By Paul Menham
The case of Barbulescu v Romania has generated a significant amount of press coverage. Much of that coverage has suggested that this allows a “right to spy” on employee’s personal private messages. This may be stretching the limits of the judgment slightly.
This case involved a Romanian engineer, Mr Barbulescu. His employer requested that he set up a Yahoo Messenger account to exclusively use to contact business contacts for work purposes. The employer had a contract and company rules in place making clear that it was strictly forbidden to use work computers for personal purposes.
The employer monitored the Yahoo Messenger and discovered that Mr Barbulescu had been using the account to exchange private messages with his fiancée and brother, during work time. This was a breach of his employment contract and the company rules.
During the investigation, Mr Barbulescu denied that he had ever used Yahoo Messenger for personal purposes. Therefore his employer obtained a 45 page transcript of his usage (including the personal usage). He was dismissed for using the internet during working hours for personal purposes.
Mr Barbulescu brought a claim in the Romanian Courts which failed. Her therefore appealed to the European Court of Human Rights (ECHR) alleging that the evidence of his personal messages should have been disregarded by the court on the basis that it infringed his right Article 8 right to respect for private and family life, the home and correspondence.
The ECHR found that whilst Article 8 was engaged – the Romanian courts were perfectly entitled to consider these private messages in order to determine whether Mr Barbulescu’s dismissal was fair. The Court and his employer had only used the transcripts proportionately, in as far as was reasonably necessary to determine Mr Barbulescu’s breach and disprove his false contention that he only used Yahoo Messenger for business purposes. The ECHR found that the Court and employer had struck the appropriate balance between Mr Barbulescu’s right to privacy and the employer’s right to determine whether he was breaching his contract.
This does not mean that employers (necessarily) have the right to spy on staff’s private messages.
The ECHR made clear that it is “not unreasonable for an employer to want to verify that employees are completing their professional tasks during work hours”. That is the legitimate business interest. However employers must still act reasonably. They do not have the right to carry out unregulated unrestricted surveillance on employees’ private messages.
In this case, looking at these private messages was the only way in which the employer (or the court) could check Mr Barbulescu’s claim that he had not used his employer’s system for private messaging.
The case probably doesn’t change much in the UK. The Regulation of Investigatory Powers Act 2000 (“RIPA”) and the Data Protection Act 1998 (“DPA”) already place restrictions on an employer’s power to monitor communications. It was already the case within the UK that provided that an employer is clear that they will monitor communications, and that the employee has no expectation of privacy – that an employer may monitor employee’s communications on the employer’s systems (including personal communications).
Ensure that your employment contracts and IT policy make clear what (if any) personal use is acceptable to the business, and makes clear that monitoring will be carried out and the purpose of the monitoring. Set out clearly that employees have no reasonable expectation of privacy on work systems.
Employers have the right to monitor (with appropriate warnings) emails, Yahoo Messenger, LinkedIn accounts, work mobile phones, tablets and the like. Arguably it could apply to employee’s own personal mobile phones or equipment, if they are allowed to utilise them for work purposes and the Bring-Your-Own policy is clear about the right to monitor. However, it is significantly easier for an employer to justify monitoring of its own equipment.