For some privacy advocates, the decision earlier this month of the Grand Chamber of the European Court of Human Rights (ECtHR) in Barbulescu v Romania was another milestone in the pursuit of greater protection for employee privacy. Reversing a decision of the Fourth Section last year, the Court held that the monitoring of an employee’s Yahoo Messenger account breached his right to respect for private life in Article 8. While it would be churlish to contradict such claims, this is no time for complacency.
Mr. Barbulescu was a sales engineer working for a private company in Romania. The company in question prohibited the use of its equipment (including the internet) for personal use – a policy it robustly enforced with dismissals for transgressors – facts which Mr. Barbulescu was made aware of. At his employer’s request, Mr. Barbulescu opened a Yahoo Messenger Account in order to communicate with customers. He was subsequently told that this account had been monitored, revealing that it had been used for personal purposes. When Mr. Barbulescu denied this claim, he was presented with a transcript of the content of his messages. These included exchanges with his brother and his fiancé, some of which were of an intimate nature. Mr. Barbulescu was fired. He challenged his dismissal in the domestic courts alleging that it breached his right to private life. Those claims were dismissed and Mr. Barbulescu brought his case to Strasbourg.
While some form of monitoring in the workplace is not unusual, there have been relatively few cases in the last 20 years in which the ECtHR has had to consider its privacy implications. In the cases in which it has done so, it has had little hesitation in concluding that the right to private life encompasses activities that take place at work (see e.g. Niemietz v Germany (1992), Peev v Bulgaria (2007), Kopke v Germany (2010)) and that correspondence includes communications via the internet (Copland v UK (2007)). This case was no exception [paras 70-72]. Having concluded that Mr. Barbulescu’s activities in principle fell within the scope of Article 8 the Court went on to consider whether he had a reasonable expectation of privacy [paras 73-81]. This phrase is borrowed from the US where it was devised in order to ameliorate the shortcomings of spatial conceptualisations of privacy exposed by advances in surveillance technology (see Katz v United States (1967)). There, by asking whether or not the individual has an expectation of privacy that society recognises as reasonable, the test was intended to invite a more expansive approach to the way privacy was conceived (although in practice it has fallen short of such aspirations). Paradoxically, its application by the ECtHR appears to do the opposite. Cognisant that its pluralistic approach to Article 8 risks indeterminacy, the Court appears anxious to contain its scope. In seeking to resolve the question of whether Article 8 is engaged, the Court asks whether the employee was warned they would be monitored. Failure to give such a warning gives rise to a reasonable expectation of privacy and the right to private life is engaged (see e.g. Halford v UK (1997) and Copland). Implicit in this analysis, however, is that if an employee knows they are being watched any expectation of privacy is at the very least diminished and may be excluded entirely – a conclusion borne out by the case law on surveillance outside the workplace (see e.g. Pay v UK (2009), Peck v UK (2003)). (This issue will be examined further below). In the proceedings against Romania, the Court accepted that Mr. Barbulescu knew that the Company prohibited the use of its internet for personal purposes (he had signed a copy of the internal regulation to this effect). However, it was unclear whether he was told in advance that his Messenger Account would be monitored. It was, therefore, ‘open to question’ whether or not he had a reasonable expectation of privacy [para 80]. Confronted with the uncomfortable reality that the reasonable expectations of privacy test failed to resolve the question of scope, the Court glibly concluded that Article 8 was nevertheless engaged because workplace privacy cannot be reduced to zero on the simple instructions of the employer [para 80-81].
The next task was to determine whether there was a violation of Article 8. Since the facts alleged a breach by a private entity rather than an interference by the State, the Court was required to consider the horizontal application of the Convention. It therefore asked whether the State had complied with its positive obligation to secure the right to respect for private life [paras 108-111]. This turned on whether, in assessing Mr. Barbulescu’s complaint against the monitoring and his subsequent dismissal, the domestic courts struck the right balance between his privacy rights and the employer’s interest in ensuring the smooth running of the company [paras 112, 124, 127, 132]. Whilst noting that the absence of a European consensus on the question of whether and how to regulate workplace monitoring meant that States enjoyed a wide margin of appreciation, the Court accepted that this discretion was not unlimited [paras 118-120]. It therefore went on to prescribe a number of safeguards against arbitrariness in relation to which such monitoring should be assessed [para 121-122]. These principles draw on the extensive international law framework that protects individual privacy and regulates the processing of personal data. They require employers to notify employees in advance of the nature and extent of the monitoring and how data collected will be used, to be able to justify such monitoring, with ‘weightier’ reasons being required to monitor the content of communications, to consider the consequences of the monitoring for the employee and whether less intrusive methods could be used and to provide access to remedies before a judicial body in the event of disputes. When assessed against these criteria the ECtHR judged that the domestic courts’ handling of Mr. Barbulescu’s claim fell short and they therefore failed to strike the right balance between the interests at stake [see in particular paras 140- 141].
Comments
Several criticisms can be made of the ECtHR’s handling of cases involving employee privacy. One issue that deserves attention is its approach to the horizontal application of the Convention in such cases and, in particular, its failure to acknowledge the societal benefits of privacy in seeking to balance the interests of employers and employees. A prior problem, however, concerns its reliance on reasonable expectations of privacy when deciding whether Article 8 is engaged in the first place.
