Friday, 15 September 2017

Privacy at work: the Strasbourg Grand Chamber clarifies the law





Lorna Woods, Professor of Internet Law, University of Essex

Background

The case of Bărbulescu concerned the extent to which employers could track employee communications, including Internet use, when those communications might include private correspondence rather than business communications. Here, an employer dismissed an employee for failing to respect a prohibition on the use by employees of work equipment for private reasons. The employee sued his employer in the Romanian courts but lost, so brought a claim under Article 8 ECHR, which protects the right to private and family life, home and correspondence. In particular, Bărbulescu objected to the fact that, to find that he had violated the policy, his employer monitored his communications. This he claimed was contrary to the jurisprudence of the European Court of Human Rights in Copland v UK.  The Fourth Section of the Strasbourg court held, at the beginning of 2016, that the legal situation in Romania did not give rise to a violation of Article 8. While the media tended to summarise the position as the court permitting entirely unrestricted monitoring, this was not entirely the position as noted by Steve Peers here. The matter was in any event referred to the Grand Chamber and it is with this judgment that this note is concerned. The Grand Chamber came, albeit not unanimously, to the opposite conclusion from the Fourth Section, finding that there had been a violation of Article 8 ECHR.  So, why has it come to this conclusion?

Judgment

The Grand Chamber first considered the applicability of Article 8 to the situation in issue.  Re-iterating a long list of previous cases, it emphasised that Article 8 should not be understood narrowly and includes both the right to develop relationships with others and professional activities or activities taking place in a public context. The Court noted two further separate points. First it commented that:

[r]estrictions on an individual’s professional life may fall within Article 8 where they have repercussions on the manner in which he or she constructs his or her social identity by developing relationships with others [para 71].

In this context work is important in providing the possibility for individuals to develop relationships with others. Secondly, while ‘life’ in the list of interests protected by Article 8 is qualified by the adjective ‘private’, the term ‘correspondence’ is not so limited [para 72]. The Court noted that while the test of a reasonable expectation of privacy has been used to determine the scope of Article 8, it here re-iterated that is a significant though not necessarily conclusive factor [para 73]. The Court concluded that while the employee was aware of the ban, he was not aware of the monitoring; that some of the content was intimate in nature; that he alone had the password to the account. The Court left open the question of whether Bărbulescu had a reasonable expectation of privacy in the light of the employer’s policy (of which Bărbulescu was aware), but then held that ‘an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist …’ [para 80]. Both the right to private life and the right in relation to correspondence were therefore engaged.

The Court then considered whether there had been a violation. In this the Court was faced with the question of whether there was a positive obligation, given that the employer was not a public body. The Court noted that the monitoring of the communications could not be regarded as “interference” with Bărbulescu’s right by a State authority [para 109]. Nonetheless, the measure taken by the employer was accepted by the national courts, thus engaging the State’s positive obligations [paras 110-111]. It re-stated that the test was that of whether a fair balance had been struck between the competing interests. The Court noted that labour law has specific characteristics which allows for a wide margin of appreciation. This is not, however, unlimited; States must ensure that there are safeguards in respect of the monitoring of communications. It identified a number of issues:

-          Clear advance notification of the possibility of monitoring;
-          The extent of the monitoring and the degree of intrusion, taking into account the difference between monitoring ‘flow’ of communications and their content;
-          The justification for the monitoring;
-          Whether less intrusive mechanisms for monitoring exist;
-          The consequences for the employee;
-          Whether adequate safeguards were in place.

Further, there should be the possibility of a domestic remedy. The Grand Chamber took the view that the domestic courts did not consider or did not give appropriate weight to all the issues identified [para 140]. Notably, it did not appear the employer had given Bărbulescu sufficient advance notice of "the extent and nature of [its] monitoring activities, or of the possibility that [it] might have access to the actual content of his messages". The Court was also sceptical of the national courts acceptance of the justification for the intrusion. There was therefore a violation of Article 8.  There was dissent, however, on the assessment of the national courts’ approach to the matter.

