An employee who surfs the web for private purposes during work hours without explicit permission from their employer is not working. If this time is not subsequently made up, the employer is giving remuneration without receiving a return. In such a case of working time fraud, the possibility of concrete contractual consequences are at least a consideration. For the employer here, there regularly arises the problem of providing evidence of an employee engaging in this behavior.
Shortly after Germany's Federal Labor Court had already dealt with a similar issue (see our corresponding blog article on this topic), hereby setting a particularly clear precedent with the provision of § 32 (1) of the German Federal Data Protection Act, in its judgment of September 5, 2017, the European Court of Human Rights (ECtHR) laid down the conditions pertaining to the permissible monitoring of the use of company communication devices from its standpoint. (ECtHR, Complaint no. 61496/08 – Bărbulescu vs. Romania). The ECtHR considered the monitoring of an employee as a violation of Article 8 of the European Convention on Human Rights (ECHR), even though any private use of company resources was prohibited.
1. Underlying circumstances
The plaintiff was employed as a sales engineer at a Romanian private company. At his employer's request, he set up an account with an instant messenger service which was intended only for work communication with clients. Any private use of company resources was prohibited by a company policy. The employer terminated the plaintiff’s employment, citing as the reason a chat log which proved private use of the messenger and was the result of monitoring by the employer over several days.
The Romanian courts to which the plaintiff applied upheld the employer’s termination of employment. The plaintiff then appealed to the ECtHR. The ECtHR decided, by judgment of January 12, 2016, that the monitoring did not constitute a violation of Article 8 of the ECHR. The plaintiff again appealed against this decision and applied to the Grand Chamber of the ECtHR.
2. The ECtHR judgment
In its decision of September 5, 2017, the judges in Strasbourg ruled against the country of Romania and ordered it to pay compensation to the plaintiff, thereby overruling both the previous judgments of the ECtHR and the Romanian courts. The ECtHR concluded that the Romanian authorities had not adequately taken into account the plaintiff's right to the protection of his privacy and his correspondence which results from Article 8 of the ECHR.
At the same time, the ECtHR restricted employers’ options with regard to monitoring the communication of their employees. Monitoring, the Court stated, is not impermissible in principle, but certain conditions need to be met; these were defined by the Court for the first time as follows:
- Prior information is given to employees regarding the possibility and extent of monitoring,
- there are legitimate grounds for the use of monitoring,
- milder monitoring measures and less drastic consequences are considered, in addition to the
- consideration of the severity of the intervention regarding Article 8 of the ECHR.
However, the prohibition to use work computers for private purposes in this specific instance left it open, according to the ECtHR, whether the employee could be monitored in this manner at all.
3. Consequences for employer practice
In the present case, the ECtHR is only ordering the country of Romania to pay compensation. However, if the other member states of the European Council (such as the Federal Republic of Germany, among others) which have subjected themselves to the jurisdiction of the ECtHR do not wish to likewise be forced to pay such penalties it would be advisable for them to implement the requirements laid down by the judgment.
Irrespective of implementation into national legislation and court rulings, which remains to be seen, it would appear advisable for employers, even at this stage, to create internal company policies on whether and to what extent employees may use the resources provided to them for work, such as the internet in particular, for private purposes. This policy and its implementation should also take into account the conditions which the ECtHR has now laid down, as we must expect that these will also be reflected in national legislation and court rulings. For this reason the corresponding policy should transparently communicate at least the possibility and the scope of the usage of monitoring, and specify that monitoring may only take place where there are legitimate grounds and only under consideration and evaluation of other and milder means of monitoring.
The EU General Data Protection Regulation (GDPR), which comes into force on May 25, 2018, must likewise be observed in this context. In the context of employee data protection, amongst other things, this regulation, like the judges in Strasbourg in the case presented here, stipulates more stringent requirements with regard to transparency in data processing.