ECtHR 5 September 2017 (Barbulescu), Application no. 61496/08, Privacy:

Barbulescu – v – Romania, Romanian case

ECtHR 5 September 2017 (Barbulescu), Application no. 61496/08, Privacy

In Barbulescu, the Court examined for the first time a case concerning the monitoring of an employee’s electronic communications by a private employer. The Grand Chamber decided differently from the Chamber, when it concluded that the Romanian courts, in reviewing the decision of a private employer to dismiss an employee after having monitored his electronic communications, failed to strike a fair balance between the interests at stake: namely the employee’s right to respect for his private life and correspondence, on the one hand, and his employer’s right to take measures to ensure the smooth running of the company, on the other.

Summary

In Bărbulescu, the Court examined for the first time a case concerning the monitoring of an employee’s electronic communications by a private employer.[1] The Grand Chamber decided differently from the Chamber, when it concluded that the Romanian courts, in reviewing the decision of a private employer to dismiss an employee after having monitored his electronic communications, failed to strike a fair balance between the interests at stake: namely the employee’s right to respect for his private life and correspondence, on the one hand, and his employer’s right to take measures to ensure the smooth running of the company, on the other.

Facts

The case centres on Bogdan Mihai Bărbulescu, a Romanian national who was born in 1979 and lives in Bucharest. From 1 August 2004 until 6 August 2007 Mr Bărbulescu was employed by a private company as an engineer in charge of sales.

The company had an internal regulation which prohibited the personal use of company resources. Mr Bărbulescu had acknowledged this policy and signed a copy. In addition, on 3 July 2007, the company circulated a notice amongst its employees reminding them that the personal use of company resources was prohibited and explaining that an employee had been dismissed on disciplinary grounds after she had privately used the internet, phone and photocopier for private reasons. Mr Bărbulescu acknowledged the notice and signed a copy of it.

At his employers’ request, Mr Bărbulescu created a Yahoo Messenger account for the purpose of responding to clients’ enquiries. On 13 July 2007 his employer questioned him about his usage of the account and he said he was using it purely for business. Later, his employer was able to show him 45 pages of chat transcripts with his brother and fiancée in which he discussed personal matters, some of the messages being of an intimate nature. Two weeks later, the employer fired Mr Bărbulescu for breach of the company’s internal regulations prohibiting the use of company resources for personal reasons.

National proceedings

Mr Bărbulescu challenged his employer’s decision before the courts, complaining that the decision to terminate his contract was void because his employer had violated his right to private correspondence and access to communications in breach of the Constitution and the Criminal Code. His complaint was rejected by the Bucharest County Court in December 2007 on the grounds, in particular, that the employer had complied with the dismissal proceedings provided for by the Labour Code; that employers were entitled to set rules for the use of the internet, which was a tool made available to employees for professional use; and that Mr Bărbulescu had been duly informed of the company’s regulations. The County Court noted that shortly before Mr Bărbulescu’s disciplinary sanction, another employee had been dismissed for using the internet, phone and photocopier for personal reasons.

Mr Bărbulescu appealed, contending that the court had not struck a fair balance between the interests at stake. In its final decision, on 17 June 2008, the Court of Appeal dismissed his appeal. It essentially confirmed the lower court’s findings. Referring to European Union Directive 95/46/EC on data protection, it held that the employer’s conduct, after having warned Mr Bărbulescu and his colleagues that company resources should not be used for personal purposes, had been reasonable and that the monitoring of Mr Bărbulescu’s communications had been the only way of establishing whether there had been a disciplinary breach.

He lodged an application with the European Court of Human Rights on 15 December 2008. Relying in particular on Article 8 of the European Convention on Human Rights (the right to respect for private and family life, home and correspondence), Mr Bărbulescu argued that the fact that his employer had monitored his communications and accessed their content was a breach of his privacy and that the domestic courts had failed to protect his right to respect for his private life and correspondence.

