Source: http://www.ipsofactoj.com/DecidedCases/international/2016/part01/int2016(01)-008.htm
Timestamp: 2017-11-24 20:30:14
Document Index: 398265937

Matched Legal Cases: ['Application no. 61496', 'art 1', '§ 43', '§ 45', '§ 29', '§ 126', '§ 35', '§ 1', '§ 44', '§ 43', '§ 41', '§ 45', '§ 41', '§ 39', '§ 1', '§ 1', '§ 57', '§ 75', '§ 106', '§ 59', '§ 30', '§ 28', '§ 2', '§ 2', '§ 2', '§ 2', '§ 110', '§ 48', '§ 27', '§ 133', '§ 63', '§ 28', '§ 44', '§ 43', '§ 84', '§ 43', '§ 44', '§ 41', '§ 39', '§ 2', '§ 65', '§ 43']

Bărbulescu vs Romania [ECHR]
Application no. 61496/08
IpsofactoJ.com: International Cases [2016] Part 1 Case 8 [ECHR]
The applicant was represented by Mr D. Costinescu and Mr O. Juverdeanu, lawyers practising in Bucharest. The Romanian Government (“the Government”) were represented by their Agent, Ms C. Brumar, of the Ministry of Foreign Affairs.
On 13 July 2007 the employer informed the applicant that his Yahoo Messenger communications had been monitored from 5 to 13 July 2007 and that the records showed that he had used the Internet for personal purposes, contrary to internal regulations. The applicant replied in writing that he had only used Yahoo Messenger for professional purposes. When presented with a forty-five-page transcript of his communications on Yahoo Messenger, the applicant notified his employer that, by violating his correspondence, they were accountable under the Criminal Code. The forty-five pages contained transcripts of all the messages that the applicant had exchanged with his fiancée and his brother during the period when his communications had been monitored; they related to personal matters involving the applicant. The transcript also contained five short messages that the applicant had exchanged with his fiancée on 12 July 2007 using a personal Yahoo Messenger account; these messages did not disclose any intimate information.
It is strictly forbidden to disturb order and discipline within the company’s premises and especially .... to use computers, photocopiers, telephones, telex and fax machines for personal purposes.
The court takes the view that the monitoring of the [applicant]’s Yahoo Messenger communications from the company’s computer .... during working hours – regardless of whether the employer’s actions were or were not illegal (îmbracă sau nu forma ilicitului penal) – cannot affect the validity of the disciplinary proceedings in the instant case....
As long as the employees’ attention .... had been drawn to the fact that, not long before the applicant had received a disciplinary sanction, another colleague had been dismissed for having used the Internet, the telephone and the photocopiers for personal purposes and they had been warned that their activity was under surveillance (see notice no 2316 of 3 July 2007 that the applicant had signed ....) it cannot be held against the employer that he had not proven transparency and that he had not been open with regard to his activities in monitoring the use of the computers by its employees.
Some of the reasons that make the employer’s checks necessary are the possibilities that through use of the Internet employees could damage the company’s IT systems, or engage in illicit activities in the company’s name, or reveal the company’s commercial secrets.
The applicant appealed against this judgment. He claimed that e-mails were also protected by Article 8 of the Convention as pertaining to “private life” and “correspondence”. He also complained that the County Court had not allowed him to call witnesses to prove that the employer had not suffered as a result of his actions.
In view of the fact that the employer has the right and the obligation to ensure the functioning of the company and, to this end, [the right] to check the manner in which its employees complete their professional tasks, and of the fact that [the employer] holds the disciplinary power of which it can legitimately dispose and which [entitled it] to monitor and to transcribe the communications on Yahoo Messenger that the employee denied having had for personal purposes, after having been, together with his other colleagues, warned against using the company’s resources for personal purposes, it cannot be held that the violation of his correspondence (violarea secretului corespondenţei) was not the only manner to achieve this legitimate aim and that the proper balance between the need to protect his private life and the right of the employer to supervise the functioning of its business was not struck.
Anyone who unlawfully opens somebody else’s correspondence or intercepts somebody else’s conversations or communication by telephone, by telegraph or by any other long distance means of transmission shall be liable to imprisonment for between six months to three years.
’automatic processing’ includes the following operations if carried out in whole or in part by automated means: storage of data, carrying out of logical and/or arithmetical operations on those data, their alteration, erasure, retrieval or dissemination ....
to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form (....)
A proportionate response by an employer to the risks it faces taking into account the legitimate privacy and other interests of workers.
Prompt information can be easily delivered by software such as warning windows, which pop up and alert the worker that the system has detected and/or has taken steps to prevent an unauthorised use of the network.
