The ECHR is not working

Last week, the European Court of Human Rights (ECHR) handed down a ruling in an employment dispute. The case concerned Mr Barbulescu, formerly an engineer in charge of sales at a private company, and his country, Romania.

Barbulescu’s employer (who remains unnamed) had a very strict policy that banned the use of office facilities, including computers, for any private communications. It also required Barbulescu, as part of his work, to operate a Yahoo Messenger account to communicate with company clients.

But Barbulescu used this account to exchange some messages with his brother and fiancée. One of the addresses to which he directed messages was called ‘Andra loves you’. These communications involved personal matters, including the state of his health. His employer monitored his use of Messenger, and notified him that it was aware he was using it for personal matters. He initially denied this, but the employer produced a 45-page transcript, which debunked his claim. It then sacked him on 1 August 2007. So Barbulescu sued, alleging an invasion of privacy.

A reasonable expectation of privacy?

A factual issue in the court case was whether his employer had formally notified Barbulescu that it reserved the right to monitor his communications – ensuring compliance with its policy. The employer claimed that Barbulescu had signed a copy of its requirements, although no document bearing his signature was produced. The local courts dismissed Barbulescu’s claim.

Barbulescu then complained to the ECHR in December 2008 that his right to effective respect for private life under Article 8 of the European Convention on Human Rights had been violated. Remarkably (or not, if you know what a backlog of cases it has), the court did not notify the Romanian government until four years later, in 2012.

The main issue that the court had to decide, was whether Barbulescu had a reasonable expectation of privacy in relation to his use of the Yahoo account. It saw the fact that he was aware of the employer’s strict policy as relevant. The court contrasted this case with Halford v UK (1997), in which a senior police officer was given a phone to make personal calls, and complained successfully after her use of it was covertly monitored.

Another relevant case is Copland v UK (2007), which concerned a college employee whose employer suspected she was making excessive use of work facilities for private communications. It monitored her usage, such as the number of phone calls and emails she made, though it did not listen to them, or read their contents. The European Court of Human Rights decided that her privacy had been violated, because she was not warned about being monitored and the employer did not have a policy in place.

The court rejected Barbulescu’s complaint by a majority of six to one, noting that ‘it is not unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours’. It also commented that Barbulescu had not ‘convincingly explained why he had used the Yahoo messenger account for personal purposes’.

A ‘missed opportunity’

The dissenting judge, De Albuquerque, disagreed. He complained that this was a missed opportunity to develop case law, which he acknowledged was limited. He wanted the court to draw principles ‘for the creation, implementation and enforcement of an internet usage policy’ in employment relations. But this is not the function of the ECHR – an international tribunal tasked with the duty of deciding whether state signatories are in violation of their treaty obligations. It is not the ECHR’s job to draw up policies for workplaces across Europe.

De Albuquerque’s opinion is laden with lengthy footnotes, citing a proliferation of communiqués and pronouncements from various international bodies, ranging from the Committee of Ministers, the Council of Europe, the International Telecommunications Union and the United Nations Special Rapporteur on freedom of opinion and expression. He also claimed: ‘States have a positive obligation to promote and facilitate universal internet access, including the creation of the infrastructure necessary for internet connectivity’. This is not the case under the European Convention.

He went on to argue that employers couldn’t expect to have unfettered control over their employees’ expression on the internet. Citing the case of Copland v UK, he claimed that all use of email, telephone and computer facilities at work for private purposes was prima facie protected under Article 8. He criticised the formula used in this case (‘a reasonable expectation of privacy’) as being too vague and leaving too much open to the discretion of the employer.

He argued that employers could not impose a blanket ban on internet usage by employees. Instead, he called for:

‘A comprehensive internet-usage policy in the workplace [to] be put in place, including specific rules on the use of email, instant messaging, social networks, blogging and web surfing. Although policy may be tailor-made to the needs of each corporation as a whole… the rights and obligations of employees should be set out clearly, with transparent rules on how the internet may be used, how monitoring is conducted, how data is secured, used and destroyed, and who has access to it… Employees must be made aware of the existence of an internet usage policy in force in their workplace, as well as outside the workplace and during out-of-work hours, involving communication facilities owned by the employer, the employee or third parties. All employees should be notified personally of the said policy and consent to it explicitly.’

De Albuquerque also pointed out that Barbulescu’s employer did not have such an elaborate policy.

A striking feature of De Albuquerque’s judgement is the way in which he imports a raft of policy documents, working-party documents and opinions, as well as Council of Europe recommendations on surveillance of electronic communications, into a judicial discussion about the scope of Article 8 of the European Convention. His justification was that unless the court insisted on a very formal approach to internet and email use in the workplace, employers would abuse their position by acting ‘as a distrustful Big Brother’ and commodifying workers.

Policies on internet use, he concluded, are essential to force employers to act ‘in accordance with the principled international-law approach to internet freedom as a human right’. He goes on to speculate that the Romanian courts ‘willingly condoned the employer’s seizure upon internet abuse as an opportunistic justification for removal of an unwanted employee whom the company was unable to dismiss by lawful means’.

Do we really need more regulation?

The European Convention says nothing about internet freedom, as such. It refers to ‘freedom of expression’ in Article 10. This is very far removed from how individual employers decide what arrangements they wish to put in place for internet access, or use of electronic communications by staff. De Albuquerque’s judgement is a good illustration of quixotic judicial activism, which seeks to expand the remit of the convention in the name of freedom, while simultaneously demanding greater regulation of everyday life. But, in the real world, a proliferation of detailed policies simply gives employers more ways in which to keep tabs on their employees.

The case was decided without an oral hearing (ie, on the papers) by the Fourth Section of the ECHR consisting of seven judges: a Hungarian, a Maltese, a Slovenian, a Georgian, a Portuguese, a Lithuanian and a Romanian. It may not be a coincidence that five of out the six judges giving the majority ruling were from former Communist countries (De Albuquerque is Portugese). The sub-text would appear to be that they do not welcome this messianic, top-down approach to human rights, instead, opting for a more minimalist approach. Perhaps they are right. The last thing workers need are more diktats from the ECHR.

Barbara Hewson is a barrister. Her views here are personal.