Surveillance of Internet usage in the workplace

14 January 2016 by

Social Media button on a keyboard with speech bubbles.

Social Media button on a keyboard with speech bubbles.

Barbulescu v Romania, 12 January 2016 – read judgment

In December 2015, the European Court of Human Rights, by 6 votes to 1, dismissed a Romanian national’s appeal against his employer’s decision to terminate his contract for using a professional Yahoo Messenger account to send personal messages to his fiancé and brother.

Mr Barbulescu contended that his employer had breached his Article 8 right to respect for his private life and correspondence, and that the domestic courts had failed to protect his right. The Court found that there had been no such violation because the monitoring of the account by his employer had been limited and proportionate.

Background facts

Mr Barbulescu’s employers asked him to create a Yahoo Messenger account for responding to client enquiries and informed him that these communications had been monitored. The records showed that he had used the Internet for personal purposes, contrary to internal regulations. The employer’s regulations explicitly prohibited all personal use of company facilities, including computers and Internet access. The employer had accessed the Yahoo Messenger account in the belief that it had contained professional messages.

Mr Barbulescu maintained in writing that he had only used the account for professional purposes. The employer produced a transcript of his communications on Yahoo Messenger and it was not disputed that some messages contained sensitive personal data. Mr Barbulescu notified his employer that they had violated his correspondence and were accountable under the Criminal Code.

Mr Barbulescu’s employment was terminated in August 2007 for breach of the company’s internal regulations which specified that computers were not to be used for personal purposes. Mr Barbulescu challenged his employer’s decision on the basis that it was null and void since, by accessing his communications, his employer had violated his right to correspondence.

The domestic courts’ decisions

The Bucharest county court found that the employer had complied with Labour Code dismissal proceedings and Mr Barbulsecu had been informed of the employer’s regulations that prohibited personal use of company resources. The county court found that monitoring had not affected the validity of the disciplinary proceedings. Mr Barbulsecu appealed this decision contending that his Article 8 right protections extended to email communications in addition to instant messaging.

The Bucharest Court of Appeal ruled that the employers conduct had been reasonable and the monitoring of Mr Barbulsecu’s communications had been the only method of establishing if there had been a breach of the company’s internal regulations.

Relevant law

The European Court of Human Rights was concerned primarily with the following legislation: – the Data Protection Convention (1981 Council of Europe Convention for the protection of the individual with regard to automatic processing of personal data), Articles 3,5 and 8. See EU directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

The cases below were referred to in the Court’s judgment: – Halford v the United Kingdom (25 June 1997), which concerned an office landline designated for personal use. See also the more recent case of Copland v the United Kingdom (no. 62617/00, ECHR 2007 – I) where personal use was also allowed but surveillance was used to determine whether there was “excessive use”.

The Court’s Decision

The Strasbourg Court considered the Halford and Copland cases which decided that telephone calls, emails sent from work and information derived from Internet usage are prima facie covered by the notions of “private life” and “correspondence” for purposes of Article 8. The ruling in Copland suggested that in the absence of a warning regarding monitoring of these communications, the applicant had a reasonable expectation as to the privacy of those communications and this same expectation extended to emails and Internet usage.

The first question the Court asked was whether Mr Barbulsecu had a reasonable expectation of privacy when communicating using the Yahoo Messenger account that he had registered at his employer’s request. The Court distinguished the Halford and Copland cases on the basis that they accepted or at least tolerated personal use of the telephone. The Court highlighted that the complaint regarding the Article 8 violation was being raised in relation to labour law proceedings in order to prove the nullity of the employer’s decision. The Court found that the complaint was therefore limited to monitoring within the disciplinary proceedings framework and not related to the content nor the disclosure of communications.

The second question posed by the Court was whether, in view of the general prohibition imposed by his employer, Mr Barbulsecu retained a reasonable expectation that his communications would not be monitored. Reference was made to Articles 5 and 8 of the Data Protection Convention and the fact that the parties disputed whether prior notice was provided. The Court accepted that there was not a straightforward answer to this disputed fact and agreed that if no warning was provided then Mr Barbulsecu had a reasonable expectation of privacy.

