Grote Kamer EHRM: lezen van privé-emails verstuurd van werkmail is wel privacy-inbreuk

EHRM grote kamer 5 september 2017, IT 2533; IEFbe 2540; ECLI:CE:ECHR:2017:0905JUD006149608; Appl. no 61496/08 (Barbulescu tegen Roemenië) Privacy. Eerder oordeelde het EHRM dat het lezen van privé-email verstuurd met werkmail geen schending van de privacy is [IT 1961]. De Grote Kamer komt tot het omgekeerde oordeel [persbericht].

124. The Court observes that the domestic courts held that the interests at stake in the present case were, on the one hand, the applicant’s right to respect for his private life, and on the other hand, the employer’s right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company (see paragraphs 28 and 30 above). It considers that, by virtue of the State’s positive obligations under Article 8 of the Convention, the national authorities were required to carry out a balancing exercise between these competing interests.

125. The Court observes that the precise subject of the complaint brought before it is the alleged failure of the national courts, in the context of a labour-law dispute, to protect the applicant’s right under Article 8 of the Convention to respect for his private life and correspondence in an employment context. Throughout the proceedings the applicant complained in particular, both before the domestic courts and before the Court, about his employer’s monitoring of his communications via the Yahoo Messenger accounts in question and the use of their contents in the subsequent disciplinary proceedings against him.

126. As to whether the employer disclosed the contents of the communications to the applicant’s colleagues (see paragraph 26 above), the Court observes that this argument is not sufficiently substantiated by the material in the case file and that the applicant did not produce any further evidence at the hearing before the Grand Chamber (see paragraph 91 above).

127. It therefore considers that the complaint before it concerns the applicant’s dismissal based on the monitoring carried out by his employer. More specifically, it must ascertain in the present case whether the national authorities performed a balancing exercise, in accordance with the requirements of Article 8 of the Convention, between the applicant’s right to respect for his private life and correspondence and the employer’s interests. Its task is therefore to determine whether, in the light of all the circumstances of the case, the competent national authorities struck a fair balance between the competing interests at stake when accepting the monitoring measures to which the applicant was subjected (see,mutatis mutandis, Palomo Sánchez and Others, cited above, § 62). It acknowledges that the employer has a legitimate interest in ensuring the smooth running of the company, and that this can be done by establishing mechanisms for checking that its employees are performing their professional duties adequately and with the necessary diligence.

128. In the light of the above considerations, the Court will first examine the manner in which the domestic courts established the relevant facts in the present case. Both the County Court and the Court of Appeal held that the applicant had had prior notification from his employer (see paragraphs 28 and 30 above). The Court must then ascertain whether the domestic courts observed the requirements of the Convention when considering the case.

129. At this stage, the Court considers it useful to reiterate that when it comes to establishing the facts, it is sensitive to the subsidiary nature of its task and must be cautious in taking on the role of a first-instance tribunal of fact, where this is not rendered unavoidable by the circumstances of a particular case (see Mustafa Tunç and Fecire Tunç v. Turkey[GC], no. 24014/05, § 182, 14 April 2015). Where domestic proceedings have taken place, it is not the Court’s task to substitute its own assessment of the facts for that of the domestic courts and it is for the latter to establish the facts on the basis of the evidence before them (see, among other authorities, Edwards v. the United Kingdom, 16 December 1992, § 34, Series A no. 247‑B). Though the Court is not bound by the findings of domestic courts and remains free to make its own assessment in the light of all the material before it, in normal circumstances it requires cogent elements to lead it to depart from the findings of fact reached by the domestic courts (see Giuliani and Gaggio v. Italy [GC], no.23458/02, § 180, ECHR 2011 (extracts), and Aydan v. Turkey, no. 16281/10, § 69, 12 March 2013).

130. The evidence produced before the Court indicates that the applicant had been informed of his employer’s internal regulations, which prohibited the personal use of company resources (see paragraph 12 above). He had acknowledged the contents of the document in question and had signed a copy of it on 20 December 2006 (see paragraph 14 above). In addition, the employer had sent all employees an information notice dated 26 June 2007 reminding them that personal use of company resources was prohibited and explaining that an employee had been dismissed for breaching this rule (see paragraph 15 above). The applicant acquainted himself with the notice and signed a copy of it on an unspecified date between 3 and 13 July 2007 (see paragraph 16 above). The Court notes lastly that on 13 July 2007 the applicant was twice summoned by his employer to provide explanations as to his personal use of the internet (see paragraphs 18 and 20 above). Initially, after being shown the charts indicating his internet activity and that of his colleagues, he argued that his use of his Yahoo Messenger account had been purely work-related (see paragraphs 18 and 19 above). Subsequently, on being presented fifty minutes later with a forty-five-page transcript of his communications with his brother and fiancée, he informed his employer that in his view it had committed the criminal offence of breaching the secrecy of correspondence (see paragraph 22 above).

