Key facts of the case:
- The applicant was born in 1979 and lives in Bucharest.
- From 1 August 2004 to 6 August 2007 he was employed in the Bucharest office of S., a Romanian private company (“the employer”), as a sales engineer. At his employer’s request, for the purpose of responding to customers’ enquiries, he created an instant messaging account using Yahoo Messenger, an online chat service offering real-time text transmission over the internet. He already had another personal Yahoo Messenger account.
- The employer’s internal regulations prohibited the use of company resources by employees in the following terms:
“Any disturbance of order and discipline on company premises shall be strictly forbidden, in particular:
– ... personal use of computers, photocopiers, telephones or telex or fax machines.”
- The regulations did not contain any reference to the possibility for the employer to monitor employees’ communications.
- It appears from documents submitted by the Government that the applicant had been informed of the employer’s internal regulations and had signed a copy of them on 20 December 2006 after acquainting himself with their contents.
- On 3 July 2007 the Bucharest office received and circulated among all its employees an information notice that had been drawn up and sent by the Cluj head office on 26 June 2007. The employer asked employees to acquaint themselves with the notice and to sign a copy of it. The relevant parts of the notice read as follows:
“1. ... Time spent in the company must be quality time for everyone! Come to work to deal with company and professional matters, and not your own personal problems! Don’t spend your time using the internet, the phone or the fax machine for matters unconnected to work or your duties. This is what [elementary education], common sense and the law dictate! The employer has a duty to supervise and monitor employees’ work and to take punitive measures against anyone at fault!
Your misconduct will be carefully monitored and punished!
2. Because of repeated [disciplinary] offences vis-à-vis her superior, [as well as] her private use of the internet, the telephone and the photocopier, her negligence and her failure to perform her duties, Ms B.A. was dismissed on disciplinary grounds! Take a lesson from her bad example! Don’t make the same mistakes!
3. Have a careful read of the collective labour agreement, the company’s internal regulations, your job description and the employment contract you have signed! These are the basis of our collaboration! Between employer and employee! ...”
- It also appears from the documents submitted by the Government, including the employer’s attendance register, that the applicant acquainted himself with the notice and signed it between 3 and 13 July 2007.
- In addition, it transpires that from 5 to 13 July 2007 the employer recorded the applicant’s Yahoo Messenger communications in real time.
- On 13 July 2007 at 4.30 p.m. the applicant was summoned by his employer to give an explanation. In the relevant notice he was informed that his Yahoo Messenger communications had been monitored and that there was evidence that he had used the internet for personal purposes, in breach of the internal regulations. Charts were attached indicating that his internet activity was greater than that of his colleagues. At that stage, he was not informed whether the monitoring of his communications had also concerned their content. The notice was worded as follows:
“Please explain why you are using company resources (internet connection, Messenger) for personal purposes during working hours, as shown by the attached charts.”
- On the same day, the applicant informed the employer in writing that he had used Yahoo Messenger for work-related purposes only.
- At 5.20 p.m. the employer again summoned him to give an explanation in a notice worded as follows:
“Please explain why the entire correspondence you exchanged between 5 to 12 July 2007 using the S. Bucharest [internet] site ID had a private purpose, as shown by the attached forty-five pages.”
- The forty-five pages mentioned in the notice consisted of a transcript of the messages which the applicant had exchanged with his brother and his fiancée during the period when he had been monitored; the messages related to personal matters and some were of an intimate nature. The transcript also included five messages that the applicant had exchanged with his fiancée using his personal Yahoo Messenger account; these messages did not contain any intimate information.
- Also on 13 July, the applicant informed the employer in writing that in his view it had committed a criminal offence, namely breaching the secrecy of correspondence.
- On 1 August 2007 the employer terminated the applicant’s contract of employment.
- The applicant challenged his dismissal in an application to the Bucharest County Court (“the County Court”). He asked the court, firstly, to set aside the dismissal; secondly, to order his employer to pay him the amounts he was owed in respect of wages and any other entitlements and to reinstate him in his post; and thirdly, to order the employer to pay him 100,000 Romanian lei (approximately 30,000 euros) in damages for the harm resulting from the manner of his dismissal, and to reimburse his costs and expenses.