Opening an employee’s e-mail may also be necessary for reasons other than monitoring or surveillance, for example in order to maintain correspondence in case the employee is out of office (for example due to sickness or leave) and correspondence cannot be guaranteed otherwise (for example via an autoreply or automatic forwarding).
Finally, the Government pointed out that the present case was different from the cases of Halford v the United Kingdom (25 June 1997, Reports of Judgments and Decisions 1997-III, where one of the landlines of the office had been designated for the applicant’s personal use), and Copland v the United Kingdom (no. 62617/00, ECHR 2007-I, where personal use was allowed and the surveillance aimed to determine whether the applicant had made “excessive use” of the facilities); in the instant case, the employer’s regulations explicitly prohibited all personal use of company facilities, including computers and Internet access.
Relying on the case of Niemietz v Germany (16 December 1992, Series A no. 251-B), the applicant contended that denying the protection of Article 8 on the grounds that the measure complained of related only to professional activities could lead to inequality of treatment in that such protection would be available only to persons whose professional and non-professional activities were so intermingled that they could not be distinguished. With reference to the case of Chappell v the United Kingdom (30 March 1989, Series A no. 152-A), he argued that the Court had not excluded the applicability of Article 8 of the Convention in the case of a search of the business premises.
The Court has consistently held that the notion of private life is a broad concept (see, E.B. v France [GC], no. 43546/02, § 43, 22 January 2008, and Bohlen v Germany, no. 53495/09, § 45, 19 February 2015). It encompasses, for example, the right to establish and develop relationships with other human beings, and the right to identity and personal development (Niemietz, cited above, § 29, and Fernández Martínez v Spain [GC], no. 56030/07, § 126, ECHR 2014 (extracts)). A broad reading of Article 8 does not mean, however, that it protects every activity a person might seek to engage in with other human beings in order to establish and develop such relationships. It will not, for example, protect interpersonal relations of such broad and indeterminate scope that there can be no conceivable direct link between the action or inaction of a State and a person’s private life (see, mutatis mutandis, Botta v Italy, 24 February 1998, § 35, Reports of Judgments and Decisions 1998-I).
Thus, according to the Court’s case-law, telephone calls from business premises are prima facie covered by the notions of “private life” and “correspondence” for the purposes of Article 8 § 1 (see Halford, cited above, § 44, and Amann v Switzerland [GC], no. 27798/95, § 43, ECHR 2000-II). The Court further held that e-mails sent from work should be similarly protected under Article 8, as should information derived from the monitoring of personal Internet usage (see Copland, cited above, § 41).
In the absence of a warning that one’s calls would be liable to monitoring, the applicant had a reasonable expectation as to the privacy of calls made from a work telephone (see Halford, cited above, § 45) and the same expectation should apply in relation to an applicant’s e-mail and Internet usage (see Copland, cited above, § 41). In a case in which the applicant’s workspace at a prosecutor’s office had been searched and some of his belongings had been seized (Peev v Bulgaria, no. 64209/01, 26 July 2007), the Court held that the search amounted to an interference with the applicant’s “private life”; the Court found that the applicant had a reasonable expectation of privacy with regard to the personal belongings that he kept in his office (ibid., § 39). The Court further held that:
.... such an arrangement is implicit in habitual employer-employee relations and there is nothing in the particular circumstances of the case – such as a regulation or stated policy of the applicant’s employer discouraging employees from storing personal papers and effects in their desks or filing cabinets – to suggest that the applicant’s expectation was unwarranted or unreasonable.
. The Court must therefore determine whether, in view of the general prohibition imposed by his employer, the applicant retained a reasonable expectation that his communications would not be monitored. In this regard, the Court takes notice that the Data Protection Convention sets up clear principles applying to automatic data processing in order to enable an individual to establish the existence of an automated personal data file and its main purposes (see Articles 5 and 8 of the Data Protection Convention in paragraph 17 above). The relevant EU law goes in the same direction, notably in the field of surveillance of electronic communications in the workplace (see paragraphs 18, 19 and 20 above).
Having regard to these circumstances, and especially to the fact that the content of the applicant’s communications on Yahoo messenger was accessed and that the transcript of these communications was further used in the proceedings before the labour courts, the Court is satisfied that the applicant’s “private life” and “correspondence” within the meaning of Article 8 § 1 were concerned by these measures (mutatis mutandis, Köpke v Germany, (dec.), no. 420/07, 5 October 2010). It therefore finds that Article 8 § 1 is applicable in the present case.
