EHRM, 05-09-2017, nr. 61496/08

The applicant was born in 1979 and lives in Bucharest.

From 1 August 2004 to 6 August 2007 he was employed in the Bucharest office of S., a Romanian private company (‘the employer’), as a sales engineer. At his employer's request, for the purpose of responding to customers' enquiries, he created an instant messaging account using Yahoo Messenger, an online chat service offering real-time text transmission over the internet. He already had another personal Yahoo Messenger account.

The employer's internal regulations prohibited the use of company resources by employees in the following terms:

Article 50

The regulations did not contain any reference to the possibility for the employer to monitor employees' communications.

It appears from documents submitted by the Government that the applicant had been informed of the employer's internal regulations and had signed a copy of them on 20 December 2006 after acquainting himself with their contents.

On 3 July 2007 the Bucharest office received and circulated among all its employees an information notice that had been drawn up and sent by the Cluj head office on 26 June 2007. The employer asked employees to acquaint themselves with the notice and to sign a copy of it. The relevant parts of the notice read as follows:

It also appears from the documents submitted by the Government, including the employer's attendance register, that the applicant acquainted himself with the notice and signed it between 3 and 13 July 2007.

In addition, it transpires that from 5 to 13 July 2007 the employer recorded the applicant's Yahoo Messenger communications in real time.

On 13 July 2007 at 4.30 p.m. the applicant was summoned by his employer to give an explanation. In the relevant notice he was informed that his Yahoo Messenger communications had been monitored and that there was evidence that he had used the internet for personal purposes, in breach of the internal regulations. Charts were attached indicating that his internet activity was greater than that of his colleagues. At that stage, he was not informed whether the monitoring of his communications had also concerned their content. The notice was worded as follows:

On the same day, the applicant informed the employer in writing that he had used Yahoo Messenger for work-related purposes only.

At 5.20 p.m. the employer again summoned him to give an explanation in a notice worded as follows:

The forty-five pages mentioned in the notice consisted of a transcript of the messages which the applicant had exchanged with his brother and his fiancée during the period when he had been monitored; the messages related to personal matters and some were of an intimate nature. The transcript also included five messages that the applicant had exchanged with his fiancée using his personal Yahoo Messenger account; these messages did not contain any intimate information.

Also on 13 July, the applicant informed the employer in writing that in his view it had committed a criminal offence, namely breaching the secrecy of correspondence.

On 1 August 2007 the employer terminated the applicant's contract of employment.

The applicant challenged his dismissal in an application to the Bucharest County Court (‘the County Court’). He asked the court, firstly, to set aside the dismissal; secondly, to order his employer to pay him the amounts he was owed in respect of wages and any other entitlements and to reinstate him in his post; and thirdly, to order the employer to pay him 100,000 Romanian lei (approximately 30,000 euros) in damages for the harm resulting from the manner of his dismissal, and to reimburse his costs and expenses.

As to the merits, relying on Copland v. the United Kingdom (no. 62617/00, §§ 43–44, ECHR 2007-I), he argued that an employee's telephone and email communications from the workplace were covered by the notions of ‘private life’ and ‘correspondence’ and were therefore protected by Article 8 of the Convention. He also submitted that the decision to dismiss him was unlawful and that by monitoring his communications and accessing their contents his employer had infringed criminal law.

With regard specifically to the harm he claimed to have suffered, the applicant noted the manner of his dismissal and alleged that he had been subjected to harassment by his employer through the monitoring of his communications and the disclosure of their contents ‘to colleagues who were involved in one way or another in the dismissal procedure’.

The applicant submitted evidence including a full copy of the transcript of his Yahoo Messenger communications and a copy of the information notice (see paragraph 15 above).

In a judgment of 7 December 2007 the County Court rejected the applicant's application and confirmed that his dismissal had been lawful. The relevant parts of the judgment read as follows:

The applicant appealed to the Bucharest Court of Appeal (‘the Court of Appeal’). He repeated the arguments he had submitted before the first-instance court and contended in addition that that court had not struck a fair balance between the interests at stake, unjustly prioritising the employer's interest in enjoying discretion to control its employees' time and resources. He further argued that neither the internal regulations nor the information notice had contained any indication that the employer could monitor employees' communications.

The Court of Appeal dismissed the applicant's appeal in a judgment of 17 June 2008, the relevant parts of which read:

In the meantime, on 18 September 2007 the applicant had lodged a criminal complaint against the statutory representatives of S., alleging a breach of the secrecy of correspondence. On 9 May 2012 the Directorate for Investigating Organised Crime and Terrorism (DIICOT) of the prosecutor's office attached to the Supreme Court of Cassation and Justice ruled that there was no case to answer, on the grounds that the company was the owner of the computer system and the internet connection and could therefore monitor its employees' internet activity and use the information stored on the server, and in view of the prohibition on personal use of the IT systems, as a result of which the monitoring had been foreseeable. The applicant did not avail himself of the opportunity provided for by the applicable procedural rules to challenge the prosecuting authorities' decision in the domestic courts.

