FOURTH SECTION
 
 
 
 
 
 
 
 
CASE OF BĂRBULESCU v. ROMANIA
 
(Application no. 61496/08)
 
 
 
 
 
 
JUDGMENT
 
 
 
STRASBOURG
 
12 January 2016
 
 
THIS CASE WAS REFERRED TO THE GRAND CHAMBER WHICH DELIVERED JUDGMENT IN THE CASE ON 05/09/2017
 
This judgment may be subject to editorial revision. In the case of Bărbulescu v. Romania,
The European Court of Human Rights (Fourth Section), sitting as a Chamber composed of:
 András Sajó, President,
 Vincent A. De Gaetano,
 Boštjan M. Zupančič,
 Nona Tsotsoria,
 Paulo Pinto de Albuquerque,
 Egidijus Kūris,
 Iulia Antoanella Motoc, judges,
and Fatoş Aracı, Deputy Section Registrar,
Having deliberated in private on 1 December 2015,
Delivers the following judgment, which was adopted on that date:
PROCEDURE
1. The case originated in an application (no. 61496/08) against Romania lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Romanian national, Mr Bogdan Mihai Bărbulescu (“the applicant”), on 15 December 2008. 2. The applicant was represented by Mr D. Costinescu and Mr O. Juverdeanu, lawyers practising in Bucharest. The Romanian Government (“the Government”) were represented by their Agent, Ms C. Brumar, of the Ministry of Foreign Affairs. 3. The applicant alleged, in particular, that his employer’s decision to terminate his contract had been based on a breach of his right to respect for his private life and correspondence and that the domestic courts had failed to protect his right. 4. On 18 December 2012 the application was communicated to the Government. THE FACTS
I. THE CIRCUMSTANCES OF THE CASE
5. The applicant was born in 1979 and lives in Bucharest. 6. From 1 August 2004 to 6 August 2007, he was employed by a private company (“the employer”) as an engineer in charge of sales. At his employer’s request, he created a Yahoo Messenger account for the purpose of responding to clients’ enquiries. 7. On 13 July 2007 the employer informed the applicant that his Yahoo Messenger communications had been monitored from 5 to 13 July 2007 and that the records showed that he had used the Internet for personal purposes, contrary to internal regulations. The applicant replied in writing that he had only used Yahoo Messenger for professional purposes. When presented with a forty-five-page transcript of his communications on Yahoo Messenger, the applicant notified his employer that, by violating his correspondence, they were accountable under the Criminal Code. The forty‑five pages contained transcripts of all the messages that the applicant had exchanged with his fiancée and his brother during the period when his communications had been monitored; they related to personal matters involving the applicant. The transcript also contained five short messages that the applicant had exchanged with his fiancée on 12 July 2007 using a personal Yahoo Messenger account; these messages did not disclose any intimate information. 8. On 1 August 2007 the employer terminated the applicant’s employment contract for breach of the company’s internal regulations which stated, inter alia:
“It is strictly forbidden to disturb order and discipline within the company’s premises and especially ... to use computers, photocopiers, telephones, telex and fax machines for personal purposes.”
9. The applicant challenged his employer’s decision before the Bucharest County Court (“the County Court”). He complained that this decision had been null and void since, by accessing his communications, his employer had violated his right to correspondence protected by the Romanian Constitution and the Criminal Code. 10. In a judgment of 7 December 2007, the County Court dismissed his complaint on the grounds that the employer had complied with the dismissal proceedings provided for by the Labour Code and noted that the applicant had been duly informed of the employer’s regulations that prohibited the use of company resources for personal purposes. The County Court’s judgment reads, in its relevant parts:
“The court takes the view that the monitoring of the [applicant]’s Yahoo Messenger communications from the company’s computer ... during working hours – regardless of whether the employer’s actions were or were not illegal (îmbracă sau nu forma ilicitului penal) – cannot affect the validity of the disciplinary proceedings in the instant case... However, since the [applicant] claimed during the disciplinary proceedings that he had not used Yahoo Messenger for personal purposes but rather for advising clients on the products offered by his employer, the court finds that checking the content of the [applicant]’s communications was the only method for the employer to verify the [applicant]’s line of defence. The employer’s right to monitor their employees’ use of the company’s computers in the workplace falls within the broad scope of the right to check the manner in which professional tasks are complete. As long as the employees’ attention ... had been drawn to the fact that, not long before the applicant had received a disciplinary sanction, another colleague had