Can you still monitor employees’ communications?

Some businesses actively monitor their staffs’ online communications and their use of social media at work. If you do this you may need to adjust your policies to take into account a recent decision by the European Court of Human Rights. Wallace Employment solicitor, Rebecca Butler, explains the facts of the case and provides guidance on the actions you need to take, following this decision. Mr Bărbulescu worked as a salesman. His employer notified all staff that business IT equipment was not for personal use. They also told them they had a system for monitoring use of IT and that personal use would be viewed as misconduct.

Mr Bărbulescu was asked to set up a Yahoo messenger account by his employer, which he did. The employer discovered that Mr Bărbulescu was using the account extensively for personal purposes, in breach of the IT policy. They confronted him with a transcript of his communications, including his personal communications. Mr Bărbulescu had sent the majority of the messages using his work Yahoo! Messenger account but had also sent a few on his personal Yahoo account. The employer dismissed Mr Bărbulescu for breaching its IT policy. Mr Bărbulescu challenged his dismissal and brought his case all the way to the Grand Chamber of the European Court of Human Rights. He claimed that his employer and the Romanian courts had not protected his right to privacy under the European Convention on Human Rights.

The Grand Chamber acknowledged that employers have a legitimate interest to ensure their business runs smoothly. They also said employers have a “right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.”

Nevertheless, the Grand Chamber agreed with Mr Bărbulescu that his employer and the Romanian courts had not protected his privacy: “an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.”

The Grand Chamber held that the employer had breached Mr Bărbulescu’s right to privacy because they didn’t inform him of the nature and extent of the monitoring in advance. Nor did they tell him about the possibility that they might access the actual content of his communications.

The impact of this case, for an employer, is that you have only a qualified right to monitor your staff. If you do monitor your staff, you should make sure you cover these points:

1. Review and update your policies to ensure they are robust enough to allow you to monitor your employees' communications. The ICO's Employment Practices Code recommends you carry out an impact assessment before you monitor employees. You should identify the purpose of the monitoring, its benefit, the adverse impact on employees and whether there are less intrusive means of achieving the aim. For example in this case, the employer should have considered whether it could have achieved its aims without actually accessing the content of Mr Bărbulescu’s messages.

2. You should only access employees’ communications where: a) you can show you have a legitimate reason for the intrusion and can show what you are trying to protect; b) you have issued a clear notice to employees setting out the nature and extent of your monitoring, including whether you may access the content of messages as well as message flow; c) if you have a rule that staff must not use business IT equipment for personal use, you should clearly tell your staff they must not mix business and personal communications and what could happen if they do; d) you have made it clear that you will use the results of monitoring for disciplinary action or other limited purposes

3. Remember, existing UK legislation, including the Data Protection Act (and from 25 May 2018, the General Data Protection Regulation) and the Regulation of Investigatory Powers Act, regulate your power to monitor employees' private communications. They also provide employees with more effective remedies than attempting to rely on directly on the European Convention.

Finally, remember the European Court of Human Rights is not the same as the European Court of Justice so Brexit won’t directly affect this decision.

To read the judgement click here: Bărbulescu v Romania