October 19, 2017
By Argyro Chatzinikolaou, (Doctoral Student), Law & Technology, Faculty of Law, Ghent University
The recent judgment of the Grand Chamber of the ECtHR in the case of Bărbulescu v Romania found that the monitoring of an employee’s email account resulted in the violation of his right to respect for private life and correspondence within the meaning of Article 8 of the ECHR. By overturning last year’s judgment of the Fourth Section, the ECtHR gave relief to many who dreaded that the latter judgment had waived privacy in the workplace. Whether we can afford to be complacent, though, depends upon the grounds on which the violation was reasoned.
The applicant, Mr Bărbulescu, was employed by a Romanian private company as a sales engineer and was asked to open a Yahoo Messenger account for professional purposes. On two occasions the applicant was notified by his employer that his communications would be monitored; however, the extent of the monitoring was not defined. Mr Bărbulescu was fired after having reportedly made use of the Yahoo Messenger account for personal reasons, despite the relevant strict prohibition. More precisely, he was informed that his communications had been monitored and that conduct contrary to internal regulations had been recorded. Although Mr Bărbulescu denied having used the account for non-professional communication, he was presented with a transcript of his communications which refuted his denial. Subsequently, the employment contract of Mr Bărbulescu was terminated, leading him to challenge his employer’s decision before the Bucharest County Court and subsequently the Bucharest Court of Appeal. After the dismissal of his appeal, Mr Bărbulescu lodged an application against Romania arguing that ‘his employer’s decision to terminate his contract had been based on a breach of his right to respect for private life and correspondence and that the domestic courts had failed to protect his right’.
The Chamber’s judgment
On 12 January 2016 the Fourth Chamber delivered a judgement with regard to Mr Bărbulescu’s case and by six votes to one found that there was no violation of Article 8. (Relevant discussion on the judgment as well as on the partly dissenting opinion of judge Pinto de Albuquerque could be found in the blog post ‘Case Law, Strasbourg: Barbulescu v Romania, Surveillance of Internet Usage in the Workplace – Kate Richmond’ ). As described in a previous post, the case was referred to the Grand Chamber on 6 June 2017.
The Grand Chamber’s judgment
Compared to the Chamber’s judgment, the Grand Chamber carried out a more extensive overview of relevant international legislation. More precisely, the UN Guidelines for the regulation of computerized personal data files and the ILO Code of Practice on the Protection of Workers’ Personal Data were additionally referred to. As expected, the Court also made a reference to the General Data Protection Regulation, among others, to Article 88 thereof. According to the wording of the article, which refers to the processing in the context of employment,
Member States may, by law or by collective agreements, provide for more specific rules to ensure protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context [..]. Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, [..] and monitoring systems of the workplace.
Moving on to its assessment, the Court reiterated the broad understanding of the ‘right to private life’ under Article 8 of the Convention and referred to previous case law which includes professional activities and communication through email in the notion of private life (see Halford v. the United Kingdom, Copland v. the United Kingdom, Niemietz v Germany). The Grand Chamber further acknowledged the need to assess whether the applicant was left with a reasonable expectation of privacy after having prior knowledge of the company’s internal regulations.
With regard to the applicability of Article 8, the Grand Chamber echoed the Chamber judgment by reaffirming that the case concerned a positive obligation of the State and the obligation to strike a fair balance between competing interests. In fact, the ECtHR underlined that “contracting Parties must be granted a wide margin of appreciation in assessing the need to establish a legal framework governing the conditions in which an employer may regulate electronic or other communications of a non-professional nature by its employees in the workplace”.