been dismissed for having used the Internet, the telephone and the photocopiers for personal purposes and they had been warned that their activity was under surveillance (see notice no 2316 of 3 July 2007 that the applicant had signed ...) it cannot be held against the employer that he had not proven transparency and that he had not been open with regard to his activities in monitoring the use of the computers by its employees. The Internet in the workplace must remain a tool at the employee’s disposal. It was granted by the employer for professional use and it is indisputable that the employer, by virtue of the right to monitor the employees’ activities, has the prerogative to keep personal use of the Internet monitored. Some of the reasons that make the employer’s checks necessary are the possibilities that through use of the Internet employees could damage the company’s IT systems, or engage in illicit activities in the company’s name, or reveal the company’s commercial secrets.”
11. The applicant appealed against this judgment. He claimed that e‑mails were also protected by Article 8 of the Convention as pertaining to “private life” and “correspondence”. He also complained that the County Court had not allowed him to call witnesses to prove that the employer had not suffered as a result of his actions. 12. In a final decision of 17 June 2008, the Bucharest Court of Appeal (“the Court of Appeal”) dismissed his appeal and upheld the judgment rendered by the County Court. Relying on EU Directive 95/46/EC, the Court of Appeal ruled that the employer’s conduct had been reasonable and that the monitoring of the applicant’s communications had been the only method of establishing if there had been a disciplinary breach. With regard to his procedural rights, the Court of Appeal dismissed the applicant’s arguments, stating that the evidence already before it was sufficient. The Court of Appeal’s decision reads, in its relevant parts:
“In view of the fact that the employer has the right and the obligation to ensure the functioning of the company and, to this end, [the right] to check the manner in which its employees complete their professional tasks, and of the fact that [the employer] holds the disciplinary power of which it can legitimately dispose and which [entitled it] to monitor and to transcribe the communications on Yahoo Messenger that the employee denied having had for personal purposes, after having been, together with his other colleagues, warned against using the company’s resources for personal purposes, it cannot be held that the violation of his correspondence (violarea secretului corespondenţei) was not the only manner to achieve this legitimate aim and that the proper balance between the need to protect his private life and the right of the employer to supervise the functioning of its business was not struck.”
II. RELEVANT DOMESTIC LAW
13. The Romanian Constitution guarantees the right to the protection of intimate, private and family life (Article 26) as well as private correspondence (Article 28). 14. Article 195 of the Criminal Code provides that:
“Anyone who unlawfully opens somebody else’s correspondence or intercepts somebody else’s conversations or communication by telephone, by telegraph or by any other long distance means of transmission shall be liable to imprisonment for between six months to three years.”
15. The Labour Code in force at the time of events provided in Article 40(1)(d) that the employer had the right to monitor the manner in which the employees completed their professional tasks. Article 40(2)(i) provided that the employer had a duty to guarantee the confidentiality of the employees’ personal data. 16. Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of personal data (“Law no. 677/2001”) applies the provisions of EU Directive 95/46/EC (see paragraph 18 below). It defines “personal data” as “any data related to an identified or identifiable individual” (Article 3(a)). It provides that data can only be processed if the person concerned consented to it and it sets out a list of exceptions when consent is not necessary. Exceptions refer, among other situations, to the completion of a contract to which the concerned individual is a party and to securing a legitimate interest of the data operator (Article 5(2)(a and e)). It also provides that when processing data, public authorities remain under the obligation to protect the individuals’ intimate, private and family life (Article 5(3)). Lastly, anyone who suffered prejudice as a result of illegal processing of his/her personal data can ask the courts to allow him/her reparation (Article 18(2)). II. RELEVANT INTERNATIONAL LAW
A. Council of Europe instruments
17. The 1981 Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (“the Data Protection Convention”) defines “personal data” as “any information relating to an identified or identifiable individual”. The Convention provides, inter alia, as follows:
Article 2 – Definitions
“For the purposes of this Convention:
(...)
