A Legal View: Do Managers Have the Right to Monitor Employees’ Private Messages?

Senior law lecturer and barrister Peter Coe looks at the conflicting legal arguments surrounding the right to a private life at work.

I very much doubt that when Mr Bogdan Bărbelsecu created a Yahoo instant messenger (IM) account at his employer’s request to deal with customer enquiries he had any idea it would create such a storm, or would end up the subject of litigation working its way all the way up to the European Court of Human Rights (ECtHR). But it has and, in doing so, it has given us an important ruling relating to employees’ privacy in the workplace, particularly in light of the forthcoming introduction of the General Data Protection Regulation (GDPR) in May 2018.

What’s it all about?

In July 2007, Mr Bărbulescu’s employer sent a notice to all employees prohibiting personal use of the internet whilst at work. The notice also told employees that their work would be monitored. According to Mr Bărbulescu, he knew that he was not allowed to use his work computer for personal activity, but he did not realise that his communications would be monitored until after the notice had been circulated.

Not long after the notice was sent, Mr Bărbulescu’s employer began to monitor his Internet use, including how and when he used the IM account he had created. Later, Mr Bărbulescu’s employer presented him with 45 pages of private IM messages he had sent using the work account he had created. Consequently, he was dismissed.

This dismissal resulted in the litigation that ended up in the ECtHR, with Mr Bărbulescu claiming that his telephone, email and IM communications made whilst at work were subject to protection by virtue of his right to private life and correspondence pursuant to Article 8 of the European Convention on Human Rights.

What does this mean for employees and employers?

As a general rule, to determine whether Article 8 has been engaged, the court involved would consider whether the individual had a reasonable expectation of privacy. An employer’s policy, for instance, would tell an employee whether he/she has an expectation of privacy and what this looks like.

However, the ECtHR’s decision has ‘thrown the cat amongst the pigeons’. In finding that Mr Bărbulescu’s Article 8 rights had been violated by his employer the court stated: ‘…an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.’  Therefore, for the first time, we have an unequivocal statement from the ECtHR that, regardless of what an employer says, employees are subject to an irreducible minimum right to private social life whilst at work. Ultimately, this may well result in increased litigation based on Article 8 claims.

However the judgment definitely does not mean that employers monitoring in the workplace is now illegal. To the contrary, employers have a recognised, yet qualified, right to monitor their employees’ communications. The ECtHR acknowledged, on the behalf of employers, a ‘…right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.’  Thus, in cases concerning a conflict between an employee’s right to privacy and the employer’s right to ensure the smooth running of the company (by monitoring employees communications and/or internet use), a balance must be struck using the test of proportionality.

Ultimately, if monitoring measures are challenged, then the domestic court will need to consider the consequences of the monitoring process for the employee as against the consequences for the employer. What domestic courts should consider when attempting to find this balance was set out by the court. Siân McKinley, in her excellent analysis of the judgment in November’s Counsel magazine, distills the court’s guidance, Article 35 GDPR impact assessment (discussed further below) and the relevant provisions of the Information Commissioner’s Office (ICO) Employment Practices Code 2011, into five very helpful ‘practical steps for employers’ that I agree with entirely. These steps will help employers to defend their monitoring of employees’ communications against Article 8 challenges:

1. Employees should be told in advance that their employer may monitor their communications, and the way in which this will be done. The ‘nature’ of the monitoring must also be made clear. So, if an employer wants to monitor the content of communications, this must be made clear to employees before it happens.
2. Prior to monitoring their employees, employers should assess the extent of the monitoring they intend to carry out and its intrusion into employees’ privacy. In doing so, they should consider the following questions:

• Can they limit the monitoring to the flow of communications, or does content also need to be monitored?
• Do all communications need to be monitored, or will monitoring some communications suffice?
• Can the monitoring be subject to a time limit?
• Can physical limits to monitoring be imposed?
• Can the number of people who have access to the results of the monitoring be limited?

3. Legitimate reasons must be established for monitoring of the flow of communications. Due to its invasiveness, the monitoring of content will require even clearer reasons.
4. Employers should assess whether a less intrusive monitoring system could be set up. In respect of monitoring content, the employer must assess whether they could meet the legitimate reasons (see point 3) without directly accessing the full content of the communication(s).
5. The monitoring process should be constantly reviewed by the employer, including the use of the results of the operation, the consequences for employees and whether the results achieve the identified ‘legitimate reasons’.

The ECtHR judgment corresponds, to a great extent, with the existing ICO’s Employment Practices Code 2011 and the requirements, for certain situations at least, of the soon to be implemented GDPR. Thus, subject to the Court’s finding that employers cannot access the content of communications unless employees have been told beforehand that this may happen, employers’ monitoring practices should already conform to the ECtHR’s finding.

In respect of the GDPR, Article 35(9) requires that data controllers, where appropriate, seek the views of data subjects or their representatives on the processing. However, if this causes prejudice towards commercial or public interests or the security of processing operations, this would not appropriate. Thus, as McKInley observes ‘this appears to preserve the ability of businesses to carry out covert monitoring in exceptional circumstances’.

As a Senior Lecturer in Law Peter’s work focuses on three main activities: firstly, his research relating to two distinct areas of Media Law (i) defamation and the protection of corporate reputation and (ii) social media’s impact on freedom of expression, media freedom, privacy, data protection and reputation; secondly, his teaching and convenorship of Media Law and Criminal Law modules; and thirdly, his interest in employability and his role in developing and managing relationships with practice and industry partners.

Peter is a barrister, and Door Tenant, at East Anglian Chambers, and Cornwall Street Chambers where he specialises in general Civil/Commercial and Criminal Litigation. In 2016, as a result of his Media Law research, Peter joined international law firm Addleshaw Goddard (AG Integrate) as a consultant lawyer.

Founded in 1895 and a University since 1966, Aston is a long established research-led university known for its world-class teaching quality, and strong links to business and the professions. Aston University is located in Birmingham and at the heart of a vibrant city and the campus houses all the university’s academic, social and accommodation facilities for our students.  Professor Alec Cameron is the Vice Chancellor & Chief Executive.

Aston has been a leading university for graduate employment success for over 25 years and our students do extremely well in securing top jobs and careers.  Our strong relationships with industry partners mean we understand the needs of employers, which is why we are also ranked in the top 20 for graduate employability.