*/
Media speculation that employers can no longer monitor their employees’ communications is misleading and unhelpful, writes Siân McKinley
In September 2017, when the Grand Chamber of the European Court of Human Rights (ECtHR) released its judgment in Barbulescu v Romania (App No. 61496/08), some newspapers reported this as a landmark ruling which ‘heralds the end of snooping bosses spying on workers’ emails and instant chats’ (see, for example, The Telegraph, 5 September 2017: bit.ly/2yKa2fE). The British press was previously accused of whipping up a ‘misinformed media storm’ by printing ‘inaccurate scare stories’ over the earlier decision of the Chamber in January 2016. This ‘new benchmark’ of careless reporting prompted the ECtHR to issue a statement explaining its role.
This case is an important ruling for privacy in the workplace, but not for the reason the press claims. Media speculation that employers can no longer monitor the communications of their employees is misleading and unhelpful. As is so commonly the case, the real picture is much more nuanced.
What is the actual position?
The case involved an instant messaging account which Mr Barbulescu created at his employer’s request. On 3 July 2007 the employer circulated an information notice which prohibited personal use of the internet and informed all employees that their work would be monitored. Shortly afterwards the employer began recording Barbulescu’s instant messaging communications. Barbulescu was already aware that personal computer use was prohibited but he did not see that his communications would be monitored until some point after the information notice had been circulated. It was not clear exactly when.
On 13 July 2007 he was told that his communications had been monitored and shown evidence that his internet activity was greater than that of his colleagues. At this stage Barbulescu claimed he had only used the instant messaging service for work-related purposes. An hour later, Barbulescu was shown 45 pages of messages of private messages he had sent. Barbulescu was dismissed and challenged his dismissal in the Romanian domestic courts. The domestic courts dismissed his claim. Before the Chamber and the Grand Chamber of the European Court, Barbulescu alleged that his telephone and email communications from this workplace were protected by his right to private life and correspondence under Art 8 of the European Convention on Human Rights.
What the court held
The Grand Chamber upheld Barbulescu’s claim and held that his Art 8 rights had been violated. When coming to this decision, the ECtHR stated that ‘an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.’ It is most likely this comment which led to the proclamations in the press that employers will no longer have access to employees’ emails.
Legally, this is an interesting statement of principle. This is the first time the ECtHR has said there is an irreducible minimum right to private social life in the workplace.
When considering whether an individual’s Art 8 rights have been engaged, it has always been relevant, although not determinative, whether individuals had a reasonable expectation that their privacy would be respected and protected. Normally the actions of an employer inform the employee as to whether he has a reasonable expectation of privacy and shape what that expectation looks like.
Now we know, no matter what an employer does, that it can’t completely reduce the reasonable expectations of privacy. This increases the chances that employees’ Art 8 rights will be engaged. This is not the end of the road for monitoring in the workplace, however. The ECtHR also acknowledged that employers have a legitimate interest in ensuring the smooth running of the organisation and a ‘right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.’
Once Art 8 has been engaged, there must be a balance between the employee’s right to private life and the employer’s interests. The proportionality test is used to determine where the fair balance must be struck between these competing interests. The ECtHR set out what the domestic courts should look for when weighing the employee’s right to respect for his private life and correspondence against the employer’s right to engage in monitoring.
Practical steps for employers
It’s important to remember that the ECtHR did not consider whether the private employer acted correctly, but rather whether the domestic courts adequately protected the employee’s right to private life when considering his challenge against his dismissal. However, this part of the judgment is still useful for employers wishing to monitor communications. Taking the following steps will make it easier for employers to defend such measures against challenges:
Impact assessment and the GDPR
The Information Commissioner’s Office already recommends that, before any monitoring is carried out, an impact assessment is conducted. This impact assessment should take a very similar form to the guidance set out above. Employers should identify the purpose of the monitoring, its benefit, the adverse impact on the employees and whether there are less invasive means of achieving the employer’s aim (Employment Practices Code, 2011).
Under the General Data Protection Regulation (GDPR), which comes into force from May 2018, organisations must carry out an impact assessment if they wish to carry out a type of processing which is likely to result in a high risk to the rights and freedoms of individuals.
An impact assessment is required if the data controller intends to carry out systemic monitoring of a publicly accessible area on a large scale. There is no guidance on this provision but it could conceivably include monitoring of a telephone system used both by employees and the public (eg in a call centre or workplace in professional services or local authority). An impact assessment is also required if a type of processing would use new technology. It is possible that monitoring of employees’ communications would fall within this category.
