Romania, Bucharest County Court - 29152/3/2007, B?rbulescu Bogdan Mihai v. S.C. Secpral Pro Instala?ii S.R.L., ordinary, 07.12.2007

Data protection - right to privacy in working places

The applicant was an employee as a sales engineer. The employer’s internal regulations prohibited the use of company resources by employees. However, the regulations did not contain any reference to the possibility for the employer to monitor employees’ communications.
The employer recorded the applicant’s Yahoo Messenger communications in real time. On 13 July 2007, the applicant was summoned by his employer to give an explanation for forty-five pages of private correspondence exchanged with his brother and his fiancée, using the employer’s internet site ID. The messages related to personal matters and some were of an intimate nature. On 1 August 2007 the employer terminated the applicant’s contract of employment.
The applicant challenged his dismissal in an application to the Bucharest County Court. He asked the court to set aside the dismissal; to order his employer to pay him the amounts he was owed in respect of wages and any other entitlements and to reinstate him in his post; and to order the employer to pay him damages for the harm resulting from the manner of his dismissal, and to reimburse his costs and expenses.

The reasoning of the County Court does not explicitly refer to the EU Charter. Mainly, the reasoning states that the procedure for conducting a disciplinary investigation is expressly regulated by the provisions of Article 267 of the Labour Code. The employer conducted the disciplinary investigation in respect of the applicant by twice summoning him in writing to explain himself and the applicant had the opportunity to submit arguments in his defence regarding his alleged acts.
The Court took the view that the monitoring of the internet conversations in which the employee took part using the Yahoo Messenger software on the company’s computer during working hours cannot undermine the validity of the disciplinary proceedings in the instant case.
The fact that the provisions containing the requirement to interview the suspect in a case of alleged misconduct and to examine the arguments submitted in that person’s defence prior to the decision on a sanction are couched in imperative terms highlights the legislature’s intention to make respect for the rights of the defence a prerequisite for the validity of the decision on the sanction.
In the present case, since the employee maintained during the disciplinary investigation that he had not used Yahoo Messenger for personal purposes but in order to advise customers on the products being sold by his employer, an inspection of the content of the applicant’s conversations was the only way in which the employer could ascertain the validity of his arguments.
The employer’s right to monitor employees in the workplace, particularly as regards their use of company computers, forms part of the broader right, governed by the provisions of Article 40 (d) of the Labour Code, to supervise how employees perform their professional tasks.
Given that it has been shown that the employees’ attention had been drawn to the fact that, shortly before the applicant’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes, and that the employees had been warned that their activities were being monitored, the employer cannot be accused of showing a lack of transparency and of failing to give its employees a clear warning that it was monitoring their computer use.
Internet access in the workplace is above all a tool made available to employees by the employer for professional use, and the employer indisputably has the power, by virtue of its right to supervise its employees’ activities, to monitor personal internet use.
Such checks by the employer are made necessary by, for example, the risk that through their internet use, employees might damage the company’s IT systems, carry out illegal activities in cyberspace for which the company could incur liability, or disclose the company’s trade secrets.
The court considered that the acts committed by the applicant constitute a disciplinary offence within the meaning of Article 263 § 2 of the Labour Code since they amount to a culpable breach of the provisions of his employer’s internal regulations, which prohibit the use of computers for personal purposes.
The aforementioned acts are deemed by the internal regulations to constitute serious misconduct, the penalty for which is termination of the contract of employment on disciplinary grounds.
Therefore, the court considered that the decision complained of was well- founded and lawful, and dismissed the application as unfounded.
The County Court’s judgement was challenged in an appeal, at the national level; eventually, the case ended up before the European Court of Human Rights (app. no. 61496/08). The applicant complained, in particular, that his employer’s decision to terminate his contract had been based on a breach of his right to respect for his private life and correspondence as enshrined in Article 8 of the Convention and that the domestic courts had failed to comply with their obligation to protect that right. The application was allocated to the Fourth Section of the Court. On 12 January 2016 a Chamber of that Section held, by six votes to one, that there had been no violation of Article 8 of the Convention. The dissenting opinion of Judge Pinto de Albuquerque was annexed to the Chamber judgment. On 12 April 2016 the applicant requested the referral of the case to the Grand Chamber and on 6 June 2016 a panel of the Grand Chamber accepted the request and delivered the jusgement on 5 September 2016.

The County Court’s decision had an actual impact on the parties. However, the case ended up before the Grand Chamber of the European Court of Human Rights and has been widely publicised. Therefore, we can presume it has a real impact on related national case law.

The applicant challenged the judgement issued by the Bucharest County Court, before the Bucharest Court of Appeal. His appeal was dismissed. After finishing the internal proceedings, the applicant filed an application against Romania at the European Court of Human Rights. He complained, in particular, that his employer’s decision to terminate his contract had been based on a breach of his right to respect for his private life and correspondence as enshrined in Article 8 of the Convention and that the domestic courts had failed to comply with their obligation to protect that right. The application ended up before the Grand Chamber, which found that the ‘domestic authorities did not afford adequate protection of the applicant’s right to respect for his private life and correspondence and that they consequently failed to strike a fair balance between the interests at stake’.

Subsequent case decided by the ECtHR

The ECtHR considered that the Contracting States must be granted a wide margin of appreciation in assessing the need to establish a legal framework governing the conditions in which an employer may regulate electronic or other communications of a non-professional nature by its employees in the workplace. Nevertheless, the discretion enjoyed by States in this field cannot be unlimited. The domestic authorities should ensure that the introduction by an employer of measures to monitor correspondence and other communications, irrespective of the extent and duration of such measures, is accompanied by adequate and sufficient safeguards against abuse

Despite the rapid developments in this area, proportionality and procedural guarantees against arbitrariness are essential. In this context, the Court considered that domestic authorities should treat the following factors as relevant:
(i)  whether the employee has been notified (in a clear manner and in advance) of the possibility that the employer might take measures to monitor correspondence and other communications, and of the implementation of such measures;
 (ii)  the extent of the monitoring by the employer and the degree of intrusion into the employee’s privacy;
(iii)  whether the employer has provided legitimate reasons to justify monitoring the communications and accessing their actual content;
(iv)  whether it would have been possible to establish a monitoring system based on less intrusive methods and measures than directly accessing the content of the employee’s communications;
(v)  the consequences of the monitoring for the employee subjected to it and the use made by the employer of the results of the monitoring operation;
(vi)  whether the employee had been provided with adequate safeguards, especially when the employer’s monitoring operations were of an intrusive nature.

The Court examined how the national authorities took the criteria set out above into account in their reasoning when weighing the applicant’s right to respect for his private life and correspondence against the employer’s right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.
Notwithstanding the respondent State’s margin of appreciation, the Court considered that the domestic authorities did not afford adequate protection of the applicant’s right to respect for his private life and correspondence and that they consequently failed to strike a fair balance between the interests at stake. Therefore, the Court found that there has been a violation of Article 8 of the Convention.