The introduction of this test in Halford, met with misgivings that fundamental rights in the work place could be circ*mscribed through a form of implied consent (Oliver (2002), Morris (2001), Ford (2002)). Although the Court in Barbulescu concedes that workplace privacy cannot be reduced to zero at the whim of the employer, its reliance on such expectations remains problematic. This is because it downplays the harms that arise from monitoring even when one knows it is happening. While these harms arise wherever monitoring occurs they are particularly acute in the workplace. It is disappointing that the Grand Chamber failed to recognise this and to take the opportunity to reconsider the relevance of employee expectations.
Aside from the impact that systematic observation has on individual wellbeing due to the anxiety and discomfort it causes, it has profound implications for our personhood. Jeremy Bentham’s Panoptic prison illustrates the inhibiting effects of surveillance and its utility as a method of social coercion. Indeed, the impact is so great that even the threat of being watched is enough to turn individuals into the instruments of their own subjugation. The ECtHR recognised this in Klass v Germany (1978) when referring to the ‘menace of surveillance (…) that necessarily strikes at the freedom of communication’. Such harms arise wherever monitoring takes place. However certain features of working life amplify their impact on employees.
Going to work involves a greater degree of exposure than simply walking down the street. We are forced into regular society with others. Changes in mind and body that remain concealed during the fleeting and irregular interactions we have in other social settings, are revealed. In this respect, the workplace shares many of the same features as those environments in which more intimate and ostensibly private relationships are lived out. The intimacy of working life creates a vulnerability that in our personal lives is mitigated by the reciprocal nature of the exposure. In the workplace, however, while reciprocity may exist in relation to one’s co-workers, it is usually absent in relation to the employer. This exposure is reinforced by the physical organisation of many work spaces. Open plan offices increase employee visibility while managers often enjoy private spaces. As employees spend increasing amounts of time at work, necessitating the conduct of private matters during work time, these physical features present considerable practical obstacles to the exercise of privacy.
The nature of workplace monitoring is also materially different in its scope and intensity from that to which we are exposed elsewhere. Information about us is gathered as we transact our daily lives in public. Mobile phones track our movements, credit cards log transactions, while loyalty cards monitor our consumer preferences. However, it would be misleading to think that workplace monitoring is simply an extension of this ubiquitous information gathering. Workplace monitoring focuses on particular individuals, often over extended periods. The data collected is then held exclusively by the employer with whom the employee has a relationship of dependency. This contrasts with the disaggregated nature of the information we reveal in other contexts and the relative freedom we have to choose who we share our data with. This informational asymmetry coupled with the greater exposure of employees leaves privacy rights vulnerable.
Technology exacerbates these problems. Smart phones, cheap laptops and fast internet access facilitate remote working including from home. This blurs the temporal and spatial boundaries between work life and home life as well as workplace and home (Ford (2002), Separate Partly Dissenting Opinion of Judge Pinto De Albuquerque in Barbulescu v Romania (2016)). To the extent that it was ever really possible, therefore, it becomes increasingly difficult to distinguish in what capacity an individual is acting at any one time (Niemietz). This increases employees’ exposure and thus the impact of surveillance on them. Meanwhile, technology has empowered employers. Advocates of technology based monitoring argue that it amounts to no more than another pair of eyes. This idea is also reflected in the case law of the ECtHR (involving surveillance outside the workplace). There the Court equates being visible walking down the street by a member of the public with being watched by a security guard from behind a CCTV camera (PG and JH v UK (2008), Peck v UK). It therefore concludes that the ‘normal use’ of CCTV surveillance for a foreseeable purpose does not (without more) engage the right to private life (Perry v UK). Such characterisations are, however, misleading. Unchallenged, they facilitate the widespread use of invasive monitoring in the workplace and elsewhere. Technology distances the observer from the observed. Social norms that censure excessive staring, eavesdropping and physical encroachments can be sidestepped. The employer’s visual acuity is also enhanced and employees can be observed from vantage points that would not be possible in the physical world (Von Silva-Tarouca Larsen (2011)). In other respects, technology based surveillance is less intrusive. While we may be aware we are being monitored, the mechanism used is often discrete. This ameliorates the discomfort that the persistent gaze of another would otherwise create. Paradoxically, therefore, the inhibiting effect of such methods may be less. It would be wrong, however, to assume that this neutralises the impact on personal freedom. On the contrary, relaxing one’s guard having overlooked a threat is materially different from doing so in its absence.
Conclusion
Notwithstanding the decision of the Court in Barbulescu, privacy rights in the workplace remain assailable. Monitoring, wherever it occurs, but particularly in the workplace, implicates key dimensions of the right to private life. It should therefore be considered to engage Article 8 whether one is aware it is happening or not. Employers should always be required to provide a justification for monitoring within the framework of Article 8(2) (see Morris (2001) and Oliver (2002)). In practice, this should require employers to demonstrate that monitoring is a lawful, necessary and proportionate response to the pursuit of a legitimate aim. This approach captures more completely the ways in which being closely observed by others is problematic and makes employee privacy less vulnerable to compromise. The Grand Chamber’s failure to engage with these issues is disappointing.