The impact assessment under Art 35 of the GDPR requires the controller to carry out many of the same acts identified by the ECtHR in Barbulescu and by the ICO in the Employment Practices Code 2011.
Expectations of employers
So, although the guidance produced by the ECtHR appears onerous for employers, it is largely in line with what is already expected of employers and what will be required of businesses in certain circumstances from May 2018. The main difference is the suggestion by the ECtHR that employers must not be able to access the actual content of the communications concerned unless employees have been notified in advance that this may happen. Under the Employment Practices Code 2011, the ICO recommended workers should be aware of the nature, extent and reasons for any monitoring, but did accept that in exceptional circumstances covert monitoring could be justified. The ECtHR in its judgment does not mention this as a possibility.
The GDPR requires controllers, where appropriate, to seek the views of data subjects or their representatives on the processing (eg the monitoring). However, Art 35(9) states this would not be appropriate if it would prejudice the protection of commercial or public interests or the security of processing operations. This appears to preserve the ability of businesses to carry out covert monitoring in exceptional circumstance. As previously stated, the GDPR will be part of domestic law from next year. It is worth remembering that, in the UK, the Human Rights Act 1998 requires judges to take the decisions of the ECtHR into account, but there is no obligation to follow them.
Balancing act
It is therefore not the case that employers cannot monitor their employees’ communications, as the British press suggested. On the contrary, the ECtHR recognised businesses have a qualified right to engage in monitoring. The most important point for employers is to be aware that there needs to be a case-by-case balancing act. Monitoring which invades employees’ privacy to a greater degree will require stronger arguments in justification and, in most cases, a greater degree of warning.
In September 2017, when the Grand Chamber of the European Court of Human Rights (ECtHR) released its judgment in Barbulescu v Romania (App No. 61496/08), some newspapers reported this as a landmark ruling which ‘heralds the end of snooping bosses spying on workers’ emails and instant chats’ (see, for example, The Telegraph, 5 September 2017: bit.ly/2yKa2fE). The British press was previously accused of whipping up a ‘misinformed media storm’ by printing ‘inaccurate scare stories’ over the earlier decision of the Chamber in January 2016. This ‘new benchmark’ of careless reporting prompted the ECtHR to issue a statement explaining its role.
This case is an important ruling for privacy in the workplace, but not for the reason the press claims. Media speculation that employers can no longer monitor the communications of their employees is misleading and unhelpful. As is so commonly the case, the real picture is much more nuanced.
What is the actual position?
The case involved an instant messaging account which Mr Barbulescu created at his employer’s request. On 3 July 2007 the employer circulated an information notice which prohibited personal use of the internet and informed all employees that their work would be monitored. Shortly afterwards the employer began recording Barbulescu’s instant messaging communications. Barbulescu was already aware that personal computer use was prohibited but he did not see that his communications would be monitored until some point after the information notice had been circulated. It was not clear exactly when.
On 13 July 2007 he was told that his communications had been monitored and shown evidence that his internet activity was greater than that of his colleagues. At this stage Barbulescu claimed he had only used the instant messaging service for work-related purposes. An hour later, Barbulescu was shown 45 pages of messages of private messages he had sent. Barbulescu was dismissed and challenged his dismissal in the Romanian domestic courts. The domestic courts dismissed his claim. Before the Chamber and the Grand Chamber of the European Court, Barbulescu alleged that his telephone and email communications from this workplace were protected by his right to private life and correspondence under Art 8 of the European Convention on Human Rights.
What the court held
The Grand Chamber upheld Barbulescu’s claim and held that his Art 8 rights had been violated. When coming to this decision, the ECtHR stated that ‘an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.’ It is most likely this comment which led to the proclamations in the press that employers will no longer have access to employees’ emails.
Legally, this is an interesting statement of principle. This is the first time the ECtHR has said there is an irreducible minimum right to private social life in the workplace.
When considering whether an individual’s Art 8 rights have been engaged, it has always been relevant, although not determinative, whether individuals had a reasonable expectation that their privacy would be respected and protected. Normally the actions of an employer inform the employee as to whether he has a reasonable expectation of privacy and shape what that expectation looks like.
Now we know, no matter what an employer does, that it can’t completely reduce the reasonable expectations of privacy. This increases the chances that employees’ Art 8 rights will be engaged. This is not the end of the road for monitoring in the workplace, however. The ECtHR also acknowledged that employers have a legitimate interest in ensuring the smooth running of the organisation and a ‘right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.’
