In Barbulescu v Romania, a case concerning employees’ right to privacy, the European Court of Human Rights (ECHR) held that an employer could monitor and access personal messages sent by an employee during work hours from his Yahoo Messenger account. The decision, however, is not a precedent for unrestricted monitoring by employers of personal messages sent by employees during office hours.

The employee had set up a Yahoo Messenger account at his employer’s request for work purposes, and was fired for using the account at work for personal purposes, in breach of the employer’s internal regulations.  When the employee denied using Yahoo Messenger for personal purposes, the employer presented him with a forty-five page transcript of his communications with his fiancée and his brother, and subsequently used the transcript as evidence in disciplinary proceedings, and in the courts.  The Romanian courts upheld the employee’s dismissal. 

The ECHR held that the employer a legitimate right to monitor the messages to verify that the account was only being used for professional purposes.  It concluded that the employer’s monitoring was limited in scope and proportionate, as the messages on the employee’s Yahoo Messenger account were examined, but not other documents stored on his computer. Use of the transcript was also limited, since the identity of the other parties to the messages was not disclosed in the courts. Accordingly, the ECHR held that the employer had not violated the employee’s right to respect for his private life and correspondence under Article 8 of the European Convention on Human Rights (the Convention).

This ruling does not mean employers have a carte blanche to blanket monitor and access all personal emails of employees. Rather in the circumstances of the case, in particular, where there was a ban on personal use by employees of the internet at work, the ECHR found that the employer did not violate Article 8.  It is unfortunate that the ECHR did not clarify whether the employee had received prior notice that his messages would be monitored and their content access and disclosed (this issue was disputed by the parties).  Previous ECHR case-law indicates that in the absence of a warning of monitoring, an employee has a reasonable expectation of privacy.

The ECHR has jurisdiction only to interpret the Convention and its protocols. The Convention was incorporated into Irish law by the European Convention on Human Rights Act 2003, and decisions of the ECHR are of persuasive value to the Irish courts. However, the decision may be subject to review by the Grand Chamber of the ECHR. In addition, it is possible that the Irish law and EU law set higher standards of privacy, through our constitutional right to privacy and the EU Data Protection Directive 95/46/EC. Whilst the ECHR noted that this case involved the employee’s "personal data" within the meaning of EU, it did not examine the Data Protection Directive further, albeit the dissenting judge did!

This decision does not overrule prior ECHR case-law concerning employees’ right to privacy under Article 8.  In fact, the ECHR distinguished this case from previous case-law which recognised that an employee has a reasonable expectation to privacy in respect of phone calls made from work; email and internet usage, and with regard to personal belongings kept in work (as held in Halford v United Kingdom (1997); Copland v United Kingdom (2007), Peev v Bulgaria (2007) respectively), on the grounds that in those cases employees had not been prohibited from using company equipment for personal purposes.

If employers intend to engage in surveillance of employees, they should ensure that such surveillance is transparent and proportionate.  To that end, employers should put in place clear and comprehensive internet, email and phone usage policies setting out the extent and purpose of any surveillance. Any monitoring should be fair, necessary, and not excessive in respect of the concerns it seeks to allay.