Employees must have a reasonable expectation that their private communication is being monitored. If not, Article 8 ECHR is violated (Bărbulescu v. Romania)
The European Court of Human Rights (ECtHR), sitting as a Grand Chamber, issued a judgment against Romania on the grounds of a violation of Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR; right to privacy) (Bărbulescu v. Romania, judgment of 5 September 2017). Romanian citizen Bogdan Bărbulescu was dismissed in 2007 because he had used the Yahoo messenger services (through which he was supposed to respond to enquiries by customers of the employer) for private purposes, in violation of strict company policy banning employees from using this tool for private purposes. The employer had in fact monitored use of the Messenger utility by Bărbulescu and included, along with notice of summary dismissal and by way of evidence of its claims, included a 45-page transcript of his private chats with his brother (concerning matters to do with their father's company) and his fiancée (on topics including sex and health). The Romanian courts upheld the termination of employment through all instances.
The ECtHR had originally dismissed the complaint at the beginning of 2016, finding against Bărbulescu's case being one of a violation of Art. 8 ECHR according to which everyone has the right to respect for their private and family life, their home, and their correspondence, However, the Grand Chamber subsequently arrived at a different conclusion and ruled that than unannounced monitoring of means of communication and dismissal on that basis amounted to a violation of Article 8 ECtHR. According to the Grand Chamber, in principle employers have the right to monitor communications by employees, but only if certain conditions are satisfied. In this case, the Romanian courts had failed to enquire whether Bărbulescu had been instructed beforehand of the possibility of monitoring and of the manner and scope in which it would be carried out. Where this is not the case, ruled the ECtHR, there is a violation of the right to respect for private correspondence. The courts had also failed to cast light on whether there had been legitimate grounds for monitoring, and whether less intrusive alternative monitoring methods had not been available, i.e., less drastic means to put an end to the said private correspondence (such as a formal warning letter). In deviation from the previous judgments of the lower courts, the Grand Chamber of the ECtHR found that Article 8 ECHR had been violated and awarded Bărbulescu satisfaction in the amount of € 1,365.
The ECtHR concludes that monitoring at the workplace presupposes notification of the employee by the employer as to the possibility and the scope of checks; also, there must exist a legitimate reason for such monitoring. Finally, the employer must consider the application of more lenient monitoring measures and less severe sanctions than, say, termination of the employee.
While the direct applicability of this ECtHR judgment is limited to Romania, the criteria laid out above will from now on also bind other companies in Europe (with the exception of Belarus) as the Czech Republic, Germany, Poland, Slovakia, the Baltic states, Hungary, Bulgaria, etc., in their capacity as members of the Council of Europe must observe them. The judgment essentially matches the requirements for employee monitoring set by the General Data Protection Regulation (GDPR) of the EU, which is set to come into force at the end of May 2018. Of particular relevance are the general rules on permitted processing in Article 5 et seq., as well as Article 88 which provides rules for "processing in the context of employment". The very general framework drawn in these provisions corresponds to the previous framework of Sec. 28 of the German Federal Data Protection Act; the various grounds for permitted data processing that are mentioned in these provisions include, among other things, the necessity of such processing for performance under a contract or for pursuing a legitimate interest, unless the data subject has more pressing interests which prevail. Under the GDPR, employees must also be able to reasonably expect an adequate level of monitoring.