Case Summary and Outcome

The Grand Chamber of the European Court of Human rights held Romania responsible for having failed in its obligations to protect an individual’s right to privacy when it didn’t strike a fair balance between the applicant employee’s rights and the rights of his employer. The applicant had been dismissed from his job at a private company after disciplinary proceedings in which his instant messaging communications sent from a workplace computer were read by the employer in order to corroborate that he had used the company’s property for personal purposes. The applicant brought a complaint before domestic courts claiming that his dismissal was unlawful given that his employer had violated his right to privacy by illegally monitoring his private communications. Both the Bucharest County Court and the Bucharest Court of Appeal ruled that the dismissal had been lawful. However, the Grand Chamber reasoned that the domestic courts had not properly considered all relevant elements and had therefore failed to strike a fair balance between the applicant’s and employer’s rights. Because of this, it concluded that Romania had not afforded adequate protection to the applicant’s right to respect for his private life and correspondence under Article 8 of the European Convention on Human Rights (ECHR).

---

Facts

Mr. Bogdan Mihai Bărbulescu (applicant) was employed as a sales engineer by a private company in Romania (employer). At the request of his employer, he created a Yahoo Messenger account meant to be used to respond to customers’ enquiries. On December 20, 2006 the applicant signed a copy of the employer’s internal regulations which contained prohibitions regarding the use of workplace computers for personal purposes. Between July 3 and 13, 2007 the applicant signed a copy of a notice which also informed employees that they should not use the internet in the workplace for non-work matters. The notice also stated that the employer had a duty to “supervise and monitor employees’ work”. From July 5 to 13, 2007 the applicant’s communications sent and received at his workplace through his Yahoo Messenger account created at the request of his employer were recorded in real time by the employer.

On July 13, 2007 the applicant was summoned by his employer and informed that his Yahoo Messenger communications had been monitored and that there was evidence that he had been using it for personal communications as his internet activity was greater in comparison to that of his co-workers. The summoning note did not indicate whether the actual content of the communications had also been monitored. The same day the applicant responded in writing that he had only used Yahoo Messenger for work-related purposes.

Later that day, the applicant was summoned by the employer and asked to provide explanations regarding a 45-page transcript which contained messages the applicant had exchanged from his work Yahoo Messenger account with his brother and his fiancée during the period in which he had been monitored. The messages related to personal matters and some were of an intimate nature. The applicant then informed the employer in writing that, in his view, it had committed a criminal offense by violating the secrecy of correspondence. The employer terminated the applicant’s employment contract on August 1, 2007.

The applicant challenged the dismissal before the Bucharest County Court claiming that by monitoring his communications and accessing their content his employer had infringed criminal law which made the dismissal unlawful.  He also complained that the employer had disclosed his personal communications to others involved in the dismissal procedure. He submitted the full transcript of the communications as evidence in the proceedings.

The County Court considered that the dismissal was lawful. The Court reasoned that, because the applicant had maintained during the dismissal procedure that he had not used Yahoo Messenger for personal purposes,  an inspection of the communications’ content was the only way in which the employer could verify the validity of that argument. The Court also considered that the Labour Code invested employers with the right to monitor the use of company computers by employees and that whether the employer’s actions were illegal or not under criminal law was not material to determining the validity of the disciplinary proceedings.

The applicant then appealed to the Bucharest Court of Appeal claiming the County Court had unjustly prioritized the employer’s interest over his right to privacy. He also argued that neither the company regulations nor the notice he had been provided with  had contained any indication that his communications could be monitored. However, the Court of Appeal upheld the decision of the County Court citing the European Directive 95/45EC in support of its decision.

On September 18, 2007 the applicant lodged a criminal complaint against the statutory representatives of his employer. However, the prosecutor’s office ruled that there was no case to be pursued because the employer was the owner of the computer and the internet connection which gave him the right to monitor the employee’s internet activity. The office also noted that, as employees had been informed of the prohibition on the use of office internet for personal purposes, the monitoring had been foreseeable. Although the Romanian system provided mechanisms for the applicant to challenge the prosecuting authorities’ decision, he did not make use of these mechanisms.

The applicant then brought a petition against Romania before the European Court of Human Rights. On January 12, 2016 a chamber of the Court’s Fourth Section decided by six votes to one that, while the case concerned the applicant’s right to privacy, that right had not been violated by Romania. The Chamber highlighted that the applicant had had the opportunity to be heard by the domestic courts who had struck a fair balance, within their margin of appreciation, between the applicant’s right to respect for his private life and the employer’s interest.

The applicant requested referral to the Grand Chamber which was granted. The Grand Chamber issued its decision on September 5, 2017.

---

Decision Overview

The issue for the Grand Chamber of the European Court of Human Rights to decide was whether Romania had complied with its obligations to protect the applicant’s right to privacy.

Romania argued that the applicant’s messages sent from the workplace computer had to be considered professional, as opposed to personal, in nature; that the applicant had the opportunity to indicate that the messages were private during the disciplinary proceedings but he opted to claim they were work-related; that the applicant had been given sufficient indications that his communications could be monitored by his employer;  that the applicant had had the opportunity to challenge the alleged violation of his right to privacy through other mechanisms provided for by the Romanian legal system but he opted to only challenge the dismissal in the labor jurisdiction; and that the domestic courts had performed an appropriate balancing exercise between the applicant’s rights and the employer’s interest.

