Last month, the European Court of Human Rights (“ECHR”), in the case of Barbulescu v. Romania, issued a ruling about the rights of employers to monitor their employees’ online communications, including those via personal email and social media accounts.
The decision has attracted considerable publicity. Many headlines have implied that it gives employers carte blanche to review the private communications of employees. These headlines create a misleading impression. Closer scrutiny of the decision shows that employers must still exercise care before reviewing the communications of their employees, especially communications that are obviously private or which are through private email or social media sites. What the decision held is that although the right to privacy is engaged by an employer’s review of an employee’s private communications, an employee’s rights must be balanced against an employer’s interests in ensuring that their employees are using work time to perform job related tasks.
In this case, a Romanian company reviewed communications to ascertain whether or not their employee, Bogdan Mihai Barbulescu, had been spending too much of his working time engaged in non-work related activities. The ECHR decided that the employer’s legitimate interests in carrying out such a review outweighed the employee’s rights of privacy. As a result, Mr. Barbulescu was unable to rely on the private and personal nature of the material as a shield to prevent his employer from looking at his messages.
Mr. Barbulescu was terminated 2007 for breaching the company rule prohibiting the use of company resources for personal purposes. The employee had set up a Yahoo Messenger account at his employer’s request in order to respond to client inquiries. In July 2007 the company monitored the employee’s Yahoo Messenger account, accessing both his work account and a second personal account, and discovered that the employee had sent multiple messages regarding his health and sex life on company time. Mr. Barbulescu unsuccessfully challenged his termination in Romanian court, and appealed to the ECHR arguing that the company breached his right to privacy under the European Convention on Human Rights and was therefore prohibited from relying upon any of those private and personal communications when deciding to terminate him.
In reaching its decision, the ECHR accepted that Mr. Barbulescu’s rights to respect for his private and family life, his home, and his correspondence under Article 8 of the European Convention on Human Rights were engaged by his employer’s conduct. However, the Article 8 right is not an absolute right. Accordingly, the ECHR went on to analyze whether the employer’s monitoring of his communications pursuant to workplace rules and regulations had been reasonable in the context of disciplinary proceedings, and whether the Romanian courts had acted appropriately in balancing the employee’s rights against the interests of his employer.
In holding for the company, the ECHR focused on the fact that the company only accessed Mr. Barbulescu’s private communications because it believed that they contained professional communications. Holding that the employer was within its rights to check his messages, the ECHR stated that “it is not unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours.” Yet, the court limited this possibly broad ruling by holding that in this case the monitoring was “limited in scope and proportionate.” In other words, the decision makes very clear that any monitoring of employee’s private and personal communications must be for a legitimate purpose and be a proportionate means of achieving that purpose. In this case, that meant that any monitoring of employee internet-use was focused on company resources, tied to a company policy, limited in scope, and proportionate.
In practical terms, employers should review their policies in light of this decision to ensure that the policies explicitly provide the right to monitor electronic communications on company devices. Indeed, this decision highlights that having clear policies on electronic communications and social media use is a necessary (although not sufficient) condition of ensuring that any monitoring is lawful.