On 5 September 2017, the Grand Chamber of the European Court of Human Rights issued its judgment in the case of Bărbulescu v. Romania (Application no. 61496/08). The judgment will have an effect of stepping up the obligation of employers to respect privacy of communication of employees at work. This is of relevance to Serbian employers as well, given that European Convention of Human Rights (“Convention“), as interpreted by this judgment, is part of Serbian legal system.
The case involves a Romanian employer who accessed the content of private messages its employee (Bărbulescu) had exchanged through his work-related account of Yahoo Messenger while at work. Such personal use of company resources was in breach of the employer’s rules, and Bărbulescu was fired.
When the national courts rejected his challenge of the dismissal, Bărbulescu decided to bring the case before the European Court of Human Rights, in Strasbourg. He claimed breach of his right to respect for his private life and correspondence, enshrined in Article 8 of the Convention. The Fourth Section of the Court ruled in 2016 against the applicant. However, the Grand Chamber reversed, finding a violation of Article 8.
Fourth Section judgment
In its judgment of 12 January 2016, the Fourth Section of the European Court of Human Rights concluded that there had been no violation of Article 8 of the Convention, because the Romanian authorities seized of the dismissal dispute had sufficiently complied with their obligation to protect the employee’s right to privacy.
To support its decision, the Court gave important weight to the fact that the employer accessed the content of the communications only after the employee denied that he had put the company resources to personal use. Moreover, it highlighted that the access was limited in scope and proportionate to the goal pursued, for it affected only the employee’s Yahoo Messenger account, but not to other data or documents stored on the computer he used at work.
Other statements made by the Fourth Section which are worth mentioning were that the employee did not convincingly justified personal use of the company’s resources and that it is not unreasonable for an employer to want to verify that its employees use working hours to completing their professional tasks.
The judgment of the Grand Chamber
The Grand Chamber took an opposite position to that of the Fourth Chamber. In its judgment, the Grand Chamber determined that the Romanian courts seized of the employment dispute failed to consider the criteria that should be applied when assessing whether an employer’s measures to monitor communications are proportionate to the aim pursued and whether the employee concerned is protected against arbitrariness. The Grand Chamber explained that, to carry out the assessment, national authorities should determine:
- whether the employee was notified in advance of the possibility that the employer might take measures to monitor communications, and of the implementation of such measures (our understanding is that the above point obliges to make one notification only, informing about the possibility of monitoring measures being implemented. However, from the wording of the judgment it is not completely clear whether that is the case, or whether a different notice should be also served before the monitoring is actually initiated);
- the extent of the monitoring and the degree of intrusion into the employee’s privacy (e.g. whether it involves monitoring of the flow of the communications or of their content, whether it affects all communications or only part of them, whether monitoring was limited in time, etc.);
- whether the employee provided legitimate reasons to justify monitoring the communications and accessing their actual content;
- whether it would have been possible to establish a monitoring system based on less intrusive methods and measures than directly accessing the content of the communications; and
- whether the results of the monitoring were used solely to achieve the declared aim of the monitoring or for a broader purpose.
Takeaways for Serbian employers
- Notify the employees about the possibility that the employer takes measures to monitor the communications led through the company’s resources (computers, mobile and other phones, etc.). The notification should:
- define the circumstances that give right to the employer to access the employees’ communications stored on the company’s hardware;
- describe the purpose and the extent and scope of the monitoring, as well as the manner in which the communications may be accessed.
- To minimize the risk of infringing any data protection and privacy laws, incorporate the abovementioned notification in the employment agreement or in a standalone consent form.
- Consider whether the purpose of the monitoring can be achieved with a monitoring system based on methods and measures which do not require accessing the content of the communications.
- Prior to taking any measures to ensure access, pass an internal resolution outlining the reasons that justify the access to the employee’s communication, the manner in which the access will take place and the extent and scope of monitoring, as well as the reasons explaining why the intended measures are necessary and the least intrusive to the aimed purpose.
- Use the findings made through the monitoring only for the purpose determined in the notification.