- As to the merits, relying on Copland v. the United Kingdom (no. 62617/00, §§ 43-44, ECHR 2007‑I), he argued that an employee’s telephone and email communications from the workplace were covered by the notions of “private life” and “correspondence” and were therefore protected by Article 8 of the Convention. He also submitted that the decision to dismiss him was unlawful and that by monitoring his communications and accessing their contents his employer had infringed criminal law.
- With regard specifically to the harm he claimed to have suffered, the applicant noted the manner of his dismissal and alleged that he had been subjected to harassment by his employer through the monitoring of his communications and the disclosure of their contents “to colleagues who were involved in one way or another in the dismissal procedure”.
- The applicant submitted evidence including a full copy of the transcript of his Yahoo Messenger communications and a copy of the information notice (see paragraph 15 above).
- In a judgment of 7 December 2007 the County Court rejected the applicant’s application and confirmed that his dismissal had been lawful. The relevant parts of the judgment read as follows:
“The procedure for conducting a disciplinary investigation is expressly regulated by the provisions of Article 267 of the Labour Code.
In the instant case it has been shown, through the written documents included in the file, that the employer conducted the disciplinary investigation in respect of the applicant by twice summoning him in writing to explain himself [and] specifying the subject, date, time and place of the interview, and that the applicant had the opportunity to submit arguments in his defence regarding his alleged acts, as is clear from the two explanatory notices included in the file (see copies on sheets 89 and 91).
The court takes the view that the monitoring of the internet conversations in which the employee took part using the Yahoo Messenger software on the company’s computer during working hours – regardless of whether or not the employer’s actions were illegal in terms of criminal law – cannot undermine the validity of the disciplinary proceedings in the instant case.
The fact that the provisions containing the requirement to interview the suspect (învinuitul) in a case of alleged misconduct and to examine the arguments submitted in that person’s defence prior to the decision on a sanction are couched in imperative terms highlights the legislature’s intention to make respect for the rights of the defence a prerequisite for the validity of the decision on the sanction.
In the present case, since the employee maintained during the disciplinary investigation that he had not used Yahoo Messenger for personal purposes but in order to advise customers on the products being sold by his employer, the court takes the view that an inspection of the content of the [applicant’s] conversations was the only way in which the employer could ascertain the validity of his arguments.
The employer’s right to monitor (monitoriza) employees in the workplace, [particularly] as regards their use of company computers, forms part of the broader right, governed by the provisions of Article 40 (d) of the Labour Code, to supervise how employees perform their professional tasks.
Given that it has been shown that the employees’ attention had been drawn to the fact that, shortly before the applicant’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes, and that the employees had been warned that their activities were being monitored (see notice no. 2316 of 3 July 2007, which the applicant had signed [after] acquainting himself with it – see copy on sheet 64), the employer cannot be accused of showing a lack of transparency and of failing to give its employees a clear warning that it was monitoring their computer use.
Internet access in the workplace is above all a tool made available to employees by the employer for professional use, and the employer indisputably has the power, by virtue of its right to supervise its employees’ activities, to monitor personal internet use.
Such checks by the employer are made necessary by, for example, the risk that through their internet use, employees might damage the company’s IT systems, carry out illegal activities in cyberspace for which the company could incur liability, or disclose the company’s trade secrets.
The court considers that the acts committed by the applicant constitute a disciplinary offence within the meaning of Article 263 § 2 of the Labour Code since they amount to a culpable breach of the provisions of Article 50 of S.’s internal regulations ..., which prohibit the use of computers for personal purposes.
The aforementioned acts are deemed by the internal regulations to constitute serious misconduct, the penalty for which, in accordance with Article 73 of the same internal regulations, [is] termination of the contract of employment on disciplinary grounds.
Having regard to the factual and legal arguments set out above, the court considers that the decision complained of is well-founded and lawful, and dismisses the application as unfounded.”
- The applicant appealed to the Bucharest Court of Appeal (“the Court of Appeal”). He repeated the arguments he had submitted before the first-instance court and contended in addition that that court had not struck a fair balance between the interests at stake, unjustly prioritising the employer’s interest in enjoying discretion to control its employees’ time and resources. He further argued that neither the internal regulations nor the information notice had contained any indication that the employer could monitor employees’ communications.
