EU companies must notify employees in advance if they plan to monitor work accounts, the European Court of Human Rights ruled this week.
The ruling comes in a case filed by Romanian IT worker Bogdan Barbulescu, who in 2007 was fired by his employer for using his work computer for private conversations with family members.
When the company fired Barbulescu, they provided him with a 45-page document containing transcripts of his private Yahoo! Messenger conversations, such as the ones he had with his brother and fiancée, some of the messages being of an intimate nature.
Up to that point, Barbulescu was not aware that his employer was monitoring his online activity. Previously, Barbulescu had signed a document stating that he did not use his work computer for private matters.
Barbulescu lost all previous legal battles
Barbulescu sued his employer for wrongful termination on accusations that the company had infringed on his right to a private life. Romanian courts sided with the employer, citing the country’s Labor Code, which allowed the employer to terminate his contract for lying.
After exhausting all legal options in Romania, Barbulescu took his case to the ECHR in 2008, where he filed a case against Romania’s judicial system for failing to protect him under Article 8 of the Human Rights Convention that granted him the right to a private life and correspondence.
In January 2016, the ECHR issued an initial judgment, once more favorable to the employer. Barbulescu appealed in June 2016, and yesterday, the ECHR Grand Chamber issued a ruling for his appeal.
EU: Companies must notify employees in advance
According to ECHR documents obtained by Bleeping Computer, the Court ruled that “national authorities had not adequately protected Mr. Barbulescu’s right to respect for his private life and correspondence.”
In a separate document detailing their decision, the Court explained that companies are entitled to monitor employees as long as they notify them in advance.
The Court also pointed out that firms should explain in clear to employees about how monitoring works, when this happens, and who views the collected data.
“A distinction should be made between monitoring of the flow of communications and of their content,” the Court explained. “Whether all communications or only part of them have been monitored should also be taken into account, as should the question whether the monitoring was limited in time and the number of people who had access to the results.”
The ECHR ruling is similar to a decision German courts reached in a wrongful termination case in early August, last month. German courts ruled that companies are entitled to monitor employees, but using keyloggers may be just too intrusive.