(c)  ’automatic processing’ includes the following operations if carried out in whole or in part by automated means: storage of data, carrying out of logical and/or arithmetical operations on those data, their alteration, erasure, retrieval or dissemination ...”
Article 3 – Scope
“(1)  The Parties undertake to apply this Convention to automated personal data files and automatic processing of personal data in the public and private sectors.”
(...)
Article 5 – Quality of data
“Personal data undergoing automatic processing shall be:
(a)  obtained and processed fairly and lawfully;
(b)  stored for specified and legitimate purposes and not used in a way incompatible with those purposes;
(c)  adequate, relevant and not excessive in relation to the purposes for which they are stored;
(d)  accurate and, where necessary, kept up to date;
(e)  preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored.”
(...)
Article 8 – Additional safeguards for the data subject
“Any person shall be enabled:
(a)  to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
(b)  to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form (...)”
B. European Union instruments
18. Directive 95/46/EC of the European Parliament and of the Council of the European Union of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data provides that the object of national laws in this area is notably to protect the right to privacy as recognised both in Article 8 of the Convention and the general principles of EU law. The Directive defines personal data as “any information relating to an identified or identifiable natural person” (Article 2(a)) and asks for the Member States to prohibit processing of personal data concerning, among other things, “health or sex life” (Article 8(1)). 19. A Data Protection Working Party (“the Working Party”) was established under Article 29 of the Directive in order to examine the issue of surveillance of electronic communications in the workplace and to evaluate the implications of data protection for employees and employers. It is an independent EU advisory body. The Working Party issued in September 2001 opinion 8/2001 on the processing of personal data in an employment context, which summarises the fundamental data protection principles: finality, transparency, legitimacy, proportionality, accuracy, security and staff awareness. With regard to monitoring of employees, it suggested that it should be:
“A proportionate response by an employer to the risks it faces taking into account the legitimate privacy and other interests of workers”. 20. In May 2002 the Working Party produced the “Working document on the surveillance and the monitoring of electronic communications in the workplace” (“the working document”). This working document asserts that the simple fact that monitoring or surveillance conveniently serves an employer’s interest could not justify an intrusion into workers’ privacy. The document suggests that any monitoring measure must pass a list of four tests: transparency, necessity, fairness and proportionality. 21. From a technical point of view, the working document indicates that:
“Prompt information can be easily delivered by software such as warning windows, which pop up and alert the worker that the system has detected and/or has taken steps to prevent an unauthorised use of the network.”
22. More specifically, with regard to the question of access to an employee’s e-mails, the working document holds that:
“Opening an employee’s e-mail may also be necessary for reasons other than monitoring or surveillance, for example in order to maintain correspondence in case the employee is out of office (for example due to sickness or leave) and correspondence cannot be guaranteed otherwise (for example via an autoreply or automatic forwarding).”
THE LAW
I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
23. The applicant complained that his employer’s decision to terminate his contract had been based on a breach of his right to respect for his private life and correspondence and that the domestic courts had failed to protect his right; he relied on Article 8 of the Convention, which reads as follows:
“1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
A. Admissibility
1. The parties’ submissions
24. The Government submitted that Article 8 of the Convention was not applicable in the present case. They noted that the applicant had set up the Yahoo Messenger account for professional use and he furthermore claimed that he had only used it for this purpose; the Government inferred that the applicant could not claim an “expectation of privacy” while at the same time denying any private use. 25. They further submitted that a number of Council of Europe member States required an assertion of the private nature of the communication for which the protection of privacy was sought; they relied, among other things, on the case-law of the French Court of Cassation that held that e-mails sent by an employee with means put at his disposal by his employer should be deemed to have a professional character and be accessible to the employer unless expressly identified as private. 