The case of Barbulescu
v. Romania (application no. 61496/08) concerned the decision of a
private company to dismiss an employee after monitoring his electronic
communications and accessing their contents, and the alleged failure of the
domestic courts to protect his right to respect for his private life and
correspondence.
The Grand Chamber of the European Court of Human Rights has held,
by eleven votes to six, that there had been a violation of Article 8 (right to
respect for private and family life, the home and correspondence) of the ECHR.
The Court concluded that the national authorities had not adequately protected
Mr Barbulescu’s right to respect for his private life and correspondence. They
had consequently failed to strike a fair balance between the interests at
stake.
In particular, the national courts had failed to determine
whether Mr Barbulescu had received prior notice from his employer of the
possibility that his communications might be monitored; nor had they had regard
either to the fact that he had not been informed of the nature or the extent of
the monitoring, or the degree of intrusion into his private life and
correspondence. In addition, the national courts had failed to determine,
firstly, the specific reasons justifying the introduction of the monitoring
measures; secondly, whether the employer could have used measures entailing
less intrusion into Mr Barbulescu’s private life and correspondence; and
thirdly, whether the communications might have been accessed without his
knowledge.
Principal facts
Bogdan Mihai Barbulescu is a Romanian national who was born
in 1979 and lives in Bucharest. From 1 August 2004 until 6 August 2007 Mr
Barbulescu was employed by a private company as an engineer in charge of sales.
At his employers’ request, he created a Yahoo Messenger account for the purpose
of responding to clients’ enquiries.
On 3 July 2007 the company circulated an information notice
among its employees which stated that one employee had been dismissed on
disciplinary grounds after she had privately used the internet, the telephone
and the photocopier.
On 13 July 2007 Mr Barbulescu was summoned by his employer
to give an explanation for his conduct. He was informed that his Yahoo
Messenger communications had been monitored and that there was evidence that he
had used the internet for personal purposes. Mr Barbulescu replied in writing
that he had only used the service for professional purposes. He was then
presented with a transcript of 45 pages of his communications from 5 to 12 July
2007, consisting of messages he had exchanged with his brother and his fiancée
relating to personal matters, some of the messages being of an intimate nature.
On 1 August 2007 the employer terminated Mr Barbulescu’s employment contract
for breach of the company’s internal regulations that prohibited the use of
company resources for personal purposes.
Mr Barbulescu challenged his employer’s decision before the
courts, complaining that the decision to terminate his contract was null and
void as his employer had violated his right to correspondence in accessing his
communications in breach of the Constitution and Criminal Code. His complaint
was rejected by the Bucharest County Court in December 2007, on the grounds, in
particular, that the employer had complied with the dismissal proceedings
provided for by the Labour Code; that employers were entitled to set rules for
the use of the internet, which was a tool made available to employees for
professional use; and that Mr Barbulescu had been duly informed of the
company’s regulations. The County Court noted that shortly before Mr
Barbulescu’s disciplinary sanction, another employee had been dismissed for
using the internet, the telephone and the photocopier for personal purposes.
Mr Barbulescu appealed, contending that the court had not
struck a fair balance between the interests at stake. In a final decision on 17
June 2008 the Court of Appeal dismissed his appeal. It essentially confirmed
the lower court’s findings. Referring to European Union Directive 95/46/EC on
data protection, it held that the employer’s conduct, after having warned Mr
Barbulescu and his colleagues that company resources should not be used for
personal purposes, had been reasonable and that the monitoring of Mr
Barbulescu’s communications had been the only method of establishing whether there
had been a disciplinary breach.
ECHR proceedings
Relying in particular on Article 8 (right to respect for
private and family life, the home and correspondence), Mr Barbulescu complained
that his employer’s decision to terminate his contract after monitoring his
electronic communications and accessing their contents was based on a breach of
his privacy and that the domestic courts failed to protect his right to respect
for his private life and correspondence.
The application was lodged with the European Court of Human
Rights on 15 December 2008. In its Chamber judgment of 12 January 2016, the
European Court of Human Rights held, by six votes to one, that there had been
no violation of Article 8 of the Convention, finding that the domestic courts
had struck a fair balance between Mr Barbulescu’s right to respect for his
private life and correspondence under Article 8 and the interests of his
employer. The Court noted, in particular, that Mr Barbulescu’s private life and
correspondence had been engaged. However, his employer’s monitoring of his
communications had been reasonable in the context of disciplinary proceedings.
On 6 June 2016 the case was referred to the Grand Chamber at Mr Barbulescu’s
request.
The Government of France and the European Trade Union
Confederation (ETUC) were granted leave to intervene in the written proceedings
as third parties.