The relevant provisions of the Charter of Fundamental Rights of the European Union (2007/C 303/01) are worded as follows:

Article 7 — Respect for private and family life

Article 8 — Protection of personal data

Directive 95/46/EC of the European Parliament and of the Council of the European Union of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (‘Directive 95/46/EC’) states that the object of national laws on the processing of personal data is notably to protect the right to privacy, as recognised both in Article 8 of the Convention and in the general principles of Community law. The relevant provisions of Directive 95/46/EC read as follows:

Article 2 — Definitions

Article 6

Article 7

Article 8 — The processing of special categories of data

A Working Party on Data Protection (‘the Working Party’) has been set up under Article 29 of the Directive and, in accordance with Article 30, is empowered to:

The Working Party is an independent advisory body of the European Union. It issued an opinion in September 2001 on the processing of personal data in an employment context (opinion 8/2001), which summarises the fundamental data-protection principles: finality, transparency, legitimacy, proportionality, accuracy, security and staff awareness. In the opinion, which it adopted in conformity with its role of contributing to the uniform application of national measures adopted under Directive 95/46/EC, the Working Party pointed out that the monitoring of email involved the processing of personal data, and expressed the view that any monitoring of employees had to be

In May 2002 the Working Party produced a working document on surveillance and monitoring of electronic communications in the workplace (‘the working document’), in which it expressly took into account the provisions of Directive 95/46/EC read in the light of the provisions of Article 8 of the Convention. The working document asserts that the simple fact that a monitoring activity or surveillance is considered convenient to serve an employer's interest cannot in itself justify an intrusion into workers' privacy, and that any monitoring measure must satisfy four criteria: transparency, necessity, fairness and proportionality.

Regarding the technical aspect, the working document states:

More specifically, with regard to the question of access to employees' emails, the working document includes the following passage:

The Court of Justice of the European Union has interpreted the provisions of Directive 95/46/EC in the light of the right to respect for private life, as guaranteed by Article 8 of the Convention, in the case of Österreichischer Rundfunk and Others (C-465/00, C-138/01 and C-139/01, judgment of 20 May 2003, ECLI:EU:C:2003:294, paragraphs 71 et seq.).

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), published in OJ 2016 L 119/1, entered into force on 24 May 2016 and will repeal Directive 95/46/EC with effect from 25 May 2018 (Article 99). The relevant provisions of the Regulation read as follows:

Article 30 — Records of processing activities

Article 47 — Binding corporate rules

Article 88 — Processing in the context of employment

The documents available to the Court concerning the legislation of the Council of Europe member States, in particular a study of thirty-four of them, indicate that all the States concerned recognise in general terms, at constitutional or statutory level, the right to privacy and to secrecy of correspondence. However, only Austria, Finland, Luxembourg, Portugal, Slovakia and the United Kingdom have explicitly regulated the issue of workplace privacy, whether in labour laws or in special legislation.

With regard to monitoring powers, thirty-four Council of Europe member States require employers to give employees prior notice of monitoring. This may take a number of forms, for example notification of the personal data-protection authorities or of workers' representatives. The existing legislation in Austria, Estonia, Finland, Greece, Lithuania, Luxembourg, Norway, Poland, Slovakia and the former Yugoslav Republic of Macedonia requires employers to notify employees directly before initiating the monitoring.

In, Austria, Denmark, Finland, France, Germany, Greece, Italy, Portugal and Sweden, employers may monitor emails marked by employees as ‘private’, without being permitted to access their content. In Luxembourg employers may not open emails that are either marked as ‘private’ or are manifestly of a private nature. The Czech Republic, Italy and Slovenia, as well as the Republic of Moldova to a certain extent, also limit the extent to which employers may monitor their employees' communications, according to whether the communications are professional or personal in nature. In Germany and Portugal, once it has been established that a message is private, the employer must stop reading it.

The applicant submitted that his dismissal by his employer had been based on a breach of his right to respect for his private life and correspondence and that, by not revoking that measure, the domestic courts had failed to comply with their obligation to protect the right in question. He relied on Article 8 of the Convention, which provides:

Article 41 of the Convention provides:

We agree with the majority, some of us with some hesitation, that, even in a context where on the facts before the Court it is difficult to see how the applicant could have had a ‘reasonable expectation of privacy’ (see below), Article 8 is applicable in the circumstances of this case (see paragraphs 69 to 81 of the judgment). With Article 8 having been found to be applicable, we also agree that this applicant's complaint falls to be examined from the standpoint of the State's positive obligations (see paragraph 111 of the judgment). Subject to what follows, we also agree with the general principles applicable to the assessment of the State's positive obligation, as set out in paragraphs 113 to 122 of the judgment.

However, for the reasons set out below, we respectfully disagree with the majority in relation to the correct approach to the State's positive obligation in the context of this case and their ultimate conclusion that the ‘domestic authorities', by which the majority means only the employment courts, ‘did not afford adequate protection of the applicant's right to respect for his private life and correspondence and that they consequently failed to strike a fair balance between the interests at stake’ (see paragraph 141 of the judgment).

In light of the fact that there is common ground that the present application is to be considered by reference to the State's positive obligation under Article 8, the appropriate starting point is provided by the Court's case-law defining the content and reach of the concept of ‘positive obligations’ under Article 8. The relevant principles were most recently summarised by the Grand Chamber, in the context of the positive obligation to protect the applicant's physical and psychological integrity from other persons, in Söderman v. Sweden ([GC], no. 5786/08, §§ 78–85, ECHR 2013). There the Court made clear that:

The facts of this case, as the majority at least implicitly accepts (see paragraph 80 of the judgment), are, of course, a million miles away from the seriousness of the cases considered in Söderman. After all, in that case the Court was concerned with allegations of the violation of a person's physical or psychological integrity by another person.

