Is the employer entitled to monitor the employee's personal correspondence?

5 September 2017 The Grand Chamber of the European Court of Human Rights (ECHR) ruled in case Nr. 61496/08, which has strengthened the protection of employee‘s privacy.
In the case of Barbulescu v. Romania, the court found that the employer illegally and without warning and informing the employee verified his correspondence through the Yahoo Messenger account and thus violated his right to privacy and the confidentiality of communications, even though the employee was informed in writing of the company's internal policies prohibiting use equipment provided by the employer for non-work activities.

It is undisputed that by monitoring employee‘s emails the employer is defending his legitimate interest in ensuring the smooth operation of the company. This measure is not prohibited, but must be proportionate and guarantee the protection of the employee from the employer's arbitrariness, since the employee retains his right to privacy during his work and the rules laid down by the employer cannot, in general, deny the employee's social life.

The Grand Chamber highlighted the principles on which the legitimacy of monitoring is assessed:

• the principle of specific purpose - monitoring can only be carried out with a specific, clearly expressed and legitimate aim;
• the principle of legitimacy - the employer's purpose, which justifies the need for monitoring, must be legitimate;
• the principle of proportionality - the employer must assess the consequences for the employee of the monitoring, the degree of privacy restriction is assessed according to:
  • whether the flow or content of communication is being monitored;
  • whether all communication or part of it is monitored;
  • how long is the monitoring going;
  • where the monitoring is being carried out;
  • who can get acquainted with the results of monitoring;
• the principle of necessity - before starting to monitor, the employer must make sure that less restrictive means of privacy will not achieve the same goal;
• the principle of protection - all necessary security measures must be taken to ensure that the information is not attained by third parties;
• the principle of information: the worker must be informed about the possibility and nature of the monitoring before starting to monitor.