Information Note on the Court’s case-law 210

August-September 2017

Bărbulescu v. Romania [GC] - 61496/08

Judgment 5.9.2017 [GC]

Article 8

Article 8-1

Respect for correspondence

Respect for private life

Monitoring of an employee’s use of the Internet at his place of work and use of data collected to justify his dismissal: violation

Facts – The applicant was dismissed by his employer, a private company, for using the company’s internet network during working hours in breach of the internal regulations, which prohibited personal use of company computers. Over a certain period of time, his employer had monitored his communications on a Yahoo Messenger account which he had been asked to set up for the purpose of responding to customers’ enquiries. The records produced during the domestic proceedings showed that he had exchanged messages of a strictly private nature with other people.

In the Convention proceedings, the applicant argued that the termination of his contract had been based on a breach of his right to respect for his private life and correspondence and that the domestic courts had failed to protect that right.

In a judgment of 12 January 2015 a Chamber of the Court held, by six votes to one, that there had been no violation of Article 8. In the Chamber’s view, there was no indication that the domestic authorities had failed to strike a fair balance, within their margin of appreciation, between the applicant’s right to respect for his private life under Article 8 and his employer’s interests (see Information Note 192 ).

On 6 June 2016 the case was referred to the Grand Chamber at the applicant’s request.

Law – Article 8

(a) Applicability – The kind of internet instant messaging service at issue was a form of communication enabling individuals to lead a private social life. In addition, the notion of “correspondence” covered the sending and receiving of communications, even on an employer’s computer.

The applicant had certainly been informed of the ban on personal internet use laid down in his employer’s internal regulations. However, he had not been informed in advance of the extent and nature of his employer’s monitoring activities, or of the possibility that the employer might have access to the actual contents of his communications.

It was open to question whether the employer’s restrictive regulations had left the applicant with a reasonable expectation of privacy. Be that as it may, an employer’s instructions could not reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continued to exist, even if these could be restricted in so far as necessary.

The applicant’s communications in the workplace were therefore covered by the concepts of “private life” and “correspondence”. Accordingly, Article 8 of the Convention was applicable in the present case.

(b) Merits – In the light of the particular circumstances of the case, having regard to the conclusion concerning the applicability of Article 8 and to the fact that the applicant’s enjoyment of his right to respect for his private life and correspondence had been impaired by the actions of a private employer, the complaint had to be examined from the standpoint of the State’s positive obligations.

Few member States had explicitly regulated the question of the exercise by employees of their right to respect for their private life and correspondence in the workplace. The Contracting States should therefore be granted a wide margin of appreciation in assessing the need to establish a legal framework governing the conditions in which an employer could adopt a policy regulating electronic or other communications of a non-professional nature by its employees in the workplace.

However, proportionality and procedural guarantees against arbitrary action were essential. In that context, the domestic authorities should treat the following factors as relevant: whether the employee had been notified of the possibility that the employer might take measures to monitor correspondence and other communications, and of the implementation of such measures; the extent of the monitoring by the employer and the degree of intrusion into the employee’s privacy; whether the employer had provided reasons to justify monitoring the employee’s communications; whether it would have been possible to establish a monitoring system based on less intrusive methods and measures than directly accessing the content of the employee’s communications; the consequences of the monitoring for the employee subjected to it; and whether the employee had been provided with adequate safeguards, especially when the employer’s monitoring operations had been of an intrusive nature. Lastly, the domestic authorities should ensure that employees whose communications had been monitored had access to a remedy before a judicial body with jurisdiction to determine, at least in substance, how the criteria outlined above had been observed and whether the impugned measures had been lawful.

The domestic courts had correctly identified the interests at stake – by referring explicitly to the applicant’s right to respect for his private life – and also the applicable legal principles of necessity, purpose specification, transparency, legitimacy, proportionality and security set forth in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data The domestic courts had also examined whether the disciplinary proceedings had been conducted in an adversarial manner and whether the applicant had been given the opportunity to put forward his arguments.

The applicant did not appear to have been informed in advance of the extent and nature of his employer’s monitoring activities, or of the possibility that the employer might have access to the actual content of his messages. The domestic courts had omitted to determine whether the applicant had been notified in advance of the possibility that the employer might introduce monitoring measures, and of the scope and nature of such measures. To qualify as prior notice, the warning from the employer had to be given before the monitoring activities were initiated, especially where they also entailed accessing the contents of employees’ communications.

The question of the scope of the monitoring and the degree of intrusion into the applicant’s privacy had not been examined by any domestic court, even though the employer appeared to have recorded all the applicant’s communications during the monitoring period in real time, accessed them and printed out their contents.

The domestic courts had not carried out a sufficient assessment of whether there had been legitimate reasons to justify monitoring the applicant’s communications. In addition, neither the County Court nor the Court of Appeal had sufficiently examined whether the aim pursued by the employer could have been achieved by less intrusive methods than accessing the actual contents of the applicant’s communications.

Moreover, neither court had considered the seriousness of the consequences of the monitoring and the subsequent disciplinary proceedings. In this regard, the applicant had received the most severe disciplinary sanction, namely dismissal.

The domestic courts had not determined whether, when the employer had summoned the applicant to give an explanation for his use of company resources, in particular the internet, it had in fact already accessed the content of the communications in issue. The national authorities had not established at what point during the disciplinary proceedings the employer had accessed that content. Accepting that the content of communications could be accessed at any stage of the disciplinary proceedings ran counter to the principle of transparency ( Recommendation CM/Rec(2015)5 of the Committee of Ministers to member States on the processing of personal data in the context of employment).

That being so, the domestic courts had failed to determine, in particular, whether the applicant had received prior notice from his employer of the possibility that his communications on Yahoo Messenger might be monitored; nor had they had regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or to the degree of intrusion into his private life and correspondence. In addition, they had failed to determine, firstly, the specific reasons justifying the introduction of the monitoring measures; secondly, whether the employer could have used measures entailing less intrusion into the applicant’s private life and correspondence; and thirdly, whether the communications might have been accessed without his knowledge.

Thus, notwithstanding the respondent State’s wide margin of appreciation, the domestic authorities had not afforded adequate protection of the applicant’s right to respect for his private life and correspondence and had consequently failed to strike a fair balance between the interests at stake.

Conclusion : violation (eleven votes to six).

Article 41: claim in respect of pecuniary damage rejected; finding of a violation sufficient in respect of non-pecuniary damage.

(See also the Factsheet on Workplace surveillance )

© Council of Europe/European Court of Human Rights This summary by the Registry does not bind the Court.

Click here for the Case-Law Information Notes