Can employers monitor employees’ personal communications during work hours?

In the recent case of Barbulescu v Romania, the European Court of Human Rights (ECtHR) has ruled that the employee’s right to privacy under the European Convention of Human Rights (ECHR) was not breached by the employer monitoring communications sent by the employee during working hours. However, the decision in this case does not mean that employers have a free pass to monitor all personal communications sent by an employee from their work email or computer.

Mr Barbulescu used his business messenger account to send and receive personal messages of a sensitive nature during his core work hours. His employer discovered the personal messages accidentally, when monitoring the activity on his business messenger account. The transcripts of the messages were used against Mr Barbulescu in disciplinary proceedings which resulted in his dismissal.

Mr Barbulescu claimed that his employer’s use of his personal messages was in breach of his right to privacy under the ECHR. The court upheld the dismissal, and found that the personal usage was in breach of the employer’s policy on the permitted use of IT. The employer’s monitoring and use of the personal messages as evidence were also not in breach of his right to privacy.

The court commented “it is not unreasonable for an employer to want to verify that the employees are completing professional tasks during work hours”. Mr Barbulescu claimed that he believed that as he had been asked to create his own password for his business messenger account, the messages sent would be private, and that he had not been informed of the firm’s monitoring procedures.

Despite the claims raised by Mr Barbulescu, the court found that the employer’s monitoring was limited in scope (as it did not include any other documents on his computer) and therefore proportionate.

The case does not overrule current restrictions on employers’ powers to monitor employees’ private communications, such as the Data Protection Act 1998 and the Regulation of Investigatory Powers Act 2000. For example, in the case of Copland v UK the ECtHR considered that the employee’s rights to privacy were infringed as the employer had no IT policy and the employee was unaware that their communications may be monitored.

It is important that employers make sure employees are aware of their IT policies, and that the employer has included the right to monitor communications on work computers. Any IT policy should expressly forbid excessive or inappropriate personal use and state that personal communications could be used against an employee in disciplinary proceedings. It appears that as long as the monitoring is, on the facts, deemed to be sufficiently proportionate and limited in scope, the employer will be able to review correspondence sent and received without breaching the employee’s right to privacy under the ECHR.