ECtHR Chamber judgment of 12 January 2016

In its Chamber judgment of 12 January 2016, the European Court of Human Rights held, by six votes to one, that there had been no violation of Article 8 of the Convention, finding that the domestic courts had struck a fair balance between Mr Bărbulescu’s right to respect for his private life and correspondence under Article 8 and the interests of his employer. This Chamber judgment was reported in EELC 2016/1 (pp. 76-80).

The Chamber noted that Mr Bărbulescu had been able to bring his case and raise his arguments before the labour courts. These courts had found that Mr Bărbulescu had committed a disciplinary offence by using the internet for personal purposes during working hours. They noted that, in terms of the conduct of the disciplinary proceedings, the employer had only accessed the contents of his communications after he had told them that he was only using the Yahoo Messenger account for work-related purposes. The Chamber further noted that the domestic courts had not based their decisions on the content of Mr Bărbulescu’s communications and that the employer’s monitoring activities had been limited to his use of Yahoo Messenger. Accordingly, the Court held that there had been no violation of Article 8.

On 6 June 2016, the case was referred to the Grand Chamber at Mr Bărbulescu’s request.

ECtHR Grand Chamber judgment of 5 September 2017

The Grand Chamber overturned the ECtHR judgment of 12 January 2016, finding that Mr Bărbulescu’s privacy rights had indeed been violated.
First, the Grand Chamber confirmed that Article 8 applied in Mr Bărbulescu’s case, concluding that his communications in the workplace were covered by the concepts of ‘private life’ and ‘correspondence’. It noted in particular that, although it was questionable whether Mr Bărbulescu could have had a reasonable expectation of privacy in view of his employer’s restrictive regulations on internet use, of which he had been informed, an employer’s instructions could not reduce private social life in the workplace to zero. The right to respect for private life and for the privacy of correspondence continued to exist, even if an employer purported to restrict them.

The Court then looked at whether the case should be examined in terms of the state’s negative or positive obligations, i.e. abstaining from violating Article 8 (negative obligation) or actively securing the effectiveness of Article 8 (positive obligation). Even though the monitoring of Mr Bărbulescu’s communications had been done by a private company, it had been accepted by the national courts (as being compliant with Article 8). The Court therefore considered that the complaint was to be examined from the standpoint of the state’s positive obligations. The national authorities had been required to carry out a balancing exercise between the competing interests at stake, namely Mr Bărbulescu’s right to respect for his private life and his employer’s right to take measures to ensure the smooth running of the company.

As to whether the national authorities had struck a fair balance between those interests, the Court first observed that the national courts had expressly referred to Mr Bărbulescu’s right to respect for his private life and to the applicable legal principles. The Court of Appeal had made reference to the relevant European Union Directive and its principles, namely necessity, specification of purpose, transparency, legitimacy, proportionality and security. However, the national courts had failed to consider whether Mr Bărbulescu had been notified in advance that his employer might monitor, or the way it might do it . The County Court had simply noted that the employees had been notified that, shortly before Mr Bărbulescu’s dismissal, another employee had been dismissed for using the internet, phone and photocopier for personal purposes. The Court of Appeal had found that he had been warned that he should not use company resources for personal purposes.

The Court considered that, in line with international and European standards, to qualify as prior notice, any warning by an employer had to be given before monitoring started, especially where it involved accessing the content of employees’ communications. The Court concluded, from the material in the case file, that Mr Bărbulescu had not been informed in advance of the extent and nature of his employer’s monitoring, nor the possibility that the employer might access to actual content of his messages.

As to the scope of the monitoring and the degree of intrusion into Mr Bărbulescu’s privacy, this had not been examined by either of the national courts, even though the employer had recorded Mr Bărbulescu’s communications during the monitoring period in real time and had printed out the content.

Nor had the national courts sufficiently assessed whether there were legitimate reasons to justify monitoring Mr Bărbulescu’s communications. The County Court had referred to the need to avoid the company’s IT systems being damaged or liability being incurred by the company in the event of illegal activities online. However, these examples were only theoretical, as there was no suggestion that Mr Bărbulescu had actually exposed the company to any of those risks.