26. Taking into consideration the differences between e-mail and instant messaging (the latter lacks a subject field), the Government argued that an assertion of the private character of the communication was essential for it to fall within the scope of Article 8. Thus, they pointed out that the applicant had been given an opportunity to claim that the use he had made of Yahoo Messenger had been, at least in part, private, and he had clearly stated that this had not been the case as he had declared that he had only communicated with clients on behalf of his employer. 27. The Government inferred that the applicant had been given proper prior notice that his employer could monitor his communications; they relied on the employer’s notice of 3 July 2007 and on the findings of the County Court that the applicant had not challenged in his appeal. They did not submit a copy of the notice. 28. Finally, the Government pointed out that the present case was different from the cases of Halford v. the United Kingdom (25 June 1997, Reports of Judgments and Decisions 1997‑III, where one of the landlines of the office had been designated for the applicant’s personal use), and Copland v. the United Kingdom (no. 62617/00, ECHR 2007‑I, where personal use was allowed and the surveillance aimed to determine whether the applicant had made “excessive use” of the facilities); in the instant case, the employer’s regulations explicitly prohibited all personal use of company facilities, including computers and Internet access. 29. The applicant contested the Government’s submissions and claimed that his communications on Yahoo Messenger had had a private character and therefore fell within the scope of Article 8 of the Convention. Referring to the State’s positive obligations according to Article 8, he argued that this provision was applicable on account of the Romanian State’s failure to protect his private sphere from interference by his employer. He pointed out that he had consistently raised this argument before the domestic authorities. 30. In the applicant’s opinion, it could not be disputed that the data intercepted by his employer represented both “personal data” and “sensitive personal data” within the meaning of Law no. 677/2001 and EU Directive 95/46/EC; the information related to identified persons (the applicant, his fiancée and his brother) and concerned sensitive issues (such as the applicant’s health and sex life). The applicant did not explain why he had used Yahoo Messenger for personal purposes, but suggested that at the material time the prices for mobile phones had been very high and that the requests for his professional services, as an engineer charged with selling heating equipment, had been very low in July 2007. 31. The applicant also complained that his employer had also accessed his personal Yahoo Messenger account, which had a different ID from the one he had registered for professional purposes. Moreover, the transcript of his communications had been made available to his colleagues who had discussed it publicly. 32. Relying on the case of Niemietz v. Germany (16 December 1992, Series A no. 251‑B), the applicant contended that denying the protection of Article 8 on the grounds that the measure complained of related only to professional activities could lead to inequality of treatment in that such protection would be available only to persons whose professional and non‑professional activities were so intermingled that they could not be distinguished. With reference to the case of Chappell v. the United Kingdom (30 March 1989, Series A no. 152‑A), he argued that the Court had not excluded the applicability of Article 8 of the Convention in the case of a search of the business premises. 33. The applicant insisted that the Yahoo Messenger software was by its nature designed for personal use and that the nature of the instant messaging service had entitled him to expect that his communications would be private. Had he not expected privacy, he would have refrained from disclosing intimate information. He had felt reassured by his employer instructing him to protect his Yahoo Messenger account by choosing his own password. He denied having been given proper prior notice of his employer’s monitoring; he argued that the general prohibition in the employer’s internal regulations could not have amounted to prior notice of monitoring. He believed that the notice of 3 July 2007 had been identified after the facts; he submitted a copy of this notice which however does not bear the employees’ signatures. 34. The applicant found the Government’s submissions that he had initially asserted that he had used that account for professional purposes artificial; irrespective of his initial position, the fact that the actual use of the instant messaging service had been for personal purposes remains undisputed. He concluded that an employee’s right to establish and develop personal relationships during business hours could not be suppressed at the discretion or by a decision of their employer. 2. The Court’s assessment