However, the Court indicated that this discretion cannot be unlimited; States should make sure that they respect the principle of proportionality along with procedural guarantees against arbitrariness. The Court went on to define general principles applicable to the assessment of the State’s positive obligation to ensure respect for private life and correspondence in an employment context. The adoption of adequate and sufficient safeguards against abuse should take into account a number of factors set out in the judgment, namely, i) whether the employee has been notified of the possibility that the employer might take measures to monitor correspondence and the implementation of such measures, ii) the extent of the monitoring and the degree of intrusion into the employee’s privacy (including a distinction between the monitoring of the flow or the content of the communications), iii) whether the employer has provided legitimate reasons to justify monitoring of the communications and accessing of their actual content, iv) whether it would have been possible to establish a monitoring system based on less intrusive measures, v) the consequences of the monitoring for the employee who is subjected to it and vi) whether the employee had been provided with adequate safeguards.
Based on the produced evidence, the Court admitted that the applicant had been informed of the company’s internal regulations, while the domestic courts had successfully identified the interests at stake. Next to the identification of the conflicting interests, the Romanian courts had also correctly indicated the applicable legal principles (principle of necessity, purpose specification, transparency, legitimacy, proportionality and security). According to the Court, though, Mr Bărbulescu was not informed on the extent and the nature of the monitoring activities or the possibility of his employer having had access to the content of the communications.
The Court additionally observed that the domestic courts did not pay attention to the scope of the monitoring, the degree of the intrusion nor to whether the monitoring was justified by legitimate reasons. In fact, the specific aim of such strict monitoring was not even identified, while neither the seriousness of the consequences for the applicant nor alternative less intrusive measures were examined.
Therefore, the Court held that Article 8 of the Convention was violated with eleven votes to six and that the domestic courts had failed to strike a fair balance between the competing interests at stake, resulting in the inadequate protection of the applicant.
Whether there is a reason to celebrate after the Grand Chamber delivered the judgment of 5 September 2017 depends on the details of the argumentation of the Court. Finding a violation of Article 8 – especially after reversing last year’s Chamber judgment – is undoubtedly to the benefit of employees. However, it does not in itself secure adequate protection of any employee within the inherently unequal employment relationship.
Compared to last year’s judgment, a more consistent reasoning and extensive assessment of facts and legislation was carried out by the Grand Chamber. Factual elements which were overlooked, despite their relevance to the balancing, were now given particular attention. Even though elements, such as the intimate content of the revealed communications, were once more not looked into, the majority of the Grand Chamber carefully considered the specific circumstances when balancing the interests at stake.
Setting out specific factors to assess the proportionality of monitoring activities serve as a useful and essential tool for delineating acceptable monitoring activities within the workplace. Given the highly fact-specific nature of the required balancing, sketching out guidelines limits the ambiguity and promises more adequate safeguards against abuse.
However, despite the indisputable importance of the Court’s findings, states are granted a wide margin of appreciation with regard to how they regulate monitoring activities undertaken by employers. The affordance of such a margin of appreciation, though, inherently carries the risk of states providing insufficient protection to employees.
Moreover, the Court’s reference to the ‘reasonable expectation of privacy’ criterion maintains the ambiguity and, in a sense, creates a paradox. To base the affordance of the right to a private life on the existence of a reasonable expectation of privacy indirectly attenuates the afforded protection. The ‘reasonable expectation of privacy’ is assessed on the basis of whether the employee was notified about the possibility of an upcoming monitoring of communications. Yet linking the affordance of the right to the employee’s perception of what is permitted puts him/her in an unfavourable position. On the one hand, the assessment of how reasonable such an expectation could be or even whether such an expectation exists in the first place is highly subjective. On the other hand, one could assume that prior knowledge implies consent to the weakening or even annihilation of the expectation of privacy. This way, the harms of monitoring, regardless of prior notification, may be essentially underestimated.
Furthermore, although the Court touched upon the issue of the justification of monitoring, it failed to underline its actual significance. The opportunity to establish the requirement of a detailed Internet surveillance policy, as proposed by Judge Pinto de Albuquerque in his partly dissenting opinion to the Chamber judgment, was not grasped.
All in all, the judgment of the Grand Chamber gives rise to mixed feelings. Overturning the decision of the Chamber is in itself a step closer to safeguarding workplace privacy; yet the legal subordination which characterizes the employment relationship accentuates the need for stricter guidelines and more explicit requirements for the monitoring of employees.