Further, neither of the national courts had sufficiently examined whether the employer’s aim could have been achieved by less intrusive means. Moreover, neither court had considered the seriousness of the consequences of the monitoring and subsequent disciplinary proceedings, namely that he received the most severe disciplinary sanction – dismissal. Finally, the courts had not established at what point during the disciplinary proceedings the employer had accessed the content. In particular, was this already done by the time the employer summoned Mr Bărbulescu to explain his use of company resources?

The Court concluded that the national authorities had not adequately protected Mr Bărbulescu’s right to respect for his private life and correspondence and that they had failed to strike a fair balance between the interests at stake. There had therefore been a violation of Article 8.

Commentary by Andreea Suciu (Noerr, Romania)

In its judgment, the Court clearly specified the criteria to be applied by the national authorities when assessing whether the measures to monitor employees’ communications are proportionate to the objectives pursued and whether the employees are protected against arbitrary action.

This provides much appreciated clarification of the law in Romania, given that the law had been rather opaque on the limits of monitoring. It is also the first time that the Court has examined monitoring by a private employer, which has generated a lot of discussion amongst professionals, as well as the media.

It should be noted that national law had only provided general rules on the protection of private life and the inviolability of correspondence – with no limits or rules of interpretation.

The Romanian Constitution provides a right to respect for private and family life (Article 26) and guarantees the inviolability of private correspondence (Article 28). The Penal Code provides penalties for infringement, even if this was by mistake – imprisonment of between six months and three years or a fine. The Labour Code only provides that the employer has the right to supervise the way in which employees fulfill their work tasks (Article 40(1) d), but does guarantee the protection of employees’ personal data (Article 40(2)i). Because of this lack of clarity in the law, it was difficult for the Romanian Courts to establish whether the infringement was lawful or not.

Based on the Court’s findings, it is clear that employers should explain their policy to employees’ and obtain consent in advance regarding the way in which monitoring is done and what is included in it.

It is also interesting to note that the employee was not dismissed for failing to do his job, but just for using company resources for personal use. Generally, national law protects employees, especially in relation to dismissal. The ECtHR judgment could be interpreted as allowing employers that have a policy on the personal use of business resources with the with the sole purpose of dismissing unwanted employees – to do so – regardless of whether they otherwise do their job.

Nevertheless, the judgment provides new principles and limitations that employers will have to observe in order to ensure respect for private and family life, including the right to respect of the confidentiality of correspondence. These are as follows:

they must make sure employees have been notified that the employer might monitor correspondence and other communications;
they must explain the extent of any monitoring and the degree of intrusion this may cause;
they must provide legitimate reasons to justify monitoring communications, particularly where this involves accessing the content;
they must check whether it is possible to use less intrusive measures than directly accessing the content of employees’ communications;
they must consider the possible consequences of monitoring an employee;
they must ensure the employee has been provided with adequate safeguards, especially when the employer’s monitoring operations are of an intrusive nature.

However, note that it is not entirely clear whether a motivated justification for monitoring will be enough to ensure that employers avoid criminal liability for monitoring the personal correspondence of employees.

While the ECtHR found a violation of Article 8 of the Convention by the country of Romania, unfortunately Mr. Bărbulescu will not have any further solutions, according to the civil procedure provisions, to resume any legal proceedings against the employer. That being said, employers should not deem this case as approval for any violation of Article 8, as the ECtHR’s judgment has been clear and it is to be expected that national courts will judge accordingly in the future.

Notes

[1] In the case of Copland – v - United Kingdom (no. 62617/00) the Court found a violation of Article 8 of the Convention on account of the fact that the monitoring of the applicant’s telephone communications, email and internet usage was not in accordance with the law, there having been no domestic law at the relevant time to regulate monitoring. Further, the Court has already decided a significant number of cases concerning the surveillance of telephone communications and the seizure of electronic data by state authorities in the context of law enforcement and the protection of national security.