Nevertheless, even in that context, it is clear, firstly, that the choice of measures designed to secure respect for private life under Article 8, even in the sphere of the relations of individuals between themselves, is primarily for the Contracting States; a choice in relation to which they enjoy a wide margin of appreciation (see paragraph 119 of the judgment; narrowing where, unlike in the present case, a particularly important facet of an individual's existence or identity is at stake, or where the activities at stake involve a most intimate aspect of private life). This conclusion is underlined by the fact that there is no European consensus on this matter and only six out of thirty-four surveyed Council of Europe member States have explicitly regulated the issue of the workplace privacy (see paragraphs 52 and 118 of the judgment). Secondly, the ‘measures’ adopted by the State under Article 8 should in principle take the form of an adequate ‘legal framework’ affording protection to the victim. Article 8 does not necessarily require that an efficient criminal-law provision covering the specific act be in place. The legal framework could also consist of civil-law remedies capable of affording sufficient protection.

This, of course, applies mutatis mutandis in the present case where, as the majority identify, the Court is at best concerned with the protection of a core or minimum level of private life and correspondence in the work place against interference by a private law employer.

Having identified some of the principles set out above, the majority, in paragraph 123, unjustifiably in our view, narrowed its enquiry to the question ‘how the domestic courts to which the applicant applied dealt with his complaint of an infringement by his employer of his right to respect for private life and correspondence in an employment context’.

Although recognising that ‘protective measures are not only to be found in labour law, but also in civil and criminal law’ (see paragraph 116 of the judgment), the majority in fact sidelined and avoided the real question that falls to be answered, namely: did the High Contracting Party maintain and apply an adequate ‘legal framework’ providing at least civil-law remedies capable of affording sufficient protection to the applicant?

As the respondent Government submitted, and the majority accepts, the relevant ‘legal framework’ in Romania consisted not only of the employment courts, before which the applicant raised his complaint, but also included inter alia:

Other than the criminal complaint which was not pursued any further, none of the domestic remedies was ever engaged by the applicant. Instead, the applicant only applied to the employment courts to challenge not primarily the interference by his employer with his private life/correspondence but his dismissal. As the majority note in paragraph 24:

It was only in the context of these dismissal proceedings that, relying on the judgment of this Court in Copland v. the United Kingdom (no. 62617/00, §§ 43–44, ECHR 2007-I), he argued that the decision to dismiss him was unlawful and that by monitoring his communications and accessing their contents his employer had infringed criminal law.

The fact that the applicant's focus was primarily, if not exclusively, on the legality of his dismissal, rather than the interference by his employer with his right to respect for private life/correspondence, is also reflected in the way his case was presented before this Court. As the judgment notes at paragraph 55, the applicant's complaint was that ‘his dismissal by his employer had been based on a breach of his right to respect for his private life and correspondence and that, by not revoking that measure, the domestic courts had failed to comply with their obligation to protect the right in question’.

As a consequence, one cannot help but note (if only in passing) that, if the respondent Government had raised this as a preliminary objection, there might have been some question as to whether, by applying to the employment courts on the basis he did, the applicant had, in fact, exhausted those domestic remedies ‘that relate to the breaches alleged and which are at the same time available and sufficient’ (see Aquilina v. Malta [GC], no. 25642/94, § 39, ECHR 1999-III). After all, there is no material before the Court to suggest that any of the three remedies identified above, and, in particular, a complaint to the specialist data protection supervisory authority and/or an action for damages under Law no. 677/2001 before the competent courts were ‘bound to fail’ (see Davydov and Others v. Russia, no. 75947/11, § 233, 30 May 2017).

Our doubts about the effectiveness of the employment courts in this context (and the appropriateness of the Court restricting its analysis to the adequacy of the analysis by those employment courts) is further underlined by the fact that, in line with this Court's jurisprudence under Article 6 of the Convention, regardless of whether or not the employer's actions were illegal that fact could not per se undermine the validity of the disciplinary proceedings in the instant case. After all, as this Court confirmed most recently in Vukota-Bojić v. Switzerland (no. 61838/10, §§ 94–95, 18 October 2016):

In any event, the above alternative domestic remedies, some of which are more obviously suitable to the protection of an individual's private life/correspondence in the private workplace, were plainly relevant to the assessment whether the ‘legal framework’ created by Romania was capable of providing ‘adequate’ protection to the applicant against an unlawful interference with his right to respect for private life/correspondence under Article 8 by another private individual (in this case, his employer).

By not including them, sufficiently or at all, in their analysis, the majority failed to have regard to important factors relevant to the question posed by this case and failed to give due weight to the acknowledged wide margin of appreciation enjoyed by High Contracting Parties in determining what measures to take and what remedies to provide for in compliance with their positive obligation under Article 8 to put in place an adequate ‘legal framework’. Absent any evidence to suggest that the domestic remedies either individually or cumulatively were not sufficiently available or effective to provide the protection required under Article 8, it seems to us that there is no basis on which the Court could find a violation of Article 8 in the circumstances of the present case.