The Court aimed to strike a fair balance between the competing interests of the parties by asking the third question: whether the State, in the context of its positive obligations under Article 8, struck a fair balance between the Mr Barbulsecu’s right to respect for his private life and correspondence and his employer’s interests. Given the disciplinary context of the complaint, the Court found that the employer had acted within its disciplinary powers under the Labour Code by only accessing the account on the assumption that the information related to professional activities.

The transcript of the communications was not given much weight by the Court which found that the content “was not a decisive element in domestic court’s findings” (paragraph 58). The Court considered that it was not unreasonable for an employer to want to verify that their employees were completing their professional tasks during working hours (paragraph 59). The monitoring was held to have been limited in scope and proportionate because only the Yahoo Messenger accounts had been accessed. Finally, the Court was not convinced by Mr Barbulsecu’s explanation of why the account was used for personal purposes (he maintained it was because mobile phone prices were high and work demand was low at the relevant time).

Dissenting opinion

The dissenting opinion provided by Judge Pinto de Albuquerque acknowledges the argument that Mr Barbulsecu’s Article 8 rights have been interfered with but disagrees with with conclusion of the majority of the Court that there was no violation. The judge is of the opinion that crucial factual features of the case have been overlooked. Judge Pinto de Albuquerque emphasises that the right to freedom of expression protected by ECHR Article 10 is engaged and that both Article 8 and Article 10 rights conflict with the rights and freedoms of others in this case.

The judge highlighted that Internet surveillance was not at the employer’s discretion and the employer’s right to interfere with an employee’s communication was not unrestricted. In terms of the level of protection afforded by the Convention principle regarding Internet communications, the dissenting opinion considered that the protection afforded to the communication was not lowered because

(a) the communication occurred during working hours

(b) it took place in the employment context,

(c) it had an impact on business activities, or

(d) it affected employee performance.

The judge draws the following principle from the international legal framework:

Any processing of personal data for the purposes… of breach of contractual obligations …must be regulated either by law, collective agreement, or contract. (Paragraph 9 of the transcript)

The existence of a Labour Code was not sufficient in the dissenting judge’s view. A specific, transparent set of rules including a comprehensive Internet usage policy in the workplace was required rather than a blanket ban on personal communication. Further, Judge Albuquerque contended that employees must be

(a) made aware of the Internet usage policy,

(b) notified personally, and

(c) consent explicitly (paragraph 12, page 23).

The Internet usage policy itself should be governed by the principles of necessity and proportionality and only targeted surveillance based on well founded suspicions is admissible. In relation to the Court’s second question above, the dissenting judge was not satisfied that the Government had discharged their burden of proving that Mr Barbulescu had been notified of the Internet surveillance policy. The notice provided was not signed by the employee and, even if signed, was not sufficient to justify his termination especially when it was not proven that Mr Barbulescu had caused actual damage to his employer. Alberquerque also highlighted the unnecessary interference with Mr Barbulescu’s rights by the employer in failing to ensure that the transcript was restricted to the disciplinary proceedings.


It would seem that the dissenting judgment focuses in on certain gaps in the Court’s consideration of the second question of whether Mr Barbulescu had a reasonable expectation that his communications wouldn’t be monitored. There was a clear dispute about notification and the Court seems to have proceeded on the basis that a general warning from the employer was sufficient. Given the wide ranging implications regarding the use of personal Internet communications by others in the employment context, one would think that a more specific and considered warning and notification procedure would be required.


  1. […] Surveillance of Internet usage in the workplace In December 2015, the European Court of Human Rights, by 6 votes to 1, dismissed a Romanian national's appeal against his employer's decision to terminate his contract for using a professional Yahoo Messenger account to send personal messages to his … Read more on UK Human Rights Blog (blog) […]

  2. […] cheers, too, to UKHumanrightsblog, who have also provided a fuller account of the case, and some of the controversies generated by […]

  3. Jonathan says:

    Nice writeup, thanks.

    I think another piece could be fruitfully written on all the BS newspapers have been writing about this case today.

Comments are closed.

Welcome to the UKHRB

This blog is run by 1 Crown Office Row barristers' chambers. Subscribe for free updates here. The blog's editorial team is:
Commissioning Editor: Jonathan Metzer
Editorial Team: Rosalind English
Angus McCullough QC David Hart QC
Martin Downs
Jim Duffy

Free email updates

Enter your email address to subscribe to this blog for free and receive weekly notifications of new posts by email.




