In December 2008, Romanian national Mr Bogdan Mihai Bărbulescu lodged a complaint (Application no. 61496/08) with the European Court of Human Rights, alleging that his former employer’s decision to terminate his contract had been based on a breach of his right to respect for his private life and correspondence. He also claimed that the domestic courts had failed to protect his right.
The case arose shortly after Mr Bărbulescu’s dismissal from work, as an engineer in charge of sales with a private company, in 2007. Contrary to internal regulations which strictly prohibited employees from using the company’s computers and resources for personal purposes, the employee used a Yahoo Messenger account not only for responding to clients’ enquiries but also for personal purposes. His employer had monitored the private communications, and presented transcripts in Court. The Bucharest County Court dismissed the employee’s complaint; the Bucharest Court of Appeal dismissed the employee’s appeal.
The ECHR had to determine mainly whether the employer acted in breach of Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (on the right to privacy). Could the employee retain a reasonable expectation that his communications would not be monitored, in view of the general prohibition imposed by the employer? And did the State, in the context of its positive obligations under Article 8, strike a fair balance between the employee’s right to respect for his private life and correspondence, and his employer’s interests? Was the employee given prior notice that his communications could have been monitored?
By six votes to one, the ECHR concluded that:
- The employer acted within its disciplinary powers since, as the domestic courts found, it had accessed the Yahoo Messenger account on the assumption that the information in question had been related to professional activities and that such access had therefore been legitimate.
- It does not consider it unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours.
- The domestic courts relied on the transcript only to the extent that it proved the applicant’s disciplinary breach, namely that he had used the company’s computer for personal purposes during working hours. The content of the communications was not a decisive element in the domestic courts’ findings.
- There was nothing to indicate that the domestic authorities failed to strike a fair balance, within their margin of appreciation, between the applicant’s right to respect for his private life under Article 8 and his employer’s interests.
- Therefore, there was no violation of Article 8 of the Convention.
In a partly dissenting opinion, Judge Pinto of Albuquerque noted that the ECHR overlooked crucial features of the case, such as clearly establishing whether an Internet surveillance policy was duly implemented and enforced by the employer, and whether the employee explicitly agreed to such policy. Even if these were confirmed, the termination of employment was not justified. It was also unjustified for the employer to access and make transcripts of communication clearly demarked as personal, against the applicant’s explicit will and without a court order. The Judge opined that the employer’s interference went far beyond what was necessary.
Internet surveillance in the workplace is not at the employer’s discretionary power, even where there exist suspicions of cyberslacking, damage to the employer’s IT systems, disclosure of the employer’s trade secrets, etc. Strict limits should apply, and any interference must be justified by the protection of certain specific interests covered by the Convention.
A comprehensive Internet usage policy in the workplace must be put in place, and employees must consent to it explicitly. In event of alleged breaches, opportunity should be given to them to respond to such claims in a fair procedure, with judicial oversight.
The Judge also stated that ‘a blanket ban on personal use of the Internet by employees is inadmissible.’ In view of rulings by the Court’s Grand Chamber, and the French Constitutional Council, the Judge concluded that States have a positive obligation to promote and facilitate universal Internet access, including the creation of the infrastructure necessary for Internet connectivity.
The implications of this judgment are far-reaching. Insofar as digital policy is concerned, they affect: (a) the extent to which employers may surveil private communications; (b) the elements which an Internet usage policy must include (or not include); and (c) the manner in which a usage policy is enforced. The fact that the Court considers it reasonable for an employer to want to verify that the employees are completing their tasks, without delineating the extent to which communications, clearly marked as personal, can be surveilled, may shift the balance between the employee’s right to respect for his private life and correspondence, and his employer’s interests.