Is the monitoring of employees still possible in light of the ECHR – Barbulescu v. Romania case and the GDPR?

Is the monitoring of employees still possible? If so, how?

In the light of the new decision of the Grand Chamber of the  European Court of Human Rights (“ECHR”)and in the context of the more restrictive new regulations in the field of data protection, imposed  by  the  General  Data  Protection  Regulation  adopted  in  2016  at  European  level  (the “GDPR”), what factors should be taken into account when considering a potential monitoring of employees?

Both the Grand Chamber and Article 29 Working Party, in its recent Opinion on the subject, in June 2017, offer very precise instructions with regard to the monitoring of employees:

• informing employees in advance on a potential monitoring – ideally, the Internal Regulation should contain from the very beginning a description of the possible scenarios in which a monitoring would be considered;
• absolute restriction on the use of electronic communication means for personal purposes cannot totally limit the employee’s right to privacy. This right does not cease to exist, irrespective of the restrictions imposed by the employer;
• the existence of a very clear and strict internal policy with respect to the monitoring of employees, especially by electronic means that may not be easily detected by the employee;
• preparing a thorough analysis of the less intrusive alternatives taken into consideration in achieving the purpose so as to avoid to the extent possible usingmonitoring means;
• Limiting the monitoring in time and space and limiting the access of employers to concrete information related to aspects such as the content of accessed web addresses, the content of communications, the location in space outside working hours;
• Limiting the access to the information that results from a surveillance and its destruction as soon as it is no longer necessary for the purpose envisaged;
• Giving the employee the possibility to opt for disconnection, in certain situations, from the means of monitoring (especially in the case of monitoring of vehicles).

Thus, the implementation of any video surveillance systems, electronic correspondence monitoring systems, even in terms of flow and not necessarily in terms of content, as well as the installation of any vehicle tracking devices, but especially the implementation of any automatic means of monitoring employees’ professional performance, should be carefully reviewed before the entry into force of the GDPR, as the sanctions that may be applied by the competent authority are very similar to those applied by the Competition Council – up to 4% of the global turnover or EUR 20 million, whichever is higher.

Case of Barbulescu

The decision of the  Grand  Chamber in the  Case of Barbulescu v.  Romania was published on 5 September 2017.

The Grand Chamber decided, by overturning the decision of June 2016 of the ECHR that, in the Case of Barbulescu v. Romania, the Romanian state authorities failed to ensure the respect of the right to privacy, in the context of employment relationships, of an employee who was dismissed on disciplinary  grounds for having  used the Internet for personal  purposes during his working hours,  based  on  evidence  obtained  by  the  employer  by  monitoring  the  employee’s  electronic communications.

Context

For a better understanding of the aspects considered by the Grand Chamber when overturning the ECHR’s decision of June 2016, we include below a brief description of the de facto context of the Barbulescu Case:

• Barbulescu, a sales employee in a Romanian private entity, was instructed by the latter to create a yahoo messenger account for the purpose of communicating with the clients of his employer;
• Barbulescu used his yahoo messenger account for both professional and private conversations;
• When his employer suspected that Barbulescu was using yahoo messenger mainly for personal purposes, to the detriment of his professional activity, the employer ordered the monitoring of the yahoo messenger account and obtained transcripts of the conversations that Mr. Barbulescu had for a period of approximately 5 days;
• Before this incident, the company had circulated an internal note whereby the employees’ attention was drawn to the fact that the use of the company’s resources for personal purposes was against the Internal Regulation, which completely prohibited such use, specifying that another employee had been dismissed as a result of a similar Mr. Barbulescu took note of both the Internal Regulation and the internal note;
• When, based on the monitoring, the employer confronted Barbulescu about his usage of the Internet which was significantly higher than the usage of his colleagues, Mr. Barbulescu argued that all his communications had a professional nature and denied using the company’s resources for personal purposes;
• At that moment, the company confronted Mr. Barculescu with the transcript of his communications on yahoo messenger and dismissed the employee on disciplinary grounds;
• Barbulescu challenged the dismissal decision before the competent national courts, invoking that the company had violated his right to correspondence and the right to privacy.
• The national courts found that the information contained in the monitored correspondence did not constitute the basis for the dismissal by the employer, that the employee had been informed of the prohibition to use the company’s resources for personal purposes and of the possible consequences, but also of the fact that he was being monitored, and the employee continued to deny the use of the Internet for personal purposes. In the light of these findings, the national courts considered that the disciplinary dismissal procedure was correctly applied by the employer and maintained the disciplinary sanction of dismissal;

• The national courts also addressed the balance between the measure taken by the employer to monitor the employee’s correspondence and concluded that, with regard to the circumstances of the case, e. the employee was informed about the monitoring and he continued to deny the use of the Internet for personal purposes, the employer had no other means of proving the use of the yahoo messenger account for personal purposes and thus, the monitoring appears as a legitimate and proportional measure in relation to the aim pursued.

In the light of the above, in the first instance, ECHR upheld the position of the national courts and decided that Romania took the measures necessary to ensure the respect of the right to privacy and secrecy of correspondence and rejected Mr. Barbulescu’s application.

Decision of the Grand Chamber of ECHR

After reassessing the case, the Grand Chamber issued a decision reflecting a different approach.

Thus, it found that at issue is whether art. 8 of the European Convention for Human Rights should be applied and whether Romania should comply with the positive obligations to ensure the respect of such rights with regard to Mr. Barbulescu.

The Grand Chamber finds that, in fact, the national courts did not properly assess the circumstances of the case and failed to analyse certain aspects of the de facto situation when it was decided that the balance between (i) the interest of the employer to supervise and control the activity of its employees and (ii) the right to privacy of the employees was struck.

Therefore, the Grand Chamber indicated that the national authorities should have taken account of the following:

• if the employer provided the proof that it had informed the employee in advance about a potential monitoring – which was not proved in this case, since the company had conducted monitoring activities during the exact period in which the employee was being informed of such monitoring;
• if the employer informed the employee of the nature and extent of the monitoring and of the degree of intrusion into the employee’s private life (monitoring of the correspondence flow or monitoring of the content of the correspondence) – in this case, there was only one simple information note about the fact that the employee’s correspondence was being monitored;
• if the employer proved a legitimate interest strong enough to justify the monitoring of the content of the correspondence – no thorough analysis of the legitimacy of the monitoring of the content of the correspondence was carried out.
• if the employee was offered sufficient protection of his rights, given the intrusive monitoring means – in this case, no safeguards to protect the employee against the intrusion into his private life were considered.

Finally, the Grand Chamber pointed to trust characterising employment relationships, as an element subsuming the above, which should always define the extent to which actions are taken by the employer hughesairco.com, on the one hand, but also, the method for assessing employees’ actions with regard to the employer, on the other hand.

This information is not legal assistance. For further details, please contact us.