The applicant took the view that there had been an interference with his private life and correspondence within the meaning of Article 8 of the Convention, and that this interference had not been justified under the second paragraph of Article 8. He submitted that this interference had not been in accordance with the law, as the applicable legislation, namely the Labour Code, lacked sufficient foreseeability; in this connection, he claimed that the Court’s findings in the case of Oleksandr Volkov v Ukraine (no. 21722/11, ECHR 2013) were applicable to the present case. He pointed out that neither the Labour Code nor Law no. 677/2001 provided procedural safeguards as regards the surveillance of an employee’s electronic communications.
The Court reiterates that although the purpose of Article 8 is essentially to protect an individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in an effective respect for private life. These obligations may involve the adoption of measures designed to secure respect for private life even in the sphere of the relations of individuals between themselves (see Von Hannover v Germany (no. 2) [GC], nos. 40660/08 and 60641/08, § 57, ECHR 2012, and Benediksdóttir v Iceland (dec.), no. 38079/06, 16 June 2009). The boundary between the State’s positive and negative obligations under Article 8 does not lend itself to precise definition. In both contexts regard must be had to the fair balance that has to be struck between the competing interests – which may include competing private and public interests or Convention rights (see Evans v the United Kingdom [GC], no. 6339/05, §§ 75 and 77, ECHR 2007-I) – and in both contexts the State enjoys a certain margin of appreciation (see Von Hannover, cited above; and Jeunesse v the Netherlands [GC], no. 12738/10, § 106, 3 October 2014).
While it is true that it had not been claimed that the applicant had caused actual damage to his employer (compare and contrast Pay v United Kingdom, (dec.), no. 32792/05, 16 September 2008 where the applicant was involved outside work in activities that were not compatible with his professional duties, and Köpke (cited above), where the applicant had caused material losses to her employer), the Court finds that it is not unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours.
In addition, the Court notes that it appears that the communications on his Yahoo Messenger account were examined, but not the other data and documents that were stored on his computer. It therefore finds that the employer’s monitoring was limited in scope and proportionate (compare and contrast Wieser and Bicos Beteiligungen GmbH v Austria, no. 74336/01, §§ 59 and 63, ECHR 2007-IV, and Yuditskaya v Russia, no. 5678/06, § 30, 12 February 2015).
The Court notes that the applicant was able to raise these arguments before the Court of Appeal, which ruled, in a sufficiently reasoned decision, that hearing additional witnesses was not relevant to the case (see paragraph 12 above). Such a decision was delivered in a public hearing conducted in an adversarial manner and does not seem arbitrary (see García Ruiz v Spain [GC], no. 30544/96, §§ 28-29, ECHR 1999-I).
Declares, unanimously, the complaint concerning Article 8 of the Convention admissible and the remainder of the application inadmissible;
Bărbulescu v Romania concerns the surveillance of Internet usage in the workplace. The majority accept that there has been an interference with the applicant’s right to respect for private life and correspondence within the meaning of Article 8 of the European Convention on Human Rights (“the Convention”), but conclude that there has been no violation of this Article, since the employer’s monitoring was limited in scope and proportionate. I share the majority’s starting point, but I disagree with their conclusion. I have no reservations in joining the majority in finding the Article 6 complaint inadmissible.
The case presented an excellent occasion for the European Court of Human Rights (“the Court”) to develop its case-law in the field of protection of privacy with regard to employees’ Internet communications[1]. The novel features of this case concern the non-existence of an Internet surveillance policy, duly implemented and enforced by the employer, the personal and sensitive nature of the employee’s communications that were accessed by the employer, and the wide scope of disclosure of these communications during the disciplinary proceedings brought against the employee. These facts should have impacted on the manner in which the validity of the disciplinary proceedings and the penalty was assessed. Unfortunately, both the domestic courts and the Court’s majority overlooked these crucial factual features of the case.
As the Court’s Grand Chamber recently stated, user-generated expressive activity on the Internet provides an unprecedented platform for the exercise of freedom of expression[2]. In the light of its accessibility and capacity to store and communicate vast amounts of information, the Internet also plays an important role in enhancing the public’s access to news and facilitating the dissemination of information in general[3]. Along the same line of reasoning, the French Constitutional Council has affirmed that “in the current state of means of communication and given the generalised development of public online communication services and the importance of the latter for the participation in democracy and the expression of ideas and opinions, this right (to freedom of expression) implies freedom to access such services.”[4] Thus, States have a positive obligation to promote and facilitate universal Internet access, including the creation of the infrastructure necessary for Internet connectivity[5]. In the case of private communications on the Internet, the obligation to promote freedom of expression is coupled with the obligation to protect the right to respect for private life. States cannot ensure that individuals are able to freely seek and receive information or express themselves without also respecting, protecting and promoting their right to privacy. At the same time, the risk of harm posed by Internet communications to the exercise and enjoyment of human rights and freedoms, particularly the right to respect for private life, is certainly higher than that posed by the press[6]. For example, States should counter racial or religious discrimination or hate speech over the Internet[7]. In other words, situations may emerge where the freedom of expression of the content provider, protected by Article 10, may collide with the right to respect for private life of others enshrined in Article 8, or where both the freedom of expression and the right to respect for private life of those involved in Internet communications may conflict with the rights and freedoms of others. The present case pertains to this second type of situation.