Before leaving this question of the appropriate focus for the enquiry, we would want to express our sincere hope that the majority judgment should not be read as a blanket requirement under the Convention that, where more appropriate remedies are available within the domestic legal framework (such as e.g. those required to be put in place under the relevant EU data protection legislation), the domestic employment courts, when confronted with a case such as that brought by the applicant, are required to duplicate the functions of any such, more appropriate, specialist remedy.

However, even if, contrary to the above, the majority's focus only on the analysis by the domestic employment courts were the appropriate approach, we also do not agree that, in fact, that analysis is defective so as to lead to a finding of a violation under Article 8.

In considering the judgments of the County Court and the Bucharest Court of Appeal, we note that both domestic courts took into consideration the employer's internal regulations, which prohibited the use of company resources for personal purposes (see paragraphs 12, 28 and 30 of the judgment). We further observe that the applicant had been informed of the internal regulations, since he had acquainted himself with them and signed a copy of them on 20 December 2006 (see paragraph 14 of the judgment). The domestic courts interpreted the provisions of that instrument as implying that it was possible that measures might be taken to monitor communications, an eventuality that was likely to reduce significantly the likelihood of any reasonable expectation on the applicant's part that the privacy of his correspondence would be respected (contrast Halford v. the United Kingdom, 25 June 1997, § 45, Reports of Judgments and Decisions 1997-III, and Copland, cited above, § 42). We therefore consider that the question of prior notification should have been examined against this background.

In this context, it is clear on the evidence before the Court that the domestic courts did indeed consider this question. Both the County Court and the Court of Appeal attached a certain weight to the information notice which the applicant had signed, and their decisions indicate that a signed copy of the notice was produced in the proceedings before them (see paragraphs 28 and 30 of the judgment). The County Court observed, among other things, that the employer had warned its employees that their activities, including their computer use, were being monitored, and that the applicant himself had acknowledged the information notice (see paragraph 28 of the judgment). The Court of Appeal further confirmed that ‘personal use [of company resources could] be refused … in accordance with the provisions of the internal regulations’, of which the employees had been duly informed (see paragraph 30 of the judgment). Accordingly, the domestic courts found, on the basis of the documents in their possession, that the applicant had received sufficient warning that his activities, including his use of the computer made available to him by his employer, could be monitored. We can see no basis for departing from their decisions, and consider that the applicant could reasonably have expected his activities to be monitored.

Next, we note that the national authorities carried out a careful balancing exercise between the interests at stake, taking into account both the applicant's right to respect for his private life and the employer's right to engage in monitoring, including the corresponding disciplinary powers, in order to ensure the smooth running of the company (see paragraphs 28 and 30 of the judgment; see also, mutatis mutandis, Obst v. Germany, no. 425/03, § 49, 23 September 2010, and Fernández Martínez v. Spain [GC], no. 56030/07, § 151, ECHR 2014 (extracts). The Court of Appeal, in particular, citing the provisions of Directive 95/46/EC, noted that there had been a conflict in the present case between ‘the employer's right to engage in monitoring and the employees' right to protection of their privacy’ (see paragraph 30 of the judgment).

We also note that, on the basis of the material in their possession, the domestic courts found that the legitimate aim pursued by the employer in engaging in the monitoring of the applicant's communications had been to exercise ‘the right and the duty to ensure the smooth running of the company’ (see the Court of Appeal as quoted at paragraph 30 of the judgment). While the domestic courts attached greater weight to the employer's right to ensure the smooth running of the company and to supervise how employees performed their tasks in the context of their employment relationship than to the applicant's right to respect for his private life and correspondence, we consider that it is not unreasonable for an employer to wish to check that its employees are carrying out their professional duties when making use in the workplace and during working hours of the equipment which it has made available to them. The Court of Appeal found that the monitoring of the applicant's communications was the only way for the employer to achieve this legitimate aim, prompting it to conclude that a fair balance had been struck between the need to protect the applicant's private life and the employer's right to supervise the operation of its business (see paragraph 30 of the judgment).

In our view, the choice of the national authorities to give the employer's interests precedence over those of the employee is not capable in itself of raising an issue under the Convention (see, mutatis mutandis, Obst, cited above, § 49). We would reiterate that where they are required to strike a balance between several competing private interests, the authorities enjoy a certain discretion (see Hämäläinen v. Finland [GC], no. 37359/09, § 67 in fine, ECHR 2014, and further references). In the present case, therefore, it is our view that the domestic courts acted within Romania's margin of appreciation.

We further note that the monitoring to which the applicant was subjected was limited in time, and that the evidence before the Court indicates that the employer only monitored the applicant's electronic communications and internet activity. Indeed, the applicant did not allege that any other aspect of his private life, as enjoyed in a professional context, had been monitored by his employer. Furthermore, on the evidence before the Court, the results of the monitoring operation were used solely for the purposes of the disciplinary proceedings against the applicant and only the persons involved in those proceedings had access to the content of the applicant's communications (for a similar approach see Köpke v. Germany (dec.), no. 420/07, 5 October 2010). In this connection, it is observed that the majority agree that the applicant did not substantiate his allegations that the content in question had been disclosed to other colleagues (see paragraph 126 of the judgment).