Aarhus Abortion Abu Qatada Abuse Access to justice adoption AI air pollution air travel ALBA Allergy Al Qaeda Amnesty International animal rights Animals Anne Sacoolas anonymity Article 1 Protocol 1 Article 2 article 3 Article 4 article 5 Article 6 Article 8 Article 9 article 10 Article 11 article 13 Article 14 article 263 TFEU Artificial Intelligence Asbestos Assange assisted suicide asylum asylum seekers Australia autism badgers benefits Bill of Rights biotechnology blogging Bloody Sunday brexit Bribery British Waterways Board care homes Catholic Church Catholicism Chagos Islanders Charter of Fundamental Rights child protection Children children's rights China christianity citizenship civil liberties campaigners civil partnerships climate change clinical negligence closed material procedure Coercion Commission on a Bill of Rights common law communications competition confidentiality consent conservation constitution contact order contact tracing contempt of court Control orders Copyright coronavirus coronavirus act 2020 costs costs budgets Court of Protection covid crime criminal law Cybersecurity Damages data protection death penalty defamation DEFRA deportation deprivation of liberty derogations Detention Dignitas diplomacy diplomatic relations disability disclosure Discrimination disease divorce DNA domestic violence duty of care ECHR ECtHR Education election Employment Environment Equality Act Equality Act 2010 Ethiopia EU EU Charter of Fundamental Rights EU costs EU law European Convention on Human Rights European Court of Human Rights European Court of Justice evidence extradition extraordinary rendition Facebook Facial Recognition Family Fatal Accidents Fertility FGM Finance foreign criminals foreign office foreign policy France freedom of assembly Freedom of Expression freedom of information freedom of speech Gay marriage gay rights Gaza Gender genetics Germany Google Grenfell Gun Control hague convention Harry Dunn Health HIV home office Housing HRLA human rights Human Rights Act human rights news Human Rights Watch Huntington's Disease immigration India Indonesia injunction Inquests insurance international law internet inuit Iran Iraq Ireland islam Israel Italy IVF ivory ban Japan joint enterprise judaism judicial review Judicial Review reform Julian Assange jury trial JUSTICE Justice and Security Bill Law Pod UK legal aid legal aid cuts Leveson Inquiry lgbtq liability Libel Liberty Libya lisbon treaty Lithuania local authorities marriage Media and Censorship mental capacity Mental Capacity Act Mental Health military Ministry of Justice modern slavery morocco murder music Muslim nationality national security naturism neuroscience NHS Northern Ireland nuclear challenges nuisance Obituary ouster clauses parental rights parliamentary expenses scandal patents Pensions Personal Injury physician assisted death Piracy Plagiarism planning planning system Poland Police Politics Pope press prison Prisoners prisoner votes Prisons privacy procurement Professional Discipline Property proportionality prosecutions prostituton Protection of Freedoms Bill Protest Public/Private public access public authorities public inquiries quarantine Radicalisation refugee rehabilitation Reith Lectures Religion RightsInfo right to die right to family life Right to Privacy right to swim riots Roma Romania round-up Round Up Royals Russia saudi arabia Scotland secrecy secret justice Secret trials sexual offence shamima begum Sikhism Smoking social media social workers South Africa Spain special advocates Sports Standing starvation statelessness stem cells stop and search Strasbourg super injunctions Supreme Court Supreme Court of Canada surrogacy surveillance sweatshops Syria Tax technology Terrorism The Round Up tort Torture travel treason treaty accession trial by jury TTIP Turkey Twitter UK Ukraine universal credit universal jurisdiction unlawful detention USA US Supreme Court vicarious liability Wales War Crimes Wars Weekly Round-up Welfare Western Sahara Whistleblowing Wikileaks wildlife wind farms WomenInLaw Worboys wrongful birth YearInReview Zimbabwe


This blog is maintained for information purposes only. It is not intended to be a source of legal advice and must not be relied upon as such. Blog posts reflect the views and opinions of their individual authors, not of chambers as a whole.

Our privacy policy can be found on our ‘subscribe’ page or by clicking here.

%d bloggers like this: