Companies must notify employees if their email accounts are being monitored, the European Court of Human Rights (ECHR) ruled on Tuesday. The landmark ruling comes in a case filed by a Romanian IT worker Bogdan Barbulescu who was fired by his employer in 2007 for using his work computer for private conversations. The ruling now demands companies make such an oversight clearly communicated with the staff without unduly infringing on their privacy.
Barbulescu had sued his employer for wrongful termination and infringing on his right to a private life
When Barbulescu's employers fired him, they also provided him with a 45-page transcript of his private Yahoo! Messenger conversations, including some messages of an intimate nature with his family. Barbulescu wasn't aware that his employer was monitoring all his online activity. While he had signed a document that said he wasn't supposed to use his work computer for private matters, his employer hadn't given him a notice that his communications were being monitored by the company.
The ECHR has now said that the Romanian courts failed to protect Barbulescu’s private correspondence. Romanian courts had previously rejected Barbulescu's complaint that his employer had violated his right to correspondence, with a judgement ruling that it was not "unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours."
"In particular, the national courts had failed to determine whether Mr Bărbulescu had received prior notice from his employer of the possibility that his communications might be monitored; nor had they had regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or the degree of intrusion into his private life and correspondence. In addition, the national courts had failed to determine, firstly, the specific reasons justifying the introduction of the monitoring measures; secondly, whether the employer could have used measures entailing less intrusion into Mr Bărbulescu’s private life and correspondence; and thirdly, whether the communications might have been accessed without his knowledge."
While courts have historically been on the side of employers, the ECHR has now set boundaries for monitoring employee activity versus honoring their privacy rights by proactively informing employees of the oversight.
"The right to respect for private life and for the privacy of correspondence continued to exist, even if these might be restricted in so far as necessary," the court said. "The Court considered, following international and European standards, that to qualify as prior notice, the warning from an employer had to be given before the monitoring was initiated, especially where it entailed accessing the contents of employees' communications."
Stephanie Raets of Belgian law firm Claeys & Engels Antwerp told Reuters that "the most important lesson learned from the judgment is that, although an employer may restrict the employees’ privacy in the workplace, it may not reduce it to zero".
EU ruling doesn't prohibit staff monitoring; sets questions for firms to justify such surveillance
The latest ruling doesn't restrict companies from monitoring email communications or firing employees for using work hours for private correspondence. ECHR's latest ruling tries to ensure that the employees are informed in advance of such monitoring and its possible consequences.
The Court also added that the companies need to explain who collects and views this data, why the monitoring is necessary, and how the process works. "A distinction should be made between monitoring of the flow of communications and of their content," the Court said.
"Whether all communications or only part of them have been monitored should also be taken into account, as should the question whether the monitoring was limited in time and the number of people who had access to the results."
The ruling will now become law in 47 countries.