Decision of the Court
Article 8
The Court confirmed that Article 8 was applicable in Mr
Barbulescu’s case, concluding that his communications in the workplace had been
covered by the concepts of ‘private life’ and ‘correspondence’. It noted in
particular that, although it was questionable whether Mr Barbulescu could have
had a reasonable expectation of privacy in view of his employer’s restrictive
regulations on internet use, of which he had been informed, an employer’s
instructions could not reduce private social life in the workplace to zero. The
right to respect for private life and for the privacy of correspondence
continued to exist, even if these might be restricted in so far as necessary.
While the measure complained of, namely the monitoring of Mr
Barbulescu’s communications which resulted in his dismissal, had been taken by
a private company, it had been accepted by the national courts. The Court
therefore considered that the complaint was to be examined from the standpoint
of the State’s positive obligations. The national authorities had been required
to carry out a balancing exercise between the competing interests at stake,
namely Mr Barbulescu’s right to respect for his private life, on the one hand,
and his employer’s right to take measures in order to ensure the smooth running
of the company, on the other. As to the resulting question of whether the
national authorities had struck a fair balance between those interests, the
Court first observed that the national courts had expressly referred to Mr
Barbulescu’s right to respect for his private life and to the applicable legal
principles. Notably the Court of Appeal had made reference to EU Directive
95/46/EC (the Data Protection Directive) and the principles set forth in it,
namely necessity, purpose specification, transparency, legitimacy,
proportionality and security. The national courts had also examined whether the
disciplinary proceedings had been conducted in an adversarial manner and
whether Mr Barbulescu had been given the opportunity to put forward his
arguments. However, the national courts had omitted to determine whether Mr Barbulescu
had been notified in advance of the possibility that his employer might
introduce monitoring measures, and of the nature of such measures. The County
Court had simply observed that employees’ attention had been drawn to the fact
that, shortly before Mr Barbulescu’s disciplinary sanction, another employee
had been dismissed for using the internet, the telephone and the photocopier
for personal purposes. The Court of Appeal had found that he had been warned
that he should not use company resources for personal purposes.
The Grand Chamber considered, following international and
European standards (especially the ILO Code of Practice on the Protection of
Workers‘ Personal Data of 1997 and EU Recommendation CM/Rec (2015)5 on the
processing of personal data in the context of employment), that to qualify as
prior notice, the warning from an employer had to be given before the
monitoring was initiated, especially where it entailed accessing the contents
of employees’ communications. The Court concluded, from the material in the
case file, that Mr Barbulescu had not been informed in advance of the extent
and nature of his employer’s monitoring, or the possibility that the employer
might have access to the actual contents of his messages.
As to the scope of the monitoring and the degree of
intrusion into Mr Barbulescu’s privacy, this question had not been examined by
either of the national courts, even though the employer had recorded all
communications of Mr Barbulescu during the monitoring period in real time and
had printed out their contents. Nor had the national courts carried out a
sufficient assessment of whether there had been legitimate reasons to justify
monitoring Mr Barbulescu’s communications. The County Court had referred, in
particular, to the need to avoid the company’s IT systems being damaged or
liability being incurred by the company in the event of illegal activities
online. However, these examples could only be seen as theoretical, since there
was no suggestion that Mr Barbulescu had actually exposed the company to any of
those risks. Furthermore, neither of the national courts had sufficiently
examined whether the aim pursued by the employer could have been achieved by
less intrusive methods than accessing the contents of Mr Barbulescu’s
communications. Moreover, neither court had considered the seriousness of the
consequences of the monitoring and the subsequent disciplinary proceedings,
namely the fact that – being dismissed – he had received the most severe
disciplinary sanction. Finally, the courts had not established at what point
during the disciplinary proceedings the employer had accessed the relevant
content, in particular whether he had accessed the content at the time he summoned
Mr Barbulescu to give an explanation for his use of company resources.
Having regard to those considerations, the Court concluded
that the national authorities had not adequately protected Mr Barbulescu’s
right to respect for his private life and correspondence and that they had
consequently failed to strike a fair balance between the interests at stake.
There had therefore been a violation of Article 8.
Just satisfaction (Article 41)
The Court held that the finding of a violation constituted
in itself sufficient just satisfaction for the non-pecuniary damage sustained
by Mr Barbulescu.
Separate opinions
Judge Karakas expressed a partly dissenting opinion. Judges
Raimondi, Dedov, Kjølbro, Mits, Mourou-Vikström and Eicke expressed a joint
dissenting opinion. These opinions are annexed to the judgment.
The full judgment in English, including some interesting
material in the dissenting opinions, is available here.
Laurence Eastham writes:
One cannot help but feel that this is a judgment pertaining
to facts arising in another age. The idea that an employee might not use the
internet for personal purposes during working hours is a tricky one to get your
head round in 2017. Monitoring for illegal use of the internet is though still
a live issue and the judgment remains important.
There are basic principles here: employers must make sure their
policies are clear and give clear notice to employees before monitoring.
Employers must also limit monitoring to what is necessary to guard against
improper use.
This is a message that has been sent out to employers in the UK for some time. Whether they have all listened is another matter.
