EHRM, 03-04-2007, nr. 62617/00

The Government accepted that the College was a public body for whose actions the State was directly responsible under the Convention.

Although there had been some monitoring of the applicant's telephone calls, e-mails and internet usage prior to November 1999, this did not extend to the interception of telephone calls or the analysis of the content of websites visited by her. The monitoring thus amounted to nothing more than the analysis of automatically generated information to determine whether College facilities had been used for personal purposes which, of itself, did not constitute a failure to respect private life or correspondence. The case of P.G. and J.H. v. the United Kingdom, no. 44787/98, ECHR 2001-IX, could be distinguished since there actual interception of telephone calls occurred. There were significant differences from the case of Halford v. the United Kingdom, judgment of 25 June 1997, Reports of Judgments and Decisions 1997-III, where the applicant's telephone calls were intercepted on a telephone which had been designated for private use and, in particular her litigation against her employer.

In the event that the analysis of records of telephone, e-mail and internet use was considered to amount to an interference with respect for private life or correspondence, the Government contended that the interference was justified.

First, it pursued the legitimate aim of protecting the rights and freedoms of others by ensuring that the facilities provided by a publicly funded employer were not abused. Secondly, the interference had a basis in domestic law in that the College, as a statutory body, whose powers enable it to provide further and higher education and to do anything necessary and expedient for those purposes, had the power to take reasonable control of its facilities to ensure that it was able to carry out its statutory functions. It was reasonably foreseeable that the facilities provided by a statutory body out of public funds could not be used excessively for personal purposes and that the College would undertake an analysis of its records to determine if there was any likelihood of personal use which needed to be investigated. In this respect, the situation was analogous to that in Peck v. the United Kingdom, no. 44647/98, ECHR 2003-I.

Finally, the acts had been necessary in a democratic society and were proportionate as any interference went no further than necessary to establish whether there had been such excessive personal use of facilities as to merit investigation.

The applicant did not accept that her e-mails were not read and that her telephone calls were not intercepted but contended that, even if the facts were as set out by the Government, it was evident that some monitoring activity took place amounting to an interference with her right to respect for private life and correspondence.

She referred to legislation subsequent to the alleged violation, namely the Regulation of Investigatory Powers Act 2000 and the Telecommunications Regulations 2000 (see paragraph 20 above), which she claimed were an explicit recognition by the Government that such monitoring amounted to interference under Article 8 and required authorisation in order to be lawful. Since these laws came into force in 2000, the legal basis for such interference post-dated the events in the present case. Thus, the interference had no basis in domestic law and was entirely different from the position in Peck (see paragraph 34 above) where the local authority was specifically empowered by statute to record visual images of events occurring in its area. In the present case there was no such express power for the College to carry out surveillance on its employees and the statutory powers did not make such surveillance reasonably foreseeable.

The applicant asserted that the conduct of the College was neither necessary nor proportionate. There were reasonable and less intrusive methods that the College could have used such as drafting and publishing a policy dealing with the monitoring of employees' usage of the telephone, internet and e-mail.

According to the Court's case-law, telephone calls from business premises are prima facie covered by the notions of ‘private life’ and ‘correspondence’ for the purposes of Article 8 § 1 (see Halford, cited above, § 44 and Amann v. Switzerland [GC], no. 27798/95, § 43, ECHR 2000-II). It follows logically that e-mails sent from work should be similarly protected under Article 8, as should information derived from the monitoring of personal internet usage.

The applicant in the present case had been given no warning that her calls would be liable to monitoring, therefore she had a reasonable expectation as to the privacy of calls made from her work telephone (see Halford, § 45). The same expectation should apply in relation to the applicant's e-mail and internet usage.

The Court recalls that the use of information relating to the date and length of telephone conversations and in particular the numbers dialled can give rise to an issue under Article 8 as such information constitutes an ‘integral element of the communications made by telephone’ (see Malone v. the United Kingdom, judgment of 2 August 1984, Series A no. 82, § 84). The mere fact that these data may have been legitimately obtained by the College, in the form of telephone bills, is no bar to finding an interference with rights guaranteed under Article 8 (ibid). Moreover, storing of personal data relating to the private life of an individual also falls within the application of Article 8 § 1 (see Amann, cited above, § 65). Thus, it is irrelevant that the data held by the college were not disclosed or used against the applicant in disciplinary or other proceedings.

Accordingly, the Court considers that the collection and storage of personal information relating to the applicant's telephone, as well as to her e-mail and internet usage, without her knowledge, amounted to an interference with her right to respect for her private life and correspondence within the meaning of Article 8.

The Court recalls that it is well established in the case-law that the term ‘in accordance with the law’ implies — and this follows from the object and purpose of Article 8 — that there must be a measure of legal protection in domestic law against arbitrary interferences by public authorities with the rights safeguarded by Article 8 § 1. This is all the more so in areas such as the monitoring in question, in view of the lack of public scrutiny and the risk of misuse of power (see Halford, cited above, § 49).

This expression not only requires compliance with domestic law, but also relates to the quality of that law, requiring it to be compatible with the rule of law (see, inter alia, Khan v. the United Kingdom, judgment of 12 May 2000, Reports of Judgments and Decisions 2000-V, § 26; P.G. and J.H. v. the United Kingdom, cited above, § 44). In order to fulfil the requirement of foreseeability, the law must be sufficiently clear in its terms to give individuals an adequate indication as to the circumstances in which and the conditions on which the authorities are empowered to resort to any such measures (see Halford, cited above, § 49 and Malone, cited above, § 67).

The Court is not convinced by the Government's submission that the College was authorised under its statutory powers to do ‘anything necessary or expedient’ for the purposes of providing higher and further education, and finds the argument unpersuasive. Moreover, the Government do not seek to argue that any provisions existed at the relevant time, either in general domestic law or in the governing instruments of the College, regulating the circumstances in which employers could monitor the use of telephone, e-mail and the internet by employees. Furthermore, it is clear that the Telecommunications (Lawful Business Practice) Regulations 2000 (adopted under the Regulation of Investigatory Powers Act 2000) which make such provision were not in force at the relevant time.

Accordingly, as there was no domestic law regulating monitoring at the relevant time, the interference in this case was not ‘in accordance with the law’ as required by Article 8 § 2 of the Convention. The Court would not exclude that the monitoring of an employee's use of a telephone, e-mail or internet at the place of work may be considered ‘necessary in a democratic society’ in certain situations in pursuit of a legitimate aim. However, having regard to its above conclusion, it is not necessary to pronounce on that matter in the instant case.

There has therefore been a violation of Article 8 in this regard.