Be careful what you read

Monitoring an Employee's InternetUse

Employers reading recentheadlines concerning a case decided in the European Court could beforgiven for thinking that they have an absolute right to monitoremployees work related and e-mail accounts. Employers shouldnot rely on what they have read.

The decision which attractedextensive and misleading media headlines was the case ofBarbulescu v Romania decided in The European Court ofHuman Rights (ECHR).

The applicant, Mr Barbulescuwas a Romanian national who was employed by a private company from2004 to 2007 as an engineer in charge of sales.

At the request of his employerhe had created a Yahoo Messenger account to reply to clientenquiries.

The Company's internalpolicies and procedures contained an express prohibition againstemployees using company equipment (computers and telephones) forpersonal use.

The employer discovered thatthe Yahoo Messenger account had been used by Mr Barbulescu to sendand receive personal messages about his health and sex life inbreach of company procedures.

Mr Barbulescu was dismissedfrom his employment and challenged the dismissal before thenational Romanian Court and following the rejection of his claim,the European Court of Human Rights.

Mr Barbulescu argued that theRomanian Court should have excluded all evidence of his personalcommunication upon the basis that it infringed Article 8 of theEuropean Convention and the right to respect for privatelife.

The ECHR considered that anumber of issues including the fact that Mr Barbulescu hadcommitted a disciplinary offence by using his professional accountduring working hours on the company computer for personal messagesand in breach of company regulations.

The ECHR took account of thefact that the employer had accessed the employee's account with aview to considering professional communications and had in that waydiscovered the personal messages.

The ECHR held that Article 8,which states that everyone has a right to respect for his privateand family life, his home and his correspondence was engaged butthat the employer had not acted in violation of Article8.

In this matter the employer'smonitoring was not unreasonable and the evidence relied upon hadbeen confined to the extent of the personal messages and not thecontent of them or the recipients of them.

The employer had acted in aproportionate way and in accordance with its own procedures. The European Court of Human Rights recognised that it was notunreasonable for an employer to seek to verify that employees wereundertaking their professional tasks during workinghours.

In general terms the EuropeanCourt of Human Rights case law recognises that individuals have areasonable expectation to a "private life" which extends topersonal telephone calls from work and e-mails sent from businesspremises, however, the case of Mr Barbulescu is distinguishedbecause the company's internal policies and procedures expresslyprohibited the use of company equipment for personal use and theemployer's monitoring was reasonable.

The case does underline theimportance of having robust policies and procedures particularly inrelation to computer and telephone use. Here, however,personal use was strictly forbidden whereas most employers in theUK will adopt policies and procedures which allow for reasonablepersonal use.

In addition UK Legislation,including the Data Protection Act 1998 (DPA) regulates anemployer's powers to monitor an employee's personaldata.

The Data Protection Act andexisting case law derived from the European Court of Human Rightsboth impose an obligation on the employer to advise employees thatpersonal data may be monitored. The ideal place for thisprovision is in an internal policy or contract of employment. Neither this provision or the Barbulescu decision entitlesemployers to routinely monitor employees private communicationsalthough, unhelpfully the media frenzy surrounding the Barbulescudecision has suggested this is the case.

Instead a reasonable employeris required to consider the reason for carrying out monitoring,whether that reason is sufficient to justify an intrusion into anemployee's private life and whether the means of monitoring chosenare proportionate to meet that need.

The Employment Practices Codecontains guidance on monitoring at work and good practice. The Code embodies the themes identified above and also thereasonable requirements that should be expected of an employer bothin internal policies and procedures and in the sensitive subject ofmonitoring employees at work.

Practical steps an employermay wish to take are as follows:

• Introduce (or review) anelectronic communications policy (including the right tomonitor).
• Ensure new workers areintroduced to the policy on induction and that existing employeesare reminded of the terms of it on a regular basis.
• Ensure managers understandthe policy and are trained where necessary in relation tomonitoring techniques.
• Keep all policies andprocedures up to date and ensure managers are trained generally inrelation to disciplinary and dismissalprocedures.

This article is for general guidance only. It provides useful information in a concise form. Action should not be taken without obtaining specific legal advice.