Employee Monitoring

Personal Use by Employees of Employer Systems: Mr Bogdan Barbulescu vs the State of Romania

Mr Barbulescu used certain business systems to send personal messages in breach of his employer’s stated Policy in this regard. The Employer monitored employee communications to ensure compliance with its Policy. Mr Barbelescu was found to have been in breach of the Policy and was duly sacked. He brought a claim through the Romanian courts, which he lost. He then appealed to the European Court of Human Rights, on the grounds that the Romanian courts had breached his right to a private life by checking up on the private messages he had sent using his Employer’s systems.

Mr Barbulescu lost the ECHR case as well, on the grounds that (a) there was a company policy in place restricting personal use of business systems (the “Policy”); (b) the Policy was proportionate to the aims the Employer was trying to achieve (viz ensuring professional attendance to duty during office hours); and that (c) the employees had been made aware of the terms of that Policy. In circumstances where the Employer had communicated its Policy clearly to the employees and the Policy was prima facie reasonable, the Employer was entitled to monitor the compliance of its employees with the Policy and apply sanctions for breach of that Policy, including dismissing Mr Barbulescu.

Employer Policy on Personal Use of Business Systems

It has been settled law in the UK for some time that if an Employer has a Policy that business email and other corporate systems are reserved for business use, then the Employer is within its rights to enforce that Policy provided that (a) the Policy represents a proportionate response to ensuring a set of legitimate business aims, (b) the Employer can show that it has considered the reasonableness of its aims and that its responses in the form of its Policy represent a sensible and measured attempt to give effect to those business aims; and that (c) the Employer has given its employees good notice of the terms of the relevant Policy, including its intention to enforce compliance and dismiss employees for breach of its terms.

Employer Good Practice – Designing a Policy and Impact Assessments

Employer good practice in this area includes thinking through and documenting the outcomes the Employer is seeking to achieve with a policy restricting personal use of business systems (eg professional attendance to duty during working hours), and then preparing a written impact assessment to show that the Employer has considered whether or not the various elements of its resulting Policy represent a proportionate or a disproportionate response to a set of given business drivers when weighed against the employees’ rights to a personal life free from unreasonable interference or undue surveillance.

A degree of common sense is required on the part of the Employer. An impact assessment might show that whilst it would be reasonable to restrict use of office telephone systems during working hours, or to restrict international calls from any phone where international calling was not a requirement of an employee’s job, it may well not be reasonable to monitor the calls of an employee during their designated break times unless the Employer provided separate access to a private payphone for employees to make personal calls during their breaks free from Employer intrusion. Wherever the Employer intends to monitor particular systems, this must be made very clear in the Policy.

Where an Employer has designed its Policy restricting use of Employer systems for personal use, that Policy needs to be made available to all employees, either in a handbook or on the Company’s website. It would be sensible to ensure that employees are actively made aware of the Policy when they are recruited and then subsequently on at least an annual basis (perhaps at annual review time).

Employee Good Practice

Employee good practice in this area might include:

(a)   making sure that any personal devices do not automatically use the Company wifi except where this is authorized, and

(b)  having a personal handset for emergency calls or to make calls during breaks if any employer provided mobile is not allowed to be used for personal calls.

If you need assistance designing a policy restricting personal use of business systems, or with putting together an impact assessment, please contact [email protected] .