Lastly, we note that in their examination of the case, the national authorities took into account the attitude displayed by the applicant in the course of his professional activities in general, and during the disciplinary proceedings against him in particular. Thus, the County Court found that he had committed a disciplinary offence by breaching his employer's internal regulations, which prohibited the use of computers for personal purposes (see paragraph 28 of the judgment). The domestic authorities attached significant weight in their analysis to the applicant's attitude in the disciplinary proceedings, during which he had denied using his employer's resources for personal purposes and had maintained that he had used them solely for work-related purposes, which was incorrect (see paragraphs 28 and 30 of the judgment). They were plainly entitled to do so. This was confirmed when the applicant asserted before this Court that, despite the fact that he knew that private use of his work computer was prohibited, it would only have been an awareness of monitoring by the employer which would have led him not to engage in private use of the employer's computer; he did not deny that he was informed about the monitoring, but could not remember when he had received the information notice alerting him to the monitoring.

After all, as the majority also stress (see paragraph 121 of the judgment), in order to be fruitful, employment relations must be based on mutual trust (see Palomo Sánchez and Others v. Spain [GC], nos. 28955/06 and 3 others, § 76, ECHR 2011). Accordingly, it is our view that within their margin of appreciation, the domestic (employment) courts were entitled, when weighing up the interests at stake, to take into account the attitude displayed by the applicant, who had broken the bond of trust with his employer.

Having regard to all the foregoing considerations and in contrast to the majority, we conclude that there has been no failure to protect the applicant's right to respect for his private life and correspondence and that there has, therefore, been no violation of Article 8 of the Convention.

The applicant was born in 1979 and lives in Bucharest.

From 1 August 2004 to 6 August 2007, he was employed by a private company (‘the employer’) as an engineer in charge of sales. At his employer's request, he created a Yahoo Messenger account for the purpose of responding to clients' enquiries.

On 13 July 2007 the employer informed the applicant that his Yahoo Messenger communications had been monitored from 5 to 13 July 2007 and that the records showed that he had used the Internet for personal purposes, contrary to internal regulations. The applicant replied in writing that he had only used Yahoo Messenger for professional purposes. When presented with a forty-five-page transcript of his communications on Yahoo Messenger, the applicant notified his employer that, by violating his correspondence, they were accountable under the Criminal Code. The forty-five pages contained transcripts of all the messages that the applicant had exchanged with his fiancée and his brother during the period when his communications had been monitored; they related to personal matters involving the applicant. The transcript also contained five short messages that the applicant had exchanged with his fiancée on 12 July 2007 using a personal Yahoo Messenger account; these messages did not disclose any intimate information.

On 1 August 2007 the employer terminated the applicant's employment contract for breach of the company's internal regulations which stated, inter alia:

The applicant challenged his employer's decision before the Bucharest County Court (‘the County Court’). He complained that this decision had been null and void since, by accessing his communications, his employer had violated his right to correspondence protected by the Romanian Constitution and the Criminal Code.

In a judgment of 7 December 2007, the County Court dismissed his complaint on the grounds that the employer had complied with the dismissal proceedings provided for by the Labour Code and noted that the applicant had been duly informed of the employer's regulations that prohibited the use of company resources for personal purposes. The County Court's judgment reads, in its relevant parts:

The applicant appealed against this judgment. He claimed that e-mails were also protected by Article 8 of the Convention as pertaining to ‘private life’ and ‘correspondence’. He also complained that the County Court had not allowed him to call witnesses to prove that the employer had not suffered as a result of his actions.

In a final decision of 17 June 2008, the Bucharest Court of Appeal (‘the Court of Appeal’) dismissed his appeal and upheld the judgment rendered by the County Court. Relying on EU Directive 95/46/EC, the Court of Appeal ruled that the employer's conduct had been reasonable and that the monitoring of the applicant's communications had been the only method of establishing if there had been a disciplinary breach. With regard to his procedural rights, the Court of Appeal dismissed the applicant's arguments, stating that the evidence already before it was sufficient. The Court of Appeal's decision reads, in its relevant parts:

The Romanian Constitution guarantees the right to the protection of intimate, private and family life (Article 26) as well as private correspondence (Article 28).

Article 195 of the Criminal Code provides that:

The Labour Code in force at the time of events provided in Article 40(1)(d) that the employer had the right to monitor the manner in which the employees completed their professional tasks. Article 40(2)(i) provided that the employer had a duty to guarantee the confidentiality of the employees' personal data.

Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of personal data (‘Law no. 677/2001’) applies the provisions of EU Directive 95/46/EC (see paragraph 18 below). It defines ‘personal data’ as ‘any data related to an identified or identifiable individual’ (Article 3(a)). It provides that data can only be processed if the person concerned consented to it and it sets out a list of exceptions when consent is not necessary. Exceptions refer, among other situations, to the completion of a contract to which the concerned individual is a party and to securing a legitimate interest of the data operator (Article 5(2)(a and e)). It also provides that when processing data, public authorities remain under the obligation to protect the individuals' intimate, private and family life (Article 5(3)). Lastly, anyone who suffered prejudice as a result of illegal processing of his/her personal data can ask the courts to allow him/her reparation (Article 18(2)).

