Surveillance of Internet usage in the workplace

14 January 2016 by Kate Richmond

Social Media button on a keyboard with speech bubbles.

Barbulescu v Romania, 12 January 2016 – read judgment

In December 2015, the European Court of Human Rights, by 6 votes to 1, dismissed a Romanian national’s appeal against his employer’s decision to terminate his contract for using a professional Yahoo Messenger account to send personal messages to his fiancé and brother.

Mr Barbulescu contended that his employer had breached his Article 8 right to respect for his private life and correspondence, and that the domestic courts had failed to protect his right. The Court found that there had been no such violation because the monitoring of the account by his employer had been limited and proportionate.

Background facts

Mr Barbulescu’s employers asked him to create a Yahoo Messenger account for responding to client enquiries and informed him that these communications had been monitored. The records showed that he had used the Internet for personal purposes, contrary to internal regulations. The employer’s regulations explicitly prohibited all personal use of company facilities, including computers and Internet access. The employer had accessed the Yahoo Messenger account in the belief that it had contained professional messages.

Mr Barbulescu maintained in writing that he had only used the account for professional purposes. The employer produced a transcript of his communications on Yahoo Messenger and it was not disputed that some messages contained sensitive personal data. Mr Barbulescu notified his employer that they had violated his correspondence and were accountable under the Criminal Code.

Mr Barbulescu’s employment was terminated in August 2007 for breach of the company’s internal regulations which specified that computers were not to be used for personal purposes. Mr Barbulescu challenged his employer’s decision on the basis that it was null and void since, by accessing his communications, his employer had violated his right to correspondence.

The domestic courts’ decisions

The Bucharest county court found that the employer had complied with Labour Code dismissal proceedings and Mr Barbulsecu had been informed of the employer’s regulations that prohibited personal use of company resources. The county court found that monitoring had not affected the validity of the disciplinary proceedings. Mr Barbulsecu appealed this decision contending that his Article 8 right protections extended to email communications in addition to instant messaging.

The Bucharest Court of Appeal ruled that the employers conduct had been reasonable and the monitoring of Mr Barbulsecu’s communications had been the only method of establishing if there had been a breach of the company’s internal regulations.

Relevant law

The European Court of Human Rights was concerned primarily with the following legislation: – the Data Protection Convention (1981 Council of Europe Convention for the protection of the individual with regard to automatic processing of personal data), Articles 3,5 and 8. See EU directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

The cases below were referred to in the Court’s judgment: – Halford v the United Kingdom (25 June 1997), which concerned an office landline designated for personal use. See also the more recent case of Copland v the United Kingdom (no. 62617/00, ECHR 2007 – I) where personal use was also allowed but surveillance was used to determine whether there was “excessive use”.

The Court’s Decision

The Strasbourg Court considered the Halford and Copland cases which decided that telephone calls, emails sent from work and information derived from Internet usage are prima facie covered by the notions of “private life” and “correspondence” for purposes of Article 8. The ruling in Copland suggested that in the absence of a warning regarding monitoring of these communications, the applicant had a reasonable expectation as to the privacy of those communications and this same expectation extended to emails and Internet usage.

The first question the Court asked was whether Mr Barbulsecu had a reasonable expectation of privacy when communicating using the Yahoo Messenger account that he had registered at his employer’s request. The Court distinguished the Halford and Copland cases on the basis that they accepted or at least tolerated personal use of the telephone. The Court highlighted that the complaint regarding the Article 8 violation was being raised in relation to labour law proceedings in order to prove the nullity of the employer’s decision. The Court found that the complaint was therefore limited to monitoring within the disciplinary proceedings framework and not related to the content nor the disclosure of communications.

The second question posed by the Court was whether, in view of the general prohibition imposed by his employer, Mr Barbulsecu retained a reasonable expectation that his communications would not be monitored. Reference was made to Articles 5 and 8 of the Data Protection Convention and the fact that the parties disputed whether prior notice was provided. The Court accepted that there was not a straightforward answer to this disputed fact and agreed that if no warning was provided then Mr Barbulsecu had a reasonable expectation of privacy.

The Court aimed to strike a fair balance between the competing interests of the parties by asking the third question: whether the State, in the context of its positive obligations under Article 8, struck a fair balance between the Mr Barbulsecu’s right to respect for his private life and correspondence and his employer’s interests. Given the disciplinary context of the complaint, the Court found that the employer had acted within its disciplinary powers under the Labour Code by only accessing the account on the assumption that the information related to professional activities.

The transcript of the communications was not given much weight by the Court which found that the content “was not a decisive element in domestic court’s findings” (paragraph 58). The Court considered that it was not unreasonable for an employer to want to verify that their employees were completing their professional tasks during working hours (paragraph 59). The monitoring was held to have been limited in scope and proportionate because only the Yahoo Messenger accounts had been accessed. Finally, the Court was not convinced by Mr Barbulsecu’s explanation of why the account was used for personal purposes (he maintained it was because mobile phone prices were high and work demand was low at the relevant time).

Dissenting opinion

The dissenting opinion provided by Judge Pinto de Albuquerque acknowledges the argument that Mr Barbulsecu’s Article 8 rights have been interfered with but disagrees with with conclusion of the majority of the Court that there was no violation. The judge is of the opinion that crucial factual features of the case have been overlooked. Judge Pinto de Albuquerque emphasises that the right to freedom of expression protected by ECHR Article 10 is engaged and that both Article 8 and Article 10 rights conflict with the rights and freedoms of others in this case.

The judge highlighted that Internet surveillance was not at the employer’s discretion and the employer’s right to interfere with an employee’s communication was not unrestricted. In terms of the level of protection afforded by the Convention principle regarding Internet communications, the dissenting opinion considered that the protection afforded to the communication was not lowered because

(a) the communication occurred during working hours

(b) it took place in the employment context,

(c) it had an impact on business activities, or

(d) it affected employee performance.

The judge draws the following principle from the international legal framework:

Any processing of personal data for the purposes… of breach of contractual obligations …must be regulated either by law, collective agreement, or contract. (Paragraph 9 of the transcript)

The existence of a Labour Code was not sufficient in the dissenting judge’s view. A specific, transparent set of rules including a comprehensive Internet usage policy in the workplace was required rather than a blanket ban on personal communication. Further, Judge Albuquerque contended that employees must be

(a) made aware of the Internet usage policy,

(b) notified personally, and

(c) consent explicitly (paragraph 12, page 23).

The Internet usage policy itself should be governed by the principles of necessity and proportionality and only targeted surveillance based on well founded suspicions is admissible. In relation to the Court’s second question above, the dissenting judge was not satisfied that the Government had discharged their burden of proving that Mr Barbulescu had been notified of the Internet surveillance policy. The notice provided was not signed by the employee and, even if signed, was not sufficient to justify his termination especially when it was not proven that Mr Barbulescu had caused actual damage to his employer. Alberquerque also highlighted the unnecessary interference with Mr Barbulescu’s rights by the employer in failing to ensure that the transcript was restricted to the disciplinary proceedings.

Comment

It would seem that the dissenting judgment focuses in on certain gaps in the Court’s consideration of the second question of whether Mr Barbulescu had a reasonable expectation that his communications wouldn’t be monitored. There was a clear dispute about notification and the Court seems to have proceeded on the basis that a general warning from the employer was sufficient. Given the wide ranging implications regarding the use of personal Internet communications by others in the employment context, one would think that a more specific and considered warning and notification procedure would be required.