Internet surveillance in the workplace is not at the employer’s discretionary power. In a time when technology has blurred the diving line between work life and private life, and some employers allow the use of company-owned equipment for employees’ personal purposes, others allow employees to use their own equipment for work-related matters and still other employers permit both, the employer’s right to maintain a compliant workplace and the employee’s obligation to complete his or her professional tasks adequately does not justify unfettered control of the employee’s expression on the Internet[8]. Even where there exist suspicions of cyberslacking, diversion of the employer’s IT resources for personal purposes, damage to the employer’s IT systems, involvement in illicit activities or disclosure of the employer’s trade secrets, the employer’s right to interfere with the employee’s communications is not unrestricted. Given that in modern societies Internet communication is a privileged form of expression, including of private information, strict limits apply to an employer’s surveillance of Internet usage by employees during their worktime and, even more strictly, outside their working hours, be that communication conducted through their own computer facilities or those provided by the employer.
The Convention principle is that Internet communications are not less protected on the sole ground that they occur during working hours, in the workplace or in the context of an employment relationship, or that they have an impact on the employer’s business activities or the employee’s performance of contractual obligations[9]. This protection includes not only the content of the communications, but also the metadata resulting from the collection and retention of communications data, which may provide an insight into an individual’s way of life, religious beliefs, political convictions, private preferences and social relations[10]. In the absence of a warning from the employer that communications are being monitored, the employee has a “reasonable expectation of privacy”[11]. Any interference by the employer with the employee’s right to respect for private life and freedom of expression, including the mere storing of personal data related to the employee’s private life, must be justified in a democratic society by the protection of certain specific interests covered by the Convention[12], namely the protection of the rights and freedoms of the employer or other employees (Article 8 § 2)[13] or the protection of the reputation or rights of the employer or other employees and the prevention of the disclosure of information received by the employee in confidence (Article 10 § 2)[14]. Hence, the pursuit of maximum profitability and productivity from the workforce is not per se an interest covered by Article 8 § 2 and Article 10 § 2, but the purpose of ensuring the fair fulfilment of contractual obligations in an employment relationship may justify certain restrictions on the above-mentioned rights and freedoms in a democratic society[15].
Other than the Court’s case-law, the international standards of personal data protection both in the public and private sectors have been set out in the 1981 Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data[16]. In this Convention the protection of personal data was for the first time guaranteed as a separate right granted to an individual. Specific rules for data protection in employment relations are contained in the Council of Europe Committee of Ministers Recommendation Rec(89)2 to member states on the protection of personal data used for employment purposes, 18 January 1989, recently replaced by Recommendation CM/Rec(2015)5 of the Committee of Ministers to member States on the processing of personal data in the context of employment. Also extremely valuable in this context are Recommendation No.R(99) 5 for the protection of privacy on the Internet, adopted on 23 February 1999, and Recommendation CM/Rec(2010)13 on the protection of individuals with regard to automatic processing of personal data in the context of profiling, adopted on 23 November 2010.
In the legal framework of the European Union (EU), respect for private life and protection of personal data have been recognised as separate fundamental rights in Articles 7 and 8 of the EU Charter of Fundamental Rights. The central piece of EU legislation is Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Employment relations are specifically referred to only in the context of the processing of sensitive data. Regulation (EC) No 45/2001 lays down the same rights and obligations at the level of the EC institutions and bodies. It also establishes an independent supervisory authority with the task of ensuring that the Regulation is complied with. Directive 2002/58/EC concerns the processing of personal data and the protection of privacy in the electronic communications sector, regulating issues like confidentiality, billing and traffic data and spam. The confidentiality of communications is protected by Article 5 of the Directive, which imposes on Member States an obligation to ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular they are to prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so. The interception of communications over private networks, including e-mails, instant messaging services, and phone calls, and generally private communications, are not covered, as the Directive refers to publicly available electronic communications services in public communication networks. Also relevant is Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, which specifies that Member States may not impose general monitoring obligations on providers of internet/email services, because such an obligation would constitute an infringement of freedom of information as well as of the confidentiality of correspondence (Article 15). Within the former third pillar of the EU, Framework Decision 2008/977/JHA dealt with the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. Finally, Article 29 Working Party Opinion 8/2001 on the processing of personal data in the employment context, adopted on 13 September 2001[17], the Working Document on the surveillance and the monitoring of electronic communications in the workplace, adopted on 29 May 2002[18], the Working Document on a common interpretation of Article 26(1) of Directive 95/46/EC, adopted on 25 November 2005[19], and Article 29 Working Party Opinion 2/2006 on privacy issues related to the provision of email screening services, adopted on 21 February 2006[20], are also important for setting the standards of data protection applicable to employees in the EU. In its 2005 annual report, the Working Party affirmed that “[i]t is not disputed that an e-mail address assigned by a company to its employees constitutes personal data if it enables an individual to be identified”[21].