- The Court of Appeal dismissed the applicant’s appeal in a judgment of 17 June 2008, the relevant parts of which read:
“The first-instance court has rightly concluded that the internet is a tool made available to employees by the employer for professional use, and that the employer is entitled to set rules for the use of this tool, by laying down prohibitions and provisions which employees must observe when using the internet in the workplace; it is clear that personal use may be refused, and the employees in the present case were duly informed of this in a notice issued on 26 June 2007 in accordance with the provisions of the internal regulations, in which they were instructed to observe working hours, to be present at the workplace [during those hours and] to make effective use of working time.
In conclusion, an employer who has made an investment is entitled, in exercising the rights enshrined in Article 40 § 1 of the Labour Code, to monitor internet use in the workplace, and an employee who breaches the employer’s rules on personal internet use is committing a disciplinary offence that may give rise to a sanction, including the most serious one.
There is undoubtedly a conflict between the employer’s right to engage in monitoring and the employees’ right to protection of their privacy. This conflict has been settled at European Union level through the adoption of Directive no. 95/46/EC, which has laid down a number of principles governing the monitoring of internet and email use in the workplace, including the following in particular.
- Principle of necessity: monitoring must be necessary to achieve a certain aim.
- Principle of purpose specification: data must be collected for specified, explicit and legitimate purposes.
- Principle of transparency: the employer must provide employees with full information about monitoring operations.
- Principle of legitimacy: data-processing operations may only take place for a legitimate purpose.
- Principle of proportionality: personal data being monitored must be relevant and adequate in relation to the specified purpose.
- Principle of security: the employer is required to take all possible security measures to ensure that the data collected are not accessible to third parties.
In view of the fact that the employer has the right and the duty to ensure the smooth running of the company and, to that end, [is entitled] to supervise how its employees perform their professional tasks, and the fact [that it] enjoys disciplinary powers which it may legitimately use and which [authorised it in the present case] to monitor and transcribe the communications on Yahoo Messenger which the employee denied having exchanged for personal purposes, after he and his colleagues had been warned that company resources should not be used for such purposes, it cannot be maintained that this legitimate aim could have been achieved by any other means than by breaching the secrecy of his correspondence, or that a fair balance was not struck between the need to protect [the employee’s] privacy and the employer’s right to supervise the operation of its business.
Accordingly, having regard to the considerations set out above, the court finds that the decision of the first-instance court is lawful and well-founded and that the appeal is unfounded; it must therefore be dismissed, in accordance with the provisions of Article 312 § 1 of the C[ode of] Civ[il] Pr[ocedure].”
- In the meantime, on 18 September 2007 the applicant had lodged a criminal complaint against the statutory representatives of S., alleging a breach of the secrecy of correspondence. On 9 May 2012 the Directorate for Investigating Organised Crime and Terrorism (DIICOT) of the prosecutor’s office attached to the Supreme Court of Cassation and Justice ruled that there was no case to answer, on the grounds that the company was the owner of the computer system and the internet connection and could therefore monitor its employees’ internet activity and use the information stored on the server, and in view of the prohibition on personal use of the IT systems, as a result of which the monitoring had been foreseeable. The applicant did not avail himself of the opportunity provided for by the applicable procedural rules to challenge the prosecuting authorities’ decision in the domestic courts.
Results (sanctions) and key consequences of the case:
FOR THESE REASONS, THE COURT
- Holds, by eleven votes to six, that there has been a violation of Article 8 of the Convention;
- Holds, by sixteen votes to one, that the finding of a violation constitutes in itself sufficient just satisfaction for the non-pecuniary damage sustained by the applicant;
- Holds, by fourteen votes to three,
(a) that the respondent State is to pay the applicant, within three months, EUR 1,365 (one thousand three hundred and sixty-five euros) in respect of costs and expenses, to be converted into the currency of the respondent State at the rate applicable at the date of settlement, plus any tax that may be chargeable to the applicant;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points;
- Dismisses, unanimously, the remainder of the applicant’s claim for just satisfaction.
44. The relevant provisions of the Charter of Fundamental Rights of the European Union (2007/C 303/01) are worded as follows:
Article 7 – Respect for private and family life
“Everyone has the right to respect for his or her private and family life, home and communications.”
Article 8 – Protection of personal data
“1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.”