131. The Court notes that the domestic courts correctly identified the interests at stake – by referring explicitly to the applicant’s right to respect for his private life – and also the applicable legal principles (see paragraphs 28 and 30 above). In particular, the Court of Appeal made express reference to the principles of necessity, purpose specification, transparency, legitimacy, proportionality and security set forth in Directive 95/46/EC, and pointed out that the monitoring of internet use and of electronic communications in the workplace was governed by those principles (see paragraph 30 above). The domestic courts also examined whether the disciplinary proceedings had been conducted in an adversarial manner and whether the applicant had been given the opportunity to put forward his arguments.

132. It remains to be determined how the national authorities took the criteria set out above (see paragraph 121) into account in their reasoning when weighing the applicant’s right to respect for his private life and correspondence against the employer’s right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company.

133. As to whether the applicant had received prior notification from his employer, the Court observes that it has already concluded that he did not appear to have been informed in advance of the extent and nature of his employer’s monitoring activities, or of the possibility that the employer might have access to the actual content of his messages (see paragraph 78 above). With regard to the possibility of monitoring, it notes that the County Court simply observed that “the employees’ attention had been drawn to the fact that, shortly before the applicant’s disciplinary sanction, another employee had been dismissed” (see paragraph 28 above) and that the Court of Appeal found that the applicant had been warned that he should not use company resources for personal purposes (see paragraph 30 above). Accordingly, the domestic courts omitted to determine whether the applicant had been notified in advance of the possibility that the employer might introduce monitoring measures, and of the scope and nature of such measures. The Court considers that to qualify as prior notice, the warning from the employer must be given before the monitoring activities are initiated, especially where they also entail accessing the contents of employees’ communications. International and European standards point in this direction, requiring the data subject to be informed before any monitoring activities are carried out (see paragraphs 38 and 43 above; see also, for a comparative-law perspective, paragraph 53 above).

134. As regards the scope of the monitoring and the degree of intrusion into the applicant’s privacy, the Court observes that this question was not examined by either the County Court or the Court of Appeal (see paragraphs 28 and 30 above), even though it appears that the employer recorded all the applicant’s communications during the monitoring period in real time, accessed them and printed out their contents (see paragraphs 17 and 21 above).

135. Nor does it appear that the domestic courts carried out a sufficient assessment of whether there were legitimate reasons to justify monitoring the applicant’s communications. The Court is compelled to observe that the Court of Appeal did not identify what specific aim in the present case could have justified such strict monitoring. Admittedly, this question had been touched upon by the County Court, which had mentioned the need to avoid the company’s IT systems being damaged, liability being incurred by the company in the event of illegal activities in cyberspace, and the company’s trade secrets being disclosed (see paragraph 28 above). However, in the Court’s view, these examples can only be seen as theoretical, since there was no suggestion that the applicant had actually exposed the company to any of those risks. Furthermore, the Court of Appeal did not address this question at all.

136. In addition, neither the County Court nor the Court of Appeal sufficiently examined whether the aim pursued by the employer could have been achieved by less intrusive methods than accessing the actual contents of the applicant’s communications.

137. Moreover, neither court considered the seriousness of the consequences of the monitoring and the subsequent disciplinary proceedings. In this respect the Court notes that the applicant had received the most severe disciplinary sanction, namely dismissal.

138. Lastly, the Court observes that the domestic courts did not determine whether, when the employer summoned the applicant to give an explanation for his use of company resources, in particular the internet (see paragraphs 18 and 20 above), it had in fact already accessed the contents of the communications in issue. It notes that the national authorities did not establish at what point during the disciplinary proceedings the employer had accessed the relevant content. In the Court’s view, accepting that the content of communications may be accessed at any stage of the disciplinary proceedings runs counter to the principle of transparency (see, to this effect, Recommendation CM/Rec(2015)5, cited in paragraph 43 above; for a comparative-law perspective, see paragraph 54 above).

139. Having regard to the foregoing, the Court finds that the Court of Appeal’s conclusion that a fair balance was struck between the interests at stake (see paragraph 30 above) is questionable. Such an assertion appears somewhat formal and theoretical. The Court of Appeal did not explain the specific reasons linked to the particular circumstances of the applicant and his employer that led it to reach that finding.

140. That being so, it appears that the domestic courts failed to determine, in particular, whether the applicant had received prior notice from his employer of the possibility that his communications on Yahoo Messenger might be monitored; nor did they have regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or to the degree of intrusion into his private life and correspondence. In addition, they failed to determine, firstly, the specific reasons justifying the introduction of the monitoring measures; secondly, whether the employer could have used measures entailing less intrusion into the applicant’s private life and correspondence; and thirdly, whether the communications might have been accessed without his knowledge (see paragraphs 120 and 121 above).

141. Having regard to all the above considerations, and notwithstanding the respondent State’s margin of appreciation, the Court considers that the domestic authorities did not afford adequate protection of the applicant’s right to respect for his private life and correspondence and that they consequently failed to strike a fair balance between the interests at stake. There has therefore been a violation of Article 8 of the Convention.