Home News Newsflash 2017 Newsflash 03.10.2017

Newsflash 03.10.2017

Attention: open in a new window. PrintPrint

Framework for the employer’s right to monitor employees’ emails

In a high-profile ruling on 5 September 2017, the European Court of Human Rights (hereinafter “the ECHR”) defined limitations for an employer monitoring the electronic communication of an employee at work, in relation to the latter’s right to privacy and correspondence.

The case involved a Romanian engineer who, asked by his employer to create a Yahoo Messenger account to answer questions from the company’s clients, had used this account for personal communication with his brother and his fiancée. The internal regulations prohibited employees from using the company’s IT resources for personal reasons, without any further specifications.

When the employee was informed on 13 July 2007 that his electronic messages had been recorded and monitored from 5 to 13 July 2007, he was summoned that same day by the employer to explain his use of the Internet for personal reasons. At first he denied such use, then reproached the employer for breaching the secrecy of his correspondence. On 1 August 2007, the employer terminated the employee’s contract for breaching the internal regulations.

The national courts accepted the termination, and the employee referred the case to the ECHR for breaching his right to privacy and correspondence, as guaranteed by article 8 of the European Convention on Human Rights (hereinafter “the Convention”).

In a judgement on 12 January 2016, the ECHR first ruled that the employee’s right to privacy and correspondence had been jeopardised, but that the monitoring of communication by the employer had been reasonable within the context of a disciplinary procedure. The case was then referred to the Grand Chamber of the ECHR, composed of 17 judges (instead of 7), whose task it was to rule on the case again.

In order to come to a decision on 5 September 2017, the Grand Chamber began by reiterating the need to strike a fair balance between the interests at stake, namely, on the one hand, the employee’s right to respect for his privacy, and on the other, the employer’s right to monitor, including, if applicable, disciplinary measures, to ensure the smooth running of his business.

The ECHR then reiterated the criteria that the national authorities must apply to determine whether the surveillance measures put in place by an employer offer sufficient and adequate guarantees, and whether the employee in question is protected against arbitrary monitoring.

The ECHR decided, in this case, that the national judges had approved the dismissal without applying these criteria, namely: 

  • making sure that the employee had been warned in advance by his employer of the possibility that his communications on Yahoo Messenger might be monitored, 
  • taking into account the fact that the employee had not been informed of the nature and the scope of the surveillance, nor of the level of intrusion into his privacy, 
  • determining concrete reasons justifying the introduction of surveillance measures, 
  • determining whether the employer might have been able to use measures that would have been less intrusive in relation to privacy and correspondence, 
  • determining whether access to the content of the employee’s communications had been possible without his knowledge.

As a result, in the end, the ECHR decided that the employee’s right to respect for his privacy and correspondence had not been sufficiently protected by the Romanian courts and that there had indeed been, in this case, a breach of article 8 of the Convention.

ECHR judgement of 5 September 2017, Case of Barbulescu v. Romania, application no. 61496/08