The applicant complained that his employer's decision to terminate his contract had been based on a breach of his right to respect for his private life and correspondence and that the domestic courts had failed to protect his right; he relied on Article 8 of the Convention, which reads as follows:

Relying on Article 6 of the Convention, the applicant also complained that the proceedings before the domestic courts had been unfair, in particular as he had not been allowed to present witnesses as part of his case.

The Court notes that the applicant was able to raise these arguments before the Court of Appeal, which ruled, in a sufficiently reasoned decision, that hearing additional witnesses was not relevant to the case (see paragraph 12 above). Such a decision was delivered in a public hearing conducted in an adversarial manner and does not seem arbitrary (see García Ruiz v. Spain [GC], no. 30544/96, §§ 28–29, ECHR 1999-I).

It follows that this complaint is manifestly ill-founded and must be rejected in accordance with Article 35 §§ 3 (a) and 4 of the Convention.

As the Court's Grand Chamber recently stated, user-generated expressive activity on the Internet provides an unprecedented platform for the exercise of freedom of expression2.. In the light of its accessibility and capacity to store and communicate vast amounts of information, the Internet also plays an important role in enhancing the public's access to news and facilitating the dissemination of information in general3.. Along the same line of reasoning, the French Constitutional Council has affirmed that ‘in the current state of means of communication and given the generalised development of public online communication services and the importance of the latter for the participation in democracy and the expression of ideas and opinions, this right (to freedom of expression) implies freedom to access such services.’4. Thus, States have a positive obligation to promote and facilitate universal Internet access, including the creation of the infrastructure necessary for Internet connectivity5.. In the case of private communications on the Internet, the obligation to promote freedom of expression is coupled with the obligation to protect the right to respect for private life. States cannot ensure that individuals are able to freely seek and receive information or express themselves without also respecting, protecting and promoting their right to privacy. At the same time, the risk of harm posed by Internet communications to the exercise and enjoyment of human rights and freedoms, particularly the right to respect for private life, is certainly higher than that posed by the press6.. For example, States should counter racial or religious discrimination or hate speech over the Internet7.. In other words, situations may emerge where the freedom of expression of the content provider, protected by Article 10, may collide with the right to respect for private life of others enshrined in Article 8, or where both the freedom of expression and the right to respect for private life of those involved in Internet communications may conflict with the rights and freedoms of others. The present case pertains to this second type of situation.

Internet surveillance in the workplace is not at the employer's discretionary power. In a time when technology has blurred the diving line between work life and private life, and some employers allow the use of company-owned equipment for employees' personal purposes, others allow employees to use their own equipment for work-related matters and still other employers permit both, the employer's right to maintain a compliant workplace and the employee's obligation to complete his or her professional tasks adequately does not justify unfettered control of the employee's expression on the Internet8.. Even where there exist suspicions of cyberslacking, diversion of the employer's IT resources for personal purposes, damage to the employer's IT systems, involvement in illicit activities or disclosure of the employer's trade secrets, the employer's right to interfere with the employee's communications is not unrestricted. Given that in modern societies Internet communication is a privileged form of expression, including of private information, strict limits apply to an employer's surveillance of Internet usage by employees during their worktime and, even more strictly, outside their working hours, be that communication conducted through their own computer facilities or those provided by the employer.

The Convention principle is that Internet communications are not less protected on the sole ground that they occur during working hours, in the workplace or in the context of an employment relationship, or that they have an impact on the employer's business activities or the employee's performance of contractual obligations9.. This protection includes not only the content of the communications, but also the metadata resulting from the collection and retention of communications data, which may provide an insight into an individual's way of life, religious beliefs, political convictions, private preferences and social relations10.. In the absence of a warning from the employer that communications are being monitored, the employee has a ‘reasonable expectation of privacy’11.. Any interference by the employer with the employee's right to respect for private life and freedom of expression, including the mere storing of personal data related to the employee's private life, must be justified in a democratic society by the protection of certain specific interests covered by the Convention12., namely the protection of the rights and freedoms of the employer or other employees (Article 8 § 2)13. or the protection of the reputation or rights of the employer or other employees and the prevention of the disclosure of information received by the employee in confidence (Article 10 § 2)14.. Hence, the pursuit of maximum profitability and productivity from the workforce is not per se an interest covered by Article 8 § 2 and Article 10 § 2, but the purpose of ensuring the fair fulfilment of contractual obligations in an employment relationship may justify certain restrictions on the above-mentioned rights and freedoms in a democratic society15..

Other than the Court's case-law, the international standards of personal data protection both in the public and private sectors have been set out in the 1981 Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data16.. In this Convention the protection of personal data was for the first time guaranteed as a separate right granted to an individual. Specific rules for data protection in employment relations are contained in the Council of Europe Committee of Ministers Recommendation Rec(89)2 to member states on the protection of personal data used for employment purposes, 18 January 1989, recently replaced by Recommendation CM/Rec(2015)5 of the Committee of Ministers to member States on the processing of personal data in the context of employment. Also extremely valuable in this context are Recommendation No.R(99) 5 for the protection of privacy on the Internet, adopted on 23 February 1999, and Recommendation CM/Rec(2010)13 on the protection of individuals with regard to automatic processing of personal data in the context of profiling, adopted on 23 November 2010.

