Skip to content

If the newspapers are to be believed, last week saw a landmark ruling by the European Court of Human Rights (ECtHR) confirming that UK employers are free to monitor their employees' private correspondence. "Bosses can snoop through your emails" screamed The Sun, "Your boss can now read EVERY Facebook and WhatsApp message you send at WORK" warned The Daily Express (use of emphasis very much their own). Such was the extensive coverage of the case of Barbulescu v Romania that a client handed me a print-out of an article at a meeting last week to make a point about seemingly cautious advice I had given on monitoring employees' computer activities in the workplace.

So does last week's ECtHR decision mean that employers now have extensive powers to snoop on their employees' personal correspondence and has the Barbulescu radically altered the legal position here in the UK? The short answers are no and no.

What did the ECtHR in Barbulescu actually find?

The histrionic media reports do not make it in any way clear what the Barbulescu case was actually about. A brief factual summary is that Barbelescu, a Romanian national, was employed by a private company in charge of sales and, at his employer's request, he set up a Yahoo messenger account to respond to clients' enquiries. His employer then monitored his use of that account and presented evidence to show that he had used the account to send personal messages, including information about his health and sex life, contrary to the employer's internal procedures. Barbelescu was dismissed.

Barbelescu brought an unsuccessful claim before the Romanian courts challenging his dismissal, in which he argued that his employer had breached his right to correspondence enshrined in the Romanian Constitution and Criminal Code. Following an unsuccessful appeal, Barbalescu brought a claim before the ECtHR but his claim was against the Romanian state, not his employer, because individuals can only enforce the European Convention of Human Rights against public bodies, not private individuals or companies. Therefore, Barbalescu's claim was that Romanian law did not sufficiently protect his Article 8 rights to respect for his family and private life such that he was not able to bring a successful claim under Romanian labour law against his dismissal.

In this context, the ECtHR decided by a majority verdict (that means with some of the judges dissenting), that the Romanian authorities had struck a fair balance between the employer's interests and the respect for Barbalescu's private life. It would appear that "European Court finds that Romanian labour law sufficiently protects employee's right to privacy" is not an interesting enough headline for British newspapers.

What's the position for UK employers?

I suspect that the legal position for UK employers on monitoring, viewing and using employees' private messages has not changed a great deal as a result of Barbulescu. My general recommendation is that employers continue to be cautious about how, when and why they access private information about their employees.

Firstly, Barbelescu was only about the Article 8 right to private and family life. Because the European Convention can only be enforced against public bodies, public sector workers are able to enforce their Article 8 right to private and family life directly against their employers. There is already a body of ECtHR case law on privacy at work that shows that the court is willing to declare public sector employers' monitoring in certain circumstances unlawful (see the cases of Halford v UK [1997] 24 ECHR 32 and Copland v UK [2007] ECHR 253). Furthermore, private sector employers also have to be mindful of the European Convention because UK courts, including Employment Tribunals, must interpret all domestic legislation consistently with the Human Rights Act 1998 (which enshrines the European Convention into UK law). So, for example, if a tribunal is considering whether a dismissal is fair under the Employment Rights Act 1996, it must consider whether an employee's Article 8 right to a private and family life is relevant.

Secondly, employers should be mindful that any monitoring of an employee's private messages must comply with the Data Protection Act 1998, which contains a relevant Employment Practices Code, The Regulation of Investigatory Powers Act 2000 ("RIPA") and the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000. Detailed consideration of these laws is outside the scope of my article and enters the realm of data privacy law (see my colleague's article here).

Thirdly, an employer accessing private messages and monitoring employees' communications has the potential to engage a range of employment law protections. As referred to above, an Employment Tribunal should consider whether Article 8 has been breached when considering if a dismissal is unfair. However, accessing an employee's private messages could in certain circumstances be considered a discriminatory act if it would appear that a particular employee has been targeted because they have a protected characteristic. There is also the risk that accessing an employee's private correspondence could be construed as an act of victimisation under the Equality Act 2010 or detrimental treatment under whistleblowing legislation if an employee who has raised relevant complaints is suddenly targeted for monitoring.

Proceed with caution

It would be a great shame if the take home message for employers from last week's headlines is that they now have free rein to snoop on their employees. The reporting of Barbulescu has depressingly lacked nuance in the context of a legal and factual background which is complicated and rapidly changing with developments in technology. All employers have greater access to employees' personal information than ever before and the suite of laws available to protect that information were largely drafted before the explosion of digital information. How employers manage and control these new powers in their hands calls for a sensible and adult conversation on the topic. This is a legal question that is likely to keep developing - Barbulescu isn't the first case to consider the vexed issue of whether employers can access and use employees' private information and it certainly won't be the last.

This article is one of two on the case of Barbelescu v Romania 61496/08 [2016] ECHR 61. For a more detailed consideration of the information law aspects of the decision, please read Owen O'Rorke's article.

This site uses cookies to help us manage and improve the website and to analyse how visitors use our site. By continuing to use the website, you are agreeing to our use of cookies. For further information about cookies, including about how to change your browser settings to no longer accept cookies, please view our Cookie Policy. Click for more info

Back to top