In a case highlighting the European Continent’s approach to worker privacy, the Grand Chamber of the European Court of Human Rights ruled that employers may violate employees’ rights when monitoring their electronic correspondence in the workplace.  In Barbulescu v. Romania, the Grand Chamber reversed a prior decision from a smaller panel of the European Court of Human Rights (“ECtHR”) which had determined companies have far-reaching authority to monitor employees’ electronic communications—a similar standard to that which exists in the United States.

The case involved a Romanian employee who used a Yahoo Messenger account to communicate with clients.  He also used the system to chat with his brother and fiancé for non-work-related matters.  After his employer confronted him with the chat transcripts, he was fired.  Romanian courts found in favor of the company, and the employee filed a case with the ECtHR.  Initially, the ECtHR ruled the employer was justified in monitoring the employee’s emails.

The employee then appealed to the Grand Chamber which, in an 11-6 ruling, determined the company violated the employee’s right to privacy and reversed the ECtHR’s decision.  Citing Article 8 of the European Convention on Human Rights and the EU Data Protection Directive, the Grand Chamber reasoned that the lower courts failed to strike a balance between the employee’s right to respect for his private correspondence, and the employer’s right to ensure productive use of company time.  Furthermore, the Grand Chamber chastised the lower courts for not sufficiently analyzing the company’s need to read the employee’s entire messages and the harms the monitoring could cause.  Specifically, the Grand Chamber determined the employee had “not been informed in advance of the extent and nature of his employer’s monitoring, or the possibility that the employer have access to the actual contents of his messages.”  The Grand Chamber then identified several criteria for assessing whether a given measure is “proportionate to the aim pursued and whether the employee concerned is protected against arbitrariness,” including:

1. whether the employee has been notified of the possibility the employer might take measures to monitor correspondence and other communications
2. the extent of the employer’s monitoring and the degree of intrusion into the employee’s privacy;
3. whether the employer has provided legitimate reasons to justify monitoring the communications and accessing their actual content;
4. whether it would have been possible to establish a monitoring system based on less intrusive methods and measures than directly accessing the content of the employee’s communications;
5. the consequences of the monitoring for the employee concerned and the use the employer made of the results of the monitoring operation; and
6. whether the employee has been provided with adequate safeguards, especially when the employer’s monitoring operations are of an intrusive nature.

The decision applies to the 47 countries that are members of the Council of Europe and marks the first time the Grand Chamber has issued an opinion related to a private employer’s monitoring of employees’ electronic communications.  Most European countries already require employers to give employees prior notice of monitoring, but only a few have legislation explicitly regulating workplace privacy: Austria, Finland, Luxembourg, Portugal, Slovakia, and the United Kingdom.  Other countries like Denmark, France, Germany, Italy, and Sweden allow employers to monitor emails marked “private,” but the company still needs permission to view the content.  As a result, the Grand Chamber also encouraged European governments to create safeguards against employer abuse and urged businesses to protect employees’ rights by using monitoring methods that do not infringe on employee privacy.

Based on this ruling, companies will now need to examine and possibly revise electronic communications policies detailing the situations in which the company may monitor employees’ electronic correspondence and explaining how information the company monitors may be used.  Whether courts in the U.S. will use the decision to inform their reasoning in similar cases remains to be seen; nevertheless, multijurisdictional employers should be aware of heightened workers’ privacy rights when doing business in Europe and draft policies accordingly.