In the legal framework of the European Union (EU), respect for private life and protection of personal data have been recognised as separate fundamental rights in Articles 7 and 8 of the EU Charter of Fundamental Rights. The central piece of EU legislation is Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Employment relations are specifically referred to only in the context of the processing of sensitive data. Regulation (EC) No 45/2001 lays down the same rights and obligations at the level of the EC institutions and bodies. It also establishes an independent supervisory authority with the task of ensuring that the Regulation is complied with. Directive 2002/58/EC concerns the processing of personal data and the protection of privacy in the electronic communications sector, regulating issues like confidentiality, billing and traffic data and spam. The confidentiality of communications is protected by Article 5 of the Directive, which imposes on Member States an obligation to ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular they are to prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so. The interception of communications over private networks, including e-mails, instant messaging services, and phone calls, and generally private communications, are not covered, as the Directive refers to publicly available electronic communications services in public communication networks. Also relevant is Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, which specifies that Member States may not impose general monitoring obligations on providers of internet/email services, because such an obligation would constitute an infringement of freedom of information as well as of the confidentiality of correspondence (Article 15). Within the former third pillar of the EU, Framework Decision 2008/977/JHA dealt with the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. Finally, Article 29 Working Party Opinion 8/2001 on the processing of personal data in the employment context, adopted on 13 September 200117., the Working Document on the surveillance and the monitoring of electronic communications in the workplace, adopted on 29 May 200218., the Working Document on a common interpretation of Article 26(1) of Directive 95/46/EC, adopted on 25 November 200519., and Article 29 Working Party Opinion 2/2006 on privacy issues related to the provision of email screening services, adopted on 21 February 200620., are also important for setting the standards of data protection applicable to employees in the EU. In its 2005 annual report, the Working Party affirmed that ‘[i]t is not disputed that an e-mail address assigned by a company to its employees constitutes personal data if it enables an individual to be identified’21..

Finally, both the 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data22., and the International Labour Office's 1997 Code of Practice on the protection of workers' personal data, provide important soft-law guidance to employers, employees and courts.

From this international legal framework, a consolidated, coherent set of principles can be drawn for the creation, implementation and enforcement of an Internet usage policy in the framework of an employment relationship23.. Any information related to an identified or identifiable employee that is collected, held or used by the employer for employment purposes, including with regard to private electronic communications, must be protected in order to respect the employee's right to privacy and freedom of expression24.. Consequently, any processing of personal data for the purposes of recruitment, fulfilment or breach of contractual obligations, staff management, work planning and organisation and termination of an employment relationship in both the public and private sectors must be regulated either by law, collective agreement or contract25.. Particular forms of personal data processing, for example of the employees' usage of Internet and electronic communications in the workplace, warrant detailed regulation26..

Hence, a comprehensive Internet usage policy in the workplace must be put in place, including specific rules on the use of email, instant messaging, social networks, blogging and web surfing. Although policy may be tailor-made to the needs of each corporation as a whole and each sector of the corporation infrastructure in particular, the rights and obligations of employees should be set out clearly, with transparent rules on how the Internet may be used, how monitoring is conducted, how data is secured, used and destroyed, and who has access to it27..

A blanket ban on personal use of the Internet by employees is inadmissible28., as is any policy of blanket, automatic, continuous monitoring of Internet usage by employees29.. Personal data relating to racial origin, political opinions or religious or other beliefs, as well as personal data concerning health, sexual life or criminal convictions are considered as ‘sensitive data’ requiring special protection30..

Employees must be made aware of the existence of an Internet usage policy in force in their workplace, as well as outside the workplace and during out-of-work hours, involving communication facilities owned by the employer, the employee or third parties31.. All employees should be notified personally of the said policy and consent to it explicitly32.. Before a monitoring policy is put in place, employees must be aware of the purposes, scope, technical means and time schedule of such monitoring33.. Furthermore, employees must have the right to be regularly notified of the personal data held about them and the processing of that personal data, the right to access all their personal data, the right to examine and obtain a copy of any records of their own personal data and the right to demand that incorrect or incomplete personal data and personal data collected or processed inconsistently with corporation policy be deleted or rectified34.. In event of alleged breaches of Internet usage policy by employees, opportunity should be given to them to respond to such claims in a fair procedure, with judicial oversight.

The enforcement of an Internet usage policy in the workplace should be guided by the principles of necessity and proportionality, in order to avoid a situation where personal data collected in connection with legitimate organisational or information-technology policies is used to control employees' behaviour35.. Before implementing any concrete monitoring measure, the employer should assess whether the benefits of that measure outweigh the adverse impact on the right to privacy of the concerned employee and of third persons who communicate with him or her36.. Unconsented collection, access and analysis of the employee's communications, including metadata, may be permitted only exceptionally, with judicial authorisation, since employees suspected of policy breaches in disciplinary or civil proceedings must not be treated less fairly than presumed offenders in criminal procedure. Only targeted surveillance in respect of well-founded suspicions of policy violations is admissible, with general, unrestricted monitoring being manifestly excessive snooping on employees37.. The least intrusive technical means of monitoring should be preferred38.. Since blocking Internet communications is a measure of last resort39., filtering mechanisms may be considered more appropriate, if at all necessary, to avoid policy infringements40.. The collected data may not be used for any purpose other than that originally intended, and must be protected from alteration, unauthorised access and any other form of misuse41.. For example, the collected data must not be made available to other employees who are not concerned by it. When no longer needed, the collected personal data should be deleted42..

