.jpg)
Following the ruling handed down on 5 September 2017 by the Grand Chamber of the European Court of Human Rights (ECtHR), which overturned the Court's earlier ruling of 12 January 2016, we are faced with one of those decisions that, from both an employment relations and a legal-procedural standpoint, we must take very seriously. A dismissal may be declared unfair or null and void on grounds of breach of the employee's right to privacy, even where the company has a signed IT protocol and relevant contractual clauses in place.
Accordingly, companies must inform employees of their policies on monitoring the use of digital tools before taking any disciplinary action. This is one of the key arguments in the ruling of the Grand Chamber of the European Court of Human Rights (ECtHR) of 5 September 2017, the so-called "Barbulescu ruling", which is not subject to appeal, and which states that the domestic courts failed to verify whether the employer had given the employee adequate prior notice of the possibility that his communications might be monitored, or of the nature and extent of such monitoring.
Furthermore, notwithstanding the fact that the company had an internal policy prohibiting the use of the internet for personal purposes, this judgment concluded, by 11 votes to 6, that the Romanian authorities "had not struck a fair balance between the competing interests" and "had not adequately protected" the applicant's right to respect for his private life and correspondence, a right protected under Article 8 of the European Convention on Human Rights.
It further notes that the authorities failed to establish the reasons justifying the introduction of the surveillance measures, whether "less intrusive" measures could have been adopted to protect privacy, and whether access to the email account was possible without the applicant's knowledge.
The new Bărbulescu doctrine calls into question the existing doctrine of the Constitutional Court, which will need to be revisited, in particular STC 241/2012 of 17 December and STC 170/2013 of 7 October, since a mere prohibition, whether under a collective bargaining agreement or an internal company policy, on using work computers for personal purposes does not in itself extinguish the employee's "reasonable expectation of privacy".
In this context, when reviewing an employer's disciplinary sanction, national courts must consider the following factors (THE BĂRBULESCU TEST):
- Was the employee notified of the possibility that the employer might monitor their correspondence and other communications, and of the implementation of any such monitoring measures?
- What was the scope of the monitoring carried out by the employer, and to what degree did it intrude upon the employee's private life?
- Has the employer provided reasons justifying the monitoring of the employee's communications?
- Would it have been possible to achieve the same purpose through a monitoring system involving less intrusive means and measures than direct access to the content of the employee's communications?
- What were the consequences of the monitoring for the employee who was subject to it?
- Was the employee afforded adequate safeguards, particularly where the employer's monitoring measures were of an intrusive nature?
Under this new doctrine established by the European Court of Human Rights, all courts, including the Constitutional Court, are required to observe the following minimum standards in cases involving the monitoring of communications, in particular where the email account and computer are the property of the company:
- Prior notification to the employee of the possibility that the employer may implement measures to monitor their correspondence and other communications, as well as of the actual implementation of any such measures. The requirement of prior notification means that the employee must be informed before the monitoring begins.
- The scope of the monitoring carried out by the employer and the degree of intrusion into the employee's private life must be assessed. Such assessment requires weighing the employer's specific objective against the means used to achieve it. For example, to establish whether the employee is using the company's phone for personal calls, access to the content of those calls is entirely unnecessary, it is sufficient to know the numbers dialled.
- The employer must provide reasons justifying the monitoring of the employee's communications, beyond what is permitted under Article 20.3 of the Workers' Statute. The European Court of Human Rights (ECtHR) refers expressly to specific and concrete grounds.
- Monitoring must be proportionate: it must be determined whether it would have been possible to use a monitoring system based on means and measures less intrusive than direct access to the content of the employee's communications.
- The consequences of the monitoring for the employee who has been subject to it must be taken into account and carefully considered. It should be borne in mind that the employee has exercised a fundamental right and that dismissal is the most severe sanction available.
- The employee must have been afforded adequate safeguards, particularly where the employer's monitoring measures were of an intrusive nature.
From a human resources and workplace relations regulatory standpoint, companies must draw up and implement protocols governing the use of digital tools and IT resources. Employees must be informed of the existence of such a protocol in advance. Each employee should receive a copy of the protocol and be asked to sign an acknowledgement of receipt; the protocol may also be made available on the company intranet or shared folders. Employment contracts should indicate where the protocol can be found and set out the employee's obligation to read and comply with it. Training sessions or awareness-raising activities may also be provided to reinforce compliance.
In other words, the company must always inform employees in advance of the rules governing the use of company IT tools (whether subject to absolute or partial restrictions), the existence of monitoring and the methods to be applied, and the consequences of any breach, all while respecting the employee's dignity and right to privacy, in line with the current standards set out in the Barbulescu doctrine.
By way of conclusion, it is essential to review all contractual clauses and internal protocols to ensure they comply with the standards established in this ruling. Moreover, it is absolutely critical that, in any disciplinary case, the company or its lawyer applies the Barbulescu Test, which can be distilled into a single question: Is the measure taken and the evidence used by the company to sanction the employee proportionate? This is precisely what a judge will ask in a dismissal case.
In my view, this should be achievable. Technology is advancing at a pace that would have been unimaginable just a few years ago, and there are now IT tools that can accurately measure an employee's work output without intruding on their privacy, such as www.workmeter.com, a platform that not only helps businesses boost productivity, but can also track the time spent working within each individual software application.
If you would like to discuss your situation with us, please do not hesitate to get in touch. There are several ways to establish the facts in a dismissal case, beyond the use of IT monitoring protocols.
