ECHR rules that companies must tell employees of email checks

Companies must tell employees in advance if their work email accounts are being monitored without unduly infringing their privacy, the European Court of Human Rights said in a ruling that defining the scope of corporate email monitoring. In a judgement in the case of a man fired 10 years ago for using a work messaging account to communicate with his family, the judges found that Romanian courts failed to protect the man’s private correspondence on the account because his employer had not given him prior notice it was monitoring his communications.

Email privacy has become an important issue as more people use corporate mobile phones and work addresses for personal correspondence even as employers demand the right to monitor email and computer usage to ensure staff use work email appropriately and to protect their systems.

Courts in general have sided with employers on the issue, but Peninsula Employment Law Director Alan Price believes the ruling will clarify the situation for employers and employees alike:  “The European Court of Human Rights’ judgement on the right of a Romanian worker to privacy in his email accounts clarifies the boundary for UK employers on rights to privacy in the workplace,” he said.

“In this case, the employer asked B?rbulescu to set up an email account for work purposes. He was subsequently dismissed after his employer checked his messages and found he had been sending personal messages to his brother and fiancée during working times.

“The original ECtHR judgment found that B?rbulescu ‘s right to respect for private and family life under Article 8 of the European Convention on Human Rights had not been breached. They judged that it was reasonable for employers to check whether employees were carrying out work during working hours. The decision of the Grand Chamber, however, overturns this decision. They found the employer had not struck a fair balance between the right to privacy and the employer’s right to ensure the effective running of the company.

“This decision does not mean that employers are completely prohibited from monitoring employee communications if they suspect the employee is using these for personal use during working time. However, in the future employers need to act carefully, in line with the Court’s guidance, to ensure they can lawfully take action. This will require employers to:

• Ensure they have a fair, proportionate and legitimate reason to carry out monitoring of employee communications
• Inform employees at the outset that monitoring of communications will take place – including how, when, which communications e.g. mobile, email etc. and what action can take place as a consequence of this. This will usually happen in specific policies within the employee handbook but employers may wish to periodically remind employees to minimise the risk of future complaints;
• If there isn’t a monitoring policy in place, or this isn’t specified in individual emails regarding the use of company phones, emails and internet, then these should be put in place and communicated to all staff.
• Receiving a signed notice that employees have received, read and understood this will be invaluable evidence when employers are looking to enforce these policies;
• Carry out a fair assessment to ensure the extent of any monitoring is not breaching the employee’s right to privacy;
• Review whether a less intrusive method can be used, for example, having a formal discussion with the employee to ask them whether they use workplace emails for private use, rather than simply accessing their accounts immediately.

“There is already UK case law that states secret monitoring of employee calls, emails and internet use is a breach of the right to privacy and this latest case, required to be taken in to account by UK judges, reiterates the importance for employers to get the balance right before carrying out any monitoring of employees.”

In the Romanian case, the company had presented Barbulescu with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use. Barbulescu had previously told his employer in writing that he had only used the service for professional purposes.

The European court in Strasbourg ruled by an 11-6 majority that Romanian judges, in backing the employer, had failed to protect Barbulescu’s right to private life and correspondence. The court concluded that Barbulescu had not been informed in advance of the extent and nature of his employer’s monitoring or the possibility that it might gain access to the contents of his messages. The company was not named in the ruling.

The court also said there had not been a sufficient assessment of whether there were legitimate reasons to monitor Barbulescu’s communications. There was no suggestion he had exposed the company to risks such as damage to its IT systems or liability in the case of illegal activities online.