Finally, both the 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data[22], and the International Labour Office’s 1997 Code of Practice on the protection of workers’ personal data, provide important soft-law guidance to employers, employees and courts.
From this international legal framework, a consolidated, coherent set of principles can be drawn for the creation, implementation and enforcement of an Internet usage policy in the framework of an employment relationship[23]. Any information related to an identified or identifiable employee that is collected, held or used by the employer for employment purposes, including with regard to private electronic communications, must be protected in order to respect the employee’s right to privacy and freedom of expression[24]. Consequently, any processing of personal data for the purposes of recruitment, fulfilment or breach of contractual obligations, staff management, work planning and organisation and termination of an employment relationship in both the public and private sectors must be regulated either by law, collective agreement or contract[25]. Particular forms of personal data processing, for example of the employees’ usage of Internet and electronic communications in the workplace, warrant detailed regulation[26].
A blanket ban on personal use of the Internet by employees is inadmissible[28], as is any policy of blanket, automatic, continuous monitoring of Internet usage by employees[29]. Personal data relating to racial origin, political opinions or religious or other beliefs, as well as personal data concerning health, sexual life or criminal convictions are considered as “sensitive data” requiring special protection[30].
Employees must be made aware of the existence of an Internet usage policy in force in their workplace, as well as outside the workplace and during out-of-work hours, involving communication facilities owned by the employer, the employee or third parties[31]. All employees should be notified personally of the said policy and consent to it explicitly[32]. Before a monitoring policy is put in place, employees must be aware of the purposes, scope, technical means and time schedule of such monitoring[33]. Furthermore, employees must have the right to be regularly notified of the personal data held about them and the processing of that personal data, the right to access all their personal data, the right to examine and obtain a copy of any records of their own personal data and the right to demand that incorrect or incomplete personal data and personal data collected or processed inconsistently with corporation policy be deleted or rectified[34]. In event of alleged breaches of Internet usage policy by employees, opportunity should be given to them to respond to such claims in a fair procedure, with judicial oversight.
The enforcement of an Internet usage policy in the workplace should be guided by the principles of necessity and proportionality, in order to avoid a situation where personal data collected in connection with legitimate organisational or information-technology policies is used to control employees’ behaviour[35]. Before implementing any concrete monitoring measure, the employer should assess whether the benefits of that measure outweigh the adverse impact on the right to privacy of the concerned employee and of third persons who communicate with him or her[36]. Unconsented collection, access and analysis of the employee’s communications, including metadata, may be permitted only exceptionally, with judicial authorisation, since employees suspected of policy breaches in disciplinary or civil proceedings must not be treated less fairly than presumed offenders in criminal procedure. Only targeted surveillance in respect of well-founded suspicions of policy violations is admissible, with general, unrestricted monitoring being manifestly excessive snooping on employees[37]. The least intrusive technical means of monitoring should be preferred[38]. Since blocking Internet communications is a measure of last resort[39], filtering mechanisms may be considered more appropriate, if at all necessary, to avoid policy infringements[40]. The collected data may not be used for any purpose other than that originally intended, and must be protected from alteration, unauthorised access and any other form of misuse[41]. For example, the collected data must not be made available to other employees who are not concerned by it. When no longer needed, the collected personal data should be deleted[42].
Breaches of the internal usage policy expose both the employer and the employee to sanctions. Penalties for an employee’s improper Internet usage should start with a verbal warning, and increase gradually to a written reprimand, a financial penalty, demotion and, for serious repeat offenders, termination of employment[43]. If the employer’s Internet monitoring breaches the internal data protection policy or the relevant law or collective agreement, it may entitle the employee to terminate his or her employment and claim constructive dismissal, in addition to pecuniary and non-pecuniary damages.