Breaches of the internal usage policy expose both the employer and the employee to sanctions. Penalties for an employee's improper Internet usage should start with a verbal warning, and increase gradually to a written reprimand, a financial penalty, demotion and, for serious repeat offenders, termination of employment43.. If the employer's Internet monitoring breaches the internal data protection policy or the relevant law or collective agreement, it may entitle the employee to terminate his or her employment and claim constructive dismissal, in addition to pecuniary and non-pecuniary damages.

Ultimately, without such a policy, Internet surveillance in the workplace runs the risk of being abused by employers acting as a distrustful Big Brother lurking over the shoulders of their employees, as though the latter had sold not only their labour, but also their personal lives to employers. In order to avoid such commodification of the worker, employers are responsible for putting in place and implementing consistently a policy on Internet use along the lines set out above. In so doing, they will be acting in accordance with the principled international-law approach to Internet freedom as a human right44..

The Government argue that the company's internal regulations provided for a prohibition on the use of computers for personal purposes. Although true, the argument is not relevant, since the given internal regulations omitted any reference to an Internet surveillance policy being implemented in the workplace. In this context, it should not be overlooked that the Government also refer to notice 2316 of 3 July 2007, which ‘highlighted that another employee had been let go on disciplinary grounds, specifically due to personal use of the company's Internet connection and phones’ and ‘reiterated that the employer verifies and monitors the employees' activity, specifically stating that they should not use the Internet, phones or faxes for issues unrelated to work’, in other words, which ‘reiterated’ the existence of a policy of Internet surveillance in the company45.. Also according to the Government, the employees had been informed about this notice, and it had even been signed by the applicant. The applicant disputes these facts. The majority themselves acknowledge that it is contested whether the company's Internet surveillance policy had been notified to the applicant prior to the interference with his Internet communications46.. Unfortunately, the majority did not elaborate further on this crucial fact.

Since the existence of prior notice was alleged by the Government and disputed by the applicant, the Government had the burden of providing evidence to that effect, which they did not47.. Moreover, the only copy of the notice 2316 available in the Court's file is not even signed by the employee48.. In other words, there is not sufficient evidence in the file that the company's employees, and specifically the applicant, were aware that monitoring software had been installed by the employer and recorded in real time the employees' communications on the company's computers, produced statistical records of each employee's Internet use and transcripts of the content of the communications exchanged by them, and could block their communication49..

Even assuming that notice 2316 did exist and was indeed notified to the employees, including the applicant, prior to the events in question, this would not suffice to justify the termination of his contract, given the extremely vague character of the notice. A mere communication by the employer to employees that ‘their activity was under surveillance’50. is manifestly insufficient to provide the latter with adequate information about the nature, scope and effects of the Internet surveillance programme implemented51.. Such a poorly-drafted ‘policy’, if existent, offered precious little protection to employees. In spite of its crucial importance for the outcome of the case, the majority did not care to consider the terms of the notice on the company's alleged Internet surveillance policy. Taking into account the evidence before the Court, I cannot but consider that the notice did not identify the minimum elements of an Internet usage and surveillance policy, including the specific misconduct being monitored, the technical means of surveillance and the employee's rights regarding the monitored materials.

The delicate character of the present case is significantly heightened by the nature of certain of the applicant's messages. They referred to the sexual health problems affecting the applicant and his fiancée52.. This subject pertains to the core of the applicant's private life and requires the most intense protection under Article 8. Other than this sensitive data, the messages also dealt with other personal information, such as his uneasiness with the hostile working environment. The employer accessed not only the professional Yahoo Messenger account created by the applicant, but also his own personal account53.. The employer had no proprietary rights over the employee's Yahoo messenger account, notwithstanding the fact that the computer used by the employee belonged to the employer54.. Furthermore, the employer was aware that some of the communications exchanged by the applicant were directed to an account entitled ‘Andra loves you’, which could evidently have no relationship with the performance of the applicant's professional tasks55.. Yet the employer accessed the content of this communication and made transcripts of it against the applicant's explicit will and without a court order56..

In addition, the employer's interference had wide adverse social effects, since the transcripts of the messages were made available to the applicant's colleagues and even discussed by them57.. Even if one were to accept that the interference with the applicant's right to respect for private life was justified in this case, which it was not, the employer did not take the necessary precautionary measures to ensure that the highly sensitive messages were restricted to the disciplinary proceedings. In other words, the employer's interference went far beyond what was necessary58..

Having said that, the termination of the applicant's employment relationship with the company could not be based on evidence that did not meet the Convention standards of protection of employees' privacy. In ratifying the employer's dismissal decision, the domestic courts accepted as legal evidence of the breach of the applicant's professional duties records of private communications which merited Convention protection and had nonetheless been accessed, used and publicised by the employer, in violation of the Convention standard59.. Moreover, the termination of the applicant's employment contract can hardly be said to be proportionate in itself, bearing in mind that it was not proven that the applicant had caused actual damage to his employer, or that he had adopted the same pattern of behaviour for a considerable period of time60..