Contrary to various reports in the press, the European Court of Human Rights' decision in Barbulescu v. Romania does not give employers free rein to spy on their employees' private messages. In fact, the Court's decision is in line with existing case law on the scope of an employer's rights to monitor communications.
In this case, the employee had set up a Yahoo Messenger account, at the employer's request, to deal with client queries about company products. The employer monitored the Yahoo Messenger account to check that the client queries were being properly dealt with. It discovered that the employee had been using the account to send personal messages as well. The employer operated a strict policy forbidding personal use of company systems. The employee denied misusing the system when confronted about this. He was shown evidence of the personal messages and was then disciplined and dismissed for breaching the company's policy. The employee argued that the employer had breached his right to privacy under Article 8 of the European Convention on Human Rights.
The Court decided that the employer's monitoring had been reasonable and proportionate. The employer had reasonably assumed that the Yahoo messages were work-related and it monitored them to check the quality of the communications with clients. The employee had been accessing work systems for personal use during working time, contrary to the employer's strict policy. When presenting evidence that the employee had breached company policy, the employer relied only on the Yahoo communications and didn't search for other data and documents stored on the employee's computer. Given this, the monitoring was limited in scope and proportionate in the circumstances.
What does this case mean for UK employers?
This case highlights the importance of having a clear IT and Communications Policy, setting out expected standards of conduct and explaining when monitoring may occur. When deciding whether to monitor, UK employers need to bear in mind their legal obligations, not least under data protection law. Whilst employees have an expectation of privacy at work, in keeping with the Court's decision in Barbulescu, employers can justify monitoring if it is reasonable and proportionate in the circumstances. Part 3 of the Data Protection Employment Practices Code gives guidance on this issue and recommends various steps that employers can take when deciding whether it is reasonable and proportionate to monitor, including carrying out an impact assessment and informing employees when they may be monitored.