Ultimately, without such a policy, Internet surveillance in the workplace runs the risk of being abused by employers acting as a distrustful Big Brother lurking over the shoulders of their employees, as though the latter had sold not only their labour, but also their personal lives to employers. In order to avoid such commodification of the worker, employers are responsible for putting in place and implementing consistently a policy on Internet use along the lines set out above. In so doing, they will be acting in accordance with the principled international-law approach to Internet freedom as a human right[44].
The Government argue that the company’s internal regulations provided for a prohibition on the use of computers for personal purposes. Although true, the argument is not relevant, since the given internal regulations omitted any reference to an Internet surveillance policy being implemented in the workplace. In this context, it should not be overlooked that the Government also refer to notice 2316 of 3 July 2007, which “highlighted that another employee had been let go on disciplinary grounds, specifically due to personal use of the company’s Internet connection and phones” and “reiterated that the employer verifies and monitors the employees’ activity, specifically stating that they should not use the Internet, phones or faxes for issues unrelated to work”, in other words, which “reiterated” the existence of a policy of Internet surveillance in the company[45]. Also according to the Government, the employees had been informed about this notice, and it had even been signed by the applicant. The applicant disputes these facts. The majority themselves acknowledge that it is contested whether the company’s Internet surveillance policy had been notified to the applicant prior to the interference with his Internet communications[46]. Unfortunately, the majority did not elaborate further on this crucial fact.
Since the existence of prior notice was alleged by the Government and disputed by the applicant, the Government had the burden of providing evidence to that effect, which they did not[47]. Moreover, the only copy of the notice 2316 available in the Court’s file is not even signed by the employee[48]. In other words, there is not sufficient evidence in the file that the company’s employees, and specifically the applicant, were aware that monitoring software had been installed by the employer and recorded in real time the employees’ communications on the company’s computers, produced statistical records of each employee’s Internet use and transcripts of the content of the communications exchanged by them, and could block their communication[49].
Even assuming that notice 2316 did exist and was indeed notified to the employees, including the applicant, prior to the events in question, this would not suffice to justify the termination of his contract, given the extremely vague character of the notice. A mere communication by the employer to employees that “their activity was under surveillance”[50] is manifestly insufficient to provide the latter with adequate information about the nature, scope and effects of the Internet surveillance programme implemented[51]. Such a poorly-drafted “policy”, if existent, offered precious little protection to employees. In spite of its crucial importance for the outcome of the case, the majority did not care to consider the terms of the notice on the company’s alleged Internet surveillance policy. Taking into account the evidence before the Court, I cannot but consider that the notice did not identify the minimum elements of an Internet usage and surveillance policy, including the specific misconduct being monitored, the technical means of surveillance and the employee’s rights regarding the monitored materials.
The delicate character of the present case is significantly heightened by the nature of certain of the applicant’s messages. They referred to the sexual health problems affecting the applicant and his fiancée[52]. This subject pertains to the core of the applicant’s private life and requires the most intense protection under Article 8. Other than this sensitive data, the messages also dealt with other personal information, such as his uneasiness with the hostile working environment. The employer accessed not only the professional Yahoo Messenger account created by the applicant, but also his own personal account[53]. The employer had no proprietary rights over the employee’s Yahoo messenger account, notwithstanding the fact that the computer used by the employee belonged to the employer[54]. Furthermore, the employer was aware that some of the communications exchanged by the applicant were directed to an account entitled “Andra loves you”, which could evidently have no relationship with the performance of the applicant’s professional tasks[55]. Yet the employer accessed the content of this communication and made transcripts of it against the applicant’s explicit will and without a court order[56].
In addition, the employer’s interference had wide adverse social effects, since the transcripts of the messages were made available to the applicant’s colleagues and even discussed by them[57]. Even if one were to accept that the interference with the applicant’s right to respect for private life was justified in this case, which it was not, the employer did not take the necessary precautionary measures to ensure that the highly sensitive messages were restricted to the disciplinary proceedings. In other words, the employer’s interference went far beyond what was necessary[58].
Having said that, the termination of the applicant’s employment relationship with the company could not be based on evidence that did not meet the Convention standards of protection of employees’ privacy. In ratifying the employer’s dismissal decision, the domestic courts accepted as legal evidence of the breach of the applicant’s professional duties records of private communications which merited Convention protection and had nonetheless been accessed, used and publicised by the employer, in violation of the Convention standard[59]. Moreover, the termination of the applicant’s employment contract can hardly be said to be proportionate in itself, bearing in mind that it was not proven that the applicant had caused actual damage to his employer, or that he had adopted the same pattern of behaviour for a considerable period of time[60].