The applicant asserted that he had not received prior notification that his communications were being monitored and that the domestic courts had not given proper weight to this element in their decisions. He also argued that the domestic labor courts had jurisdiction to examine the issues relating to his right to privacy but had chosen instead to adopt a rigid approach aimed solely at upholding the employer’s decision.

The Court began its analysis by examining whether Article 8 of the European Convention on Human Rights (ECHR) was applicable to the case. For this purpose, it reviewed precedent in which it had been recognized that communications such as phone calls or e-mails sent from businesses premises were protected by the principle of privacy of correspondence. It also highlighted the principle of “expectation of privacy” as a significant but not determinant factor for assessing whether communications are protected by Article 8. It concluded that instant message communications qualified as “correspondence” even when sent from a person’s workplace.

The Court then noted that during the monitoring process both the flow and the content of the applicant’s communications had been recorded and stored by the employer. The Court also noted that, while it was clear that the applicant had been informed of the ban on the use of company internet for personal purposes, it was less clear whether the applicant had been informed prior to the monitoring that such monitoring could take place. It considered that the applicant did not appear to have been informed “of the extent and nature of his employer’s monitoring activities, or of the possibility that the employer might have access to the actual contents of his communications”. While acknowledging that it was unclear to what extent the applicant could have a reasonable expectation of privacy under the employer’s restrictive regulations, the Court concluded that Article 8 was applicable as “employer’s instructions cannot reduce private social life in the workplace to zero”. [paras. 78-80]

The Court then proceeded to analyze the extent of State’s positive obligations under Article 8, reiterating that these obligations sometimes require States to establish a legislative framework which secures respect for private life in the relations between individuals. The Court acknowledged that, given the nature of employment relations, “States must be granted a wide margin of appreciation in assessing the need to establish a legal framework governing the conditions in which an employer may regulate electronic or other communications of a non-professional nature by its employees in the workplace”. However, it considered that this discretion should not be absolute and that domestic authorities have an obligation to ensure that any measures introduced by employers to monitor employees’ communications are accompanied by sufficient safeguards against abuse [para. 115-120].

The Court then listed a number of factors domestic authorities are required to treat as relevant, these being: whether the employee has been notified of the possibility that his communications may be monitored by the employer; the extent of the monitoring and the degree of the intrusion onto the employee’s privacy; whether the employer has provided legitimate reasons to justify the monitoring; whether it would have been possible to establish a monitoring system based on less intrusive methods; the consequences of the monitoring for the employee subjected to it; and whether the employee had been provided with adequate safeguards. The Court then noted that domestic authorities have an obligation to provide employees whose communications have been monitored access to a remedy before a judicial body with jurisdiction to determine whether the relevant criteria were observed and whether the impugned measures were lawful. [para. 121]

The Court went on to assess whether the domestic courts had complied with these standards in the proceedings initiated by the applicant. The Court noted that the domestic courts had correctly identified the interests at stake and the applicable legal principles. However, it also identified several shortcomings in the review performed by the domestic courts: they had omitted to determine whether the applicant had been informed in advance of the possible monitoring of his communications and of the scope and nature of such monitoring; they had not examined whether the degree of intrusion into the applicant’s private life was acceptable even though the employer had recorded all of the employee’s communications in real time; they had not conducted an assessment of whether the employer had legitimate reasons to justify such strict monitoring; they had not considered whether the employer’s aim could have been attained through less intrusive methods; they had not sought to verify at which precise point in time the employer had accessed the content of the applicant’s communications. [para. 134-140]

Thus the Court concluded by eleven votes to six that “the domestic authorities did not afford adequate protection of the applicant’s right to respect for his private life and correspondence and that they consequently failed to strike a fair balance between the interests at stake”. [para. 141]

Judges Raimondi, Dedov, Kjølbro, Mits, Mourou-Vikström And Eicke issued a joint dissenting opinion. The dissenting judges considered that the majority had unjustifiably focused its enquiry solely on the inadequacies of the review performed by the domestic labor courts when determining whether Romania had failed in its obligation to protect the applicant’s privacy and had ignored the fact that the Romanian legal system provided the applicant with an assortment of other legal remedies for the protection of his privacy that he had failed to pursue. In these circumstances, the dissenting judges concluded that a violation of Article 8 could not be found in the absence of “any evidence to suggest that the domestic remedies either individually or cumulatively were not sufficiently available or effective to provide the protection required under Article 8”. [para. 16]

The dissenting judges also considered, unlike the majority, that the analysis made by the domestic labor courts had not been defective as they had considered the relevant elements and acted within their margin of appreciation. The dissent highlighted that the monitoring the applicant was subjected to was of a limited time, that it had only concerned his electronic communications and not other aspects of his private life, that the results of the monitoring operation had been used solely for disciplinary proceedings, and that only those involved in the proceedings had had access to them. Based on this, the dissenting judges concluded that, even adopting the majority approach, they could not find Romania had failed to protect the applicant’s privacy.

---