Comment

The headline news from this is that the Grand Chamber came to a different determination on the issue of breach from the Fourth Section. It should be noted, however, that even that chamber did not suggest that unlimited monitoring would be permissible (see e.g. Steve Peers’ analysis). Nonetheless in purely practical terms, the Grand Chamber judgment provides a clear statement that workplace privacy cannot be reduced to zero, as well as a list of considerations that will be useful not just for national courts but also employers in considering policies regarding personal communications in the workplace. Note that this case concerned a private employer not – as in Halford and Copland – a public body as employer so the considerations highlighted will be of relevance to all employment relationships. In this, the Grand Chamber seemed to respond to some of the concerns expressed by Judge Pinto de Albuquerque in his dissent from the Fourth Section judgment regarding the factual specificity of the case. The judgment also seems to recognise the importance of work as part of daily life, an important point given the blurring of boundaries in the ‘always on’ culture of smart devices in which work-related information and communications co-habit with those of life outside work.

There are some further points to consider. The first is the scope of Article 8 and in particular the ‘reasonable expectation of privacy’.  Article 8 lists a number of aspects protected: ‘private and family life’ – usually seen as two separate elements ‘private life’ and ‘family life’ – ‘home’ and ‘correspondence’. As written, it seems that these are distinct elements yet the reasoning of the Court does not always treat them as separate; arguably the Court’s previous approach in making the matter one of a ‘reasonable expectation of privacy’ blurs any boundaries between these elements and in so doing, limits the scope of protection as far as ‘correspondence’ is concerned. The Grand Chamber seemed alive at least in some regards to this point: it specified that there is no requirement that correspondence be private. If that is the case, however, why is the issue of reasonable expectation of privacy relevant? Indeed, the Grand Chamber noted that the test of reasonable expectation of privacy is not the be all and end all of Article 8 (see para 78). Despite this recognition, the Grand Chamber still turned the question into one of a reasonable expectation of privacy:

It is open to question whether – and if so, to what extent – the employer’s restrictive regulations left the applicant with a reasonable expectation of privacy [para 80].

Is the Court here suggesting that correspondence is protected by Article 8 only when there is a reasonable expectation of privacy? Seemingly so, yet the Grand Chamber continued to state:

…. an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary [para 80].

The position is consequently somewhat unclear. It would be more straightforward were the Court to recognise that correspondence constitutes a separate class aside from private life however broadly understood, and to deal with scope of Article 8 as a separate issue from that of interference and justification.  The current position unfortunately seems to be embedded in a long line of case law.
Bărbulescu is distinct from previous case law on employee monitoring in that it involved the State’s positive obligations. The Court has tended to adopt a different approach in regard to positive obligations than negative obligations. Rather than look at Article 8(2) and the tests of legitimate objective, lawfulness and necessity (in a democratic society), it adopts a fair balance test within which the State has a broad margin of appreciation. On this basis, the side-lining of the Copland ruling – which fell at the lawfulness stage in a standard Article 8(2) analysis – is understandable.  The Court seems to suggest, however, that there are parallels between positive and negative obligations:

[i]n both contexts regard must be had in particular to the fair balance that has to be struck between the competing interests of the individual and of the community as a whole, subject in any event to the margin of appreciation enjoyed by the State [para 112].

It is questionable whether the derogation from an individual’s rights by state actors really should be seen as being about a fair balance, a stance which arguably nudges the focus of protection away from human rights as paramount. Nonetheless, here the Court brings in factors from the standard Article 8(2) state surveillance case law aimed at preventing abuse of secret surveillance capabilities to provide guidance in finding the fair balance. It is noticeable that Copland is not considered but instead the State surveillance cases of Klass and Zakharov

It might be that the Grand Chamber accepted the referral because it wished to deal with failure of the Fourth Section to consider the EU Data Protection Directive, which protects against the collection of personal data without the explicit consent of an individual (or justified grounds for such collection).  This point was highlighted by Judge Pinto de Albuquerque. If so, the judgment fails to engage with EU data protection law in any meaningful way. The Grand Chamber noted that the national courts had considered the directive, but did not consider those rules themselves. Insofar as the Court does refer to international and European standards, it specifies the ILO standards and Council of Europe Recommendation CM/Rec(2015)5, rather than the Directive. It seems then that there has not been any direct engagement with the substantive EU data protection rules.


Photo credit: Aird and Berlis LLP

No comments:

Post a Comment