“Workers do not abandon their right to privacy and data protection every morning at the doors of the workplace.”[61] New technologies make prying into the employee’s private life both easier for the employer and harder for the employee to detect, the risk being aggravated by the connatural inequality of the employment relationship. A human-rights centred approach to Internet usage in the workplace warrants a transparent internal regulatory framework, a consistent implementation policy and a proportionate enforcement strategy by employers. Such a regulatory framework, policy and strategy were totally absent in the present case. The interference with the applicant’s right to privacy was the result of a dismissal decision taken on the basis of an ad hoc Internet surveillance measure by the applicant’s employer, with drastic spill-over effects on the applicant’s social life. The employee’s disciplinary punishment was subsequently confirmed by the domestic courts, on the basis of the same evidence gathered by the above-mentioned contested surveillance measure. The clear impression arising from the file is that the local courts willingly condoned the employer’s seizure upon the Internet abuse as an opportunistic justification for removal of an unwanted employee whom the company was unable to dismiss by lawful means.
Convention rights and freedoms have a horizontal effect, insofar as they are not only directly binding on public entities in the Contracting Parties to the Convention, but also indirectly binding on private persons or entities, the Contracting State being responsible for preventing and remedying Convention violations by private persons or entities. This is an obligation of result, not merely an obligation of means. The domestic courts did not meet this obligation in the present case when assessing the legality of the employer’s dismissal decision, adopted in the disciplinary proceedings against the employee. Although they could have remedied the violation of the applicant’s right to respect for private life, they opted to confirm that violation. This Court did not provide the necessary relief either. For that reason, I dissent.
[1] This case-law is still limited (see Copland v the United Kingdom, no. 62617/00, ECHR 2007-I, and Peev v Bulgaria, no. 64209/01, 26 July 2007).
[2] Delfi AS v Estonia [GC], no. 64569/09, §§ 110 and 118, 16 June 2015, following Ahmet Yıldırım v Turkey, no. 3111/10, § 48, ECHR 2012, and Times Newspapers Ltd (nos. 1 and 2) v the United Kingdom, nos. 3002/03 and 23676/03, § 27, ECHR 2009.
[6] Delfi AS, cited above, § 133, and Editorial Board of Pravoye Delo and Shtekel v Ukraine, no. 33014/05, §§ 63-64, ECHR 2011.
[9] In Niemietz v Germany, 16 December 1992, Series A no. 251-B, § 28, Halford v the United Kingdom, 25 June 1997, Reports 1997-III, § 44, and Amann v Switzerland [GC], no. 27798/95, § 43, ECHR 2000-II, the Court considered interferences with communications and correspondence in a work or business environment in the light of the concept of private life and correspondence for the purposes of Article 8, no distinction being made between private or professional communication and correspondence. The Court has already stated that privacy rights may not be asserted in the context of conduct away from the workplace, relied upon by an employer as grounds for dismissal (Pay v the United Kingdom (dec.), no. 32792/05, 16 September 2008).
[10] Inspired by Malone v the United Kingdom, 2 August 1984, § 84, Series A no. 82, the Court affirmed in Copland, cited above, § 43, that, even if the monitoring is limited to “information relating to the date and length of telephone conversations and in particular the numbers dialled”, as well as to e-mail and Internet usage, and without access to the content of the communications, it still violates Article 8 of the Convention. The same point was made by the Court of Justice of the European Union, Joined Cases C-293/12 and C-594/12, Digital Rights Ireland and Seitlinger, Judgment of 8 April 2014, paragraphs 26-27, and 37, and the Report of the United Nations High Commissioner for Human Rights on the right to privacy in the digital age, 30 June 2014, paragraph 19 (A/HRC/27/37).
[11] Halford, cited above, §§ 44 and 45; Copland, cited above, §§ 41 and 42; and Peev, cited above, § 39. It is not clear what the Court meant by this, since the Court refers to various factors such as lack of warning, provision of private space and assurance of private use of the employer’s communication devices, but does not clarify their relative importance and whether these factors are essential or case-sensitive. Thus, the Court neglects the normative value of the “reasonability” criterion, leaving the impression that the employee’s privacy at work is always deferential to pure management prerogative, as if the employer had the ultimate word on what kind of activity is not regarded as private in the workplace and the employee could not benefit from any expectation of privacy. Worse still, the Court does not provide any guidance on the interests that the employer may invoke under Article 8 § 2 to justify interferences with the employee’s privacy. The problem with this concept lies in the way it was fashioned at birth. The employee’s expectation of privacy in the context of the “operational realities of the workplace” was affirmed by the United States Supreme Court in O’Connor v Ortega, 480 US 709 (1983), which addressed the issue on a weak case-by-case basis, leading to the absence of generally applicable principles, as the critical concurring opinion of Justice Scalia also noted. In my view, the “reasonable expectation” test is a mixed objective-subjective test, since the person must actually have held the belief (subjectively), but it must have also been reasonable for him or her to have done so (objectively). This objective, normative limb of the test cannot be forgotten.
