In September 2017, the European Court of Human Rights (the ECtHR) overturned a January 2016 decision of its lower court regarding employee privacy in the workplace which was viewed as the authority in this area. The impact of this reversal could prove significant in the context of an employer's rights to monitor and manage employee communications without impeding on an employee’s right to privacy in the workplace.

Background

Mr Barbulescu was asked by his employer to set up an instant messenger account for work purposes. The employer subsequently monitored Barbulescu’s messenger usage and observed that Barbulescu was using the account for personal reasons. Barbulescu was subsequently dismissed as this was a breach of the clear company policy on the matter. Barbulescu alleged that this was a breach of his right to privacy, as protected under Article 8 of the European Convention on Human Rights. The matter was subsequently referred to the ECtHR which held that an appropriate balance had been maintained between the privacy rights provided for under Article 8 of the Convention and the interests of the employer. Its reasoning was that Barbulescu had assured his employer that the use of the messenger service was solely for professional purposes and the employer, when accessing the messages, would have anticipated the messages to only contain work-related information. However, on appeal, in September 2017, this decision was overturned by the Grand Chamber of the ECtHR.

The Grand Chamber held that the earlier courts had failed to include a number of key considerations in determining if an employee’s right to privacy prevails over an employer’s legitimate interests in managing and monitoring communications:

• Whether an employee received prior notice about any monitoring activity. The notice must be clear regarding the nature of the monitoring and must be given in advance.
• Consideration must be given to the breadth and depth of the monitoring. In determining a breach of privacy, a distinction should be drawn between an employer monitoring the flow of communications against actually reading the content of personal communications.
• Whether an employer has provided legitimate reasons justifying monitoring the employee’s communications and their content. 
• Whether a less intrusive method achieving the same result could be used. This is inline with general data protection rules that processing should be adequate, relevant and not excessive.
• The consequences and impact that monitoring will have on the employee and the use to which the result may be put. For example, where an employee could be dismissed as a result of the findings of monitoring, then a higher standard of privacy may be needed to be afforded to the employee or the consequences need to be very clearly explained to an employee.
• Whether an employee has been provided with adequate safeguards, particularly where the monitoring activity is deemed to be intrusive. On this point, the Grand Chamber noted that the employer cannot access the actual content of the communications concerned unless the employee has been notified in advance of the employer’s intent to do so.

What is the impact of this decision for employers?

Employers should examine their policies on monitoring employees’ communications. The policy should set out the level of monitoring engaged in, the justification for the monitoring and the possible consequences for employees e.g. disciplinary procedure up to dismissal. It is clear from this judgment that employers will need to be able to demonstrate that employees are aware of the extent of any monitoring and that it is necessary and proportionate in the context of the business.

For further information or advice, you can contact Ciara McGuone, SFA Executive on 01 605 1668 or ciara.mcguone@sfa.ie.