Employee monitoring: when can private messages at work be read by employers?

Article

Posted by on

Summary: Contrary to various reports in the press, the new decision of the European Court of Human Rights in Barbulescu v. Romania does not give employers free rein to spy on their employees' private messages. In fact, the Court's decision is in line with existing case law on the scope of an employer's rights to monitor communications.

Contrary to various reports in the press, the European Court of Human Rights' decision in Barbulescu v. Romania does not give employers free rein to spy on their employees' private messages. In fact, the Court's decision is in line with existing case law on the scope of an employer's rights to monitor communications.

In this case, the employee had set up a Yahoo Messenger account, at the employer's request, to deal with client queries about company products. The employer monitored the Yahoo Messenger account to check that the client queries were being properly dealt with. It discovered that the employee had been using the account to send personal messages as well. The employer operated a strict policy forbidding personal use of company systems.  The employee denied misusing the system when confronted about this. He was shown evidence of the personal messages and was then disciplined and dismissed for breaching the company's policy. The employee argued that the employer had breached his right to privacy under Article 8 of the European Convention on Human Rights.

The Court decided that the employer's monitoring had been reasonable and proportionate. The employer had reasonably assumed that the Yahoo messages were work-related and it monitored them to check the quality of the communications with clients. The employee had been accessing work systems for personal use during working time, contrary to the employer's strict policy. When presenting evidence that the employee had breached company policy, the employer relied only on the Yahoo communications and didn't search for other data and documents stored on the employee's computer. Given this, the monitoring was limited in scope and proportionate in the circumstances.

What does this case mean for UK employers?

This case highlights the importance of having a clear IT and Communications Policy, setting out expected standards of conduct and explaining when monitoring may occur. When deciding whether to monitor, UK employers need to bear in mind their legal obligations, not least under data protection law. Whilst employees have an expectation of privacy at work, in keeping with the Court's decision in Barbulescu, employers can justify monitoring if it is reasonable and proportionate in the circumstances. Part 3 of the Data Protection Employment Practices Code gives guidance on this issue and recommends various steps that employers can take when deciding whether it is reasonable and proportionate to monitor, including carrying out an impact assessment and informing employees when they may be monitored.

Stay informed

Sign up to receive email alerts from our award winning Expert Insights team

Sign up now

See more insights by category

This site uses cookies to help us improve our services and your browsing experience. For further information about cookies, including about how to change your browser settings to no longer accept cookies, please view our privacy policy.