Once Art 8 has been engaged, there must be a balance between the employee’s right to private life and the employer’s interests. The proportionality test is used to determine where the fair balance must be struck between these competing interests. The ECtHR set out what the domestic courts should look for when weighing the employee’s right to respect for his private life and correspondence against the employer’s right to engage in monitoring.
Practical steps for employers
It’s important to remember that the ECtHR did not consider whether the private employer acted correctly, but rather whether the domestic courts adequately protected the employee’s right to private life when considering his challenge against his dismissal. However, this part of the judgment is still useful for employers wishing to monitor communications. Taking the following steps will make it easier for employers to defend such measures against challenges:
Impact assessment and the GDPR
The Information Commissioner’s Office already recommends that, before any monitoring is carried out, an impact assessment is conducted. This impact assessment should take a very similar form to the guidance set out above. Employers should identify the purpose of the monitoring, its benefit, the adverse impact on the employees and whether there are less invasive means of achieving the employer’s aim (Employment Practices Code, 2011).
Under the General Data Protection Regulation (GDPR), which comes into force from May 2018, organisations must carry out an impact assessment if they wish to carry out a type of processing which is likely to result in a high risk to the rights and freedoms of individuals.
An impact assessment is required if the data controller intends to carry out systemic monitoring of a publicly accessible area on a large scale. There is no guidance on this provision but it could conceivably include monitoring of a telephone system used both by employees and the public (eg in a call centre or workplace in professional services or local authority). An impact assessment is also required if a type of processing would use new technology. It is possible that monitoring of employees’ communications would fall within this category.
The impact assessment under Art 35 of the GDPR requires the controller to carry out many of the same acts identified by the ECtHR in Barbulescu and by the ICO in the Employment Practices Code 2011.
Expectations of employers
So, although the guidance produced by the ECtHR appears onerous for employers, it is largely in line with what is already expected of employers and what will be required of businesses in certain circumstances from May 2018. The main difference is the suggestion by the ECtHR that employers must not be able to access the actual content of the communications concerned unless employees have been notified in advance that this may happen. Under the Employment Practices Code 2011, the ICO recommended workers should be aware of the nature, extent and reasons for any monitoring, but did accept that in exceptional circumstances covert monitoring could be justified. The ECtHR in its judgment does not mention this as a possibility.
The GDPR requires controllers, where appropriate, to seek the views of data subjects or their representatives on the processing (eg the monitoring). However, Art 35(9) states this would not be appropriate if it would prejudice the protection of commercial or public interests or the security of processing operations. This appears to preserve the ability of businesses to carry out covert monitoring in exceptional circumstance. As previously stated, the GDPR will be part of domestic law from next year. It is worth remembering that, in the UK, the Human Rights Act 1998 requires judges to take the decisions of the ECtHR into account, but there is no obligation to follow them.
Balancing act
It is therefore not the case that employers cannot monitor their employees’ communications, as the British press suggested. On the contrary, the ECtHR recognised businesses have a qualified right to engage in monitoring. The most important point for employers is to be aware that there needs to be a case-by-case balancing act. Monitoring which invades employees’ privacy to a greater degree will require stronger arguments in justification and, in most cases, a greater degree of warning.
Media speculation that employers can no longer monitor their employees’ communications is misleading and unhelpful, writes Siân McKinley
The beginning of the legal year offers the opportunity for a renewed commitment to justice and the rule of law both at home and abroad
By Louise Crush of Westgate Wealth Management sets out the key steps to your dream property
A centre of excellence for youth justice, the Youth Justice Legal Centre provides specialist training, an advice line and a membership programme
By Kem Kemal of Henry Dannell
By Ashley Friday of AlphaBiolabs
Providing bespoke mortgage and protection solutions for barristers
Joanna Hardy-Susskind speaks to those walking away from the criminal Bar
From a traumatic formative education to exceptional criminal silk – Laurie-Anne Power KC talks about her path to the Bar, pursuit of equality and speaking out against discrimination (not just during Black History Month)
Yasmin Ilhan explains the Law Commission’s proposals for a quicker, easier and more effective contempt of court regime
Irresponsible use of AI can lead to serious and embarrassing consequences. Sam Thomas briefs barristers on the five key risks and how to avoid them
James Onalaja concludes his two-part opinion series