[12] Amann, cited above, § 65, and Copland, cited above, § 43. In a broader context, see also my separate opinion joined to Yildirim v Turkey, no. 3111/10, 18 December 2012.
[15] For example, in an Article 10 case, Palomo Sánchez v Spain, nos. 28955/06, 28957/06, 28959/06 and 28964/06, 12 September 2011.
[21] Important decisions have been delivered in this area by the Luxembourg Court of Justice, such as Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v Administración del Estado, Joined cases C-468/10 and C-469/10, 24 November 2011, on the implementation of Article 7 (f) of the Data Protection Directive in national law; Deutsche Telekom AG v Bundesrepublik Deutschland, C-543/09, 5 May 2011, on the necessity of renewed consent; College van burgemeester en wethouders van Rotterdam v M.E.E. Rijkeboer, C-553/07, 7 May 2009, on the right of access of the data subject; Dimitrios Pachtitis v European Commission, F-35/08, 15 June 2010, and V v European Parliament, F-46/09, 5 July 2011, both on the usage of personal data in the context of employment in EU institutions.
[40] Paragraph 14.2 of Council of Europe Recommendation Rec (2015)5. As the Article 29 Data Protection Working Party document on surveillance and monitoring of electronic communications in the workplace, page 24, put it, “the interest of the employer is better served in preventing Internet misuse rather than in detecting such misuse.
[43] At this juncture it is worth noting the Court’s demanding threshold for accepting dismissal in Vogt v Germany, no. 17851/91, 26 September 1995, where the penalty of dismissal was found excessive for the employee’s participation in political activities outside work with no impact on her professional role, and Fuentes Bobo v Spain, no. 39293/98, 29 February 2000, where the penalty of dismissal for offensive remarks broadcast about the employer was also found to be too severe, taking into account the employee’s length of service.
[53] Paragraph 5.3 of Council of Europe Recommendation (2015)5 states clearly that “Employers should refrain from requiring or asking an employee or a job applicant access to information that he or she shares with others online, notably through social networking.” As the English High Court stated in Smith v Trafford Housing Trust (2013) IRLR 86, the employer’s obligation not to promote religious beliefs does not extend to the employee’s Facebook postings, and thus a Christian employee may express his views on gay marriage on social networks without committing professional misconduct. But employee termination may be related to his or her “after hours” commercial activities on eBay, which included videos objectionable to the employer, as decided by the US Supreme Court in San Diego v Roe, 543 US 77 (2004).
[54] The ownership argument is not lacking in logical appeal, but it should be approached with caution. It can be questioned whether it is appropriate to approach the matter in black-or-white reasoning, arguing that the employee no longer has any expectation of privacy whenever he or she uses IT facilities belonging to the employer, and, conversely, the employer has such an expectation whenever he or she uses his or her own IT facilities. A more nuanced approach is necessary, as emerges from the Article 29 Working Party Working document on surveillance and monitoring of electronic communications in the workplace, page 20: “In any case, the location and ownership of the electronic means used do not rule out secrecy of communications and correspondence as laid down in fundamental legal principles and constitutions.” Recently, the Canadian Supreme Court underscored the same idea, asserting the employee’s reasonable expectation of privacy over his personal information stored in company-owned equipment (R. v Cole, (2012) SCC 53). By the same token, the working time argument, which claims that an individual at work is not on “private time” and that therefore no right to privacy applies in the workplace, is also misleading. To borrow the words of Justice Blackmun writing for the minority in O’Connor v Ortega, cited above, “the reality of work in modern time, whether done by public or private employees, reveals why a public employee’s expectation of privacy in the workplace should be carefully safeguarded and not lightly set aside. It is, unfortunately, all too true that the workplace has become another home for most working Americans. Many employees spend the better part of their days and much of their evenings at work .... As a result, the tidy distinctions (to which the plurality alludes) between the workplace and professional affairs, on the one hand, and personal possessions and private activities, on the other, do not exist in reality.”
[59] In other words, the interference with the employee’s right to privacy, especially with regard to the sensitive data collected, was so intolerable that it tainted the evidence collected and hence the Schenk standard does not apply here (Schenk v Switzerland, no. 10862/84, 12 July 1988). A similar approach was taken by the Portuguese Constitutional Court, in its judgment no. 241/2002, on the nullity of evidence collected in a dismissal case on the basis of the labour court’s request to Telepac and Portugal Telecom for traffic data and billing information concerning the employee’s home phone line.