35. The Court has consistently held that the notion of private life is a broad concept (see, E.B. v. France [GC], no. 43546/02, § 43, 22 January 2008, and Bohlen v. Germany, no. 53495/09, § 45, 19 February 2015). It encompasses, for example, the right to establish and develop relationships with other human beings, and the right to identity and personal development (Niemietz, cited above, § 29, and Fernández Martínez v. Spain [GC], no. 56030/07, § 126, ECHR 2014 (extracts)). A broad reading of Article 8 does not mean, however, that it protects every activity a person might seek to engage in with other human beings in order to establish and develop such relationships. It will not, for example, protect interpersonal relations of such broad and indeterminate scope that there can be no conceivable direct link between the action or inaction of a State and a person’s private life (see, mutatis mutandis, Botta v. Italy, 24 February 1998, § 35, Reports of Judgments and Decisions 1998‑I). 36. Thus, according to the Court’s case-law, telephone calls from business premises are prima facie covered by the notions of “private life” and “correspondence” for the purposes of Article 8 § 1 (see Halford, cited above, § 44, and Amann v. Switzerland [GC], no. 27798/95, § 43, ECHR 2000‑II). The Court further held that e-mails sent from work should be similarly protected under Article 8, as should information derived from the monitoring of personal Internet usage (see Copland, cited above, § 41). 37. In the absence of a warning that one’s calls would be liable to monitoring, the applicant had a reasonable expectation as to the privacy of calls made from a work telephone (see Halford, cited above, § 45) and the same expectation should apply in relation to an applicant’s e-mail and Internet usage (see Copland, cited above, § 41). In a case in which the applicant’s workspace at a prosecutor’s office had been searched and some of his belongings had been seized (Peev v. Bulgaria, no. 64209/01, 26 July 2007), the Court held that the search amounted to an interference with the applicant’s “private life”; the Court found that the applicant had a reasonable expectation of privacy with regard to the personal belongings that he kept in his office (ibid., § 39). The Court further held that:
“39. ... such an arrangement is implicit in habitual employer-employee relations and there is nothing in the particular circumstances of the case – such as a regulation or stated policy of the applicant’s employer discouraging employees from storing personal papers and effects in their desks or filing cabinets – to suggest that the applicant’s expectation was unwarranted or unreasonable”. 38. The Court must therefore examine whether in the present case the applicant had a reasonable expectation of privacy when communicating from the Yahoo Messenger account that he had registered at his employer’s request. In this connection, it notes that it is not disputed that the applicant’s employer’s internal regulations strictly prohibited employees from using the company’s computers and resources for personal purposes (see paragraph 8 above). 39. It follows that the case is different, as suggested by the Government, from the Halford and Copland cases (cited above), in which the personal use of an office telephone was allowed or, at least, tolerated. The case must also be distinguished from the Peev case (cited above), in which the employer’s regulations did not forbid employees to keep personal belongings in their professional office. 40. The Court notes that the applicant chose to raise before the domestic courts his complaint under Article 8 of the Convention within the framework of labour law proceedings. The main object of his case before the domestic courts was indeed his dismissal and the fact that his dismissal had resulted from a breach of his right to respect of his private life was the argument he used in order to prove the nullity of his employer’s decision. 41. It follows that the object of his complaint before the Court is limited to the monitoring of his communications within the framework of disciplinary proceedings; the employer’s decision to terminate the applicant’s contract was not based on either the actual content of his communications nor on the fact of their eventual disclosure. In this regard, the Court notes that the applicant did not argue that he had had no other fora in which to bring these arguments separately before the domestic courts. The domestic law in force at the time of events provided for other remedies designed principally to protect private life (such as a criminal complaint based on Article 195 of the Criminal Code or a complaint based on Article 18(2) of Law no. 677/2001; see paragraphs 14 and 16 above), and the applicant did not claim that they were ineffective.
42.

Article of the Convention at issue: Article 8
Outcome: no_violation