In overturning a 2016 judgment, the Grand Chamber of the European Court of Human Rights ruled that a Romanian company violated an individual’s right to privacy when it monitored his computer activity. The decision in the case of Barbulescu v. Romania has far reaching implications for both employers and employees and clarifies that an individual's right to a private life and privacy continues to exist in a workplace context, even if those rights might be restricted. The ruling sets boundaries for monitoring versus privacy rights.  

The decision overturned a 2016 judgment which had sided with his former employer who had terminated his employment following a disciplinary process. His former employer had intercepted and monitored Mr. Barbulescu’s use of a Yahoo Messenger account which he had created, at the request of his employer, to communicate with clients.

Relying in particular on Article 8 (right to respect for private and family life, the home and correspondence) of the European Convention on Human Rights, Mr. Barbulescu complained that his employer's decision to terminate his employment after monitoring his communications and accessing their contents was based upon a breach of his privacy and that the Romanian courts had failed to protect his rights.  

In reaching its majority decision (11-6), the court considered the requirement for sufficient advance notice of the employer's monitoring before any monitoring was initiated, especially where the monitoring entailed accessing the content of employee communications.  "The court concluded, from the material in the case file, that Mr. Barbulescu had not been informed in advance of the extent and nature of his employer’s monitoring, or the possibility that the employer might have access to the actual contents of his messages.”  

Furthermore, the court found that, in considering the question of striking a fair balance between Mr. Barbulescu's rights to privacy and correspondence and his employer's interest, the Romanian courts did not sufficiently examine the scope of monitoring and degree of intrusion into Mr Barbescu's privacy, and had failed to properly consider the company’s need to read the entirety of Mr. Barbulescu’s messages, or the seriousness of the consequences of the monitoring, which resulted in dismissal.

In light of the decision, employers may need to revisit their policies to assess whether those policies properly address how, and where employees use of e-mail, corporate phones, and work computers will be monitored, and why information gathered through monitoring is required, and ultimately to what use any information gathered may be used.