Key facts of the case:
“Any disturbance of order and discipline on company premises shall be strictly forbidden, in particular:
– ... personal use of computers, photocopiers, telephones or telex or fax machines.”
“1. ... Time spent in the company must be quality time for everyone! Come to work to deal with company and professional matters, and not your own personal problems! Don’t spend your time using the internet, the phone or the fax machine for matters unconnected to work or your duties. This is what [elementary education], common sense and the law dictate! The employer has a duty to supervise and monitor employees’ work and to take punitive measures against anyone at fault!
Your misconduct will be carefully monitored and punished!
2. Because of repeated [disciplinary] offences vis-à-vis her superior, [as well as] her private use of the internet, the telephone and the photocopier, her negligence and her failure to perform her duties, Ms B.A. was dismissed on disciplinary grounds! Take a lesson from her bad example! Don’t make the same mistakes!
3. Have a careful read of the collective labour agreement, the company’s internal regulations, your job description and the employment contract you have signed! These are the basis of our collaboration! Between employer and employee! ...”
“Please explain why you are using company resources (internet connection, Messenger) for personal purposes during working hours, as shown by the attached charts.”
“Please explain why the entire correspondence you exchanged between 5 to 12 July 2007 using the S. Bucharest [internet] site ID had a private purpose, as shown by the attached forty-five pages.”
“The procedure for conducting a disciplinary investigation is expressly regulated by the provisions of Article 267 of the Labour Code.
In the instant case it has been shown, through the written documents included in the file, that the employer conducted the disciplinary investigation in respect of the applicant by twice summoning him in writing to explain himself [and] specifying the subject, date, time and place of the interview, and that the applicant had the opportunity to submit arguments in his defence regarding his alleged acts, as is clear from the two explanatory notices included in the file (see copies on sheets 89 and 91).
The court takes the view that the monitoring of the internet conversations in which the employee took part using the Yahoo Messenger software on the company’s computer during working hours – regardless of whether or not the employer’s actions were illegal in terms of criminal law – cannot undermine the validity of the disciplinary proceedings in the instant case.
The fact that the provisions containing the requirement to interview the suspect (învinuitul) in a case of alleged misconduct and to examine the arguments submitted in that person’s defence prior to the decision on a sanction are couched in imperative terms highlights the legislature’s intention to make respect for the rights of the defence a prerequisite for the validity of the decision on the sanction.
In the present case, since the employee maintained during the disciplinary investigation that he had not used Yahoo Messenger for personal purposes but in order to advise customers on the products being sold by his employer, the court takes the view that an inspection of the content of the [applicant’s] conversations was the only way in which the employer could ascertain the validity of his arguments.
The employer’s right to monitor (monitoriza) employees in the workplace, [particularly] as regards their use of company computers, forms part of the broader right, governed by the provisions of Article 40 (d) of the Labour Code, to supervise how employees perform their professional tasks.
Given that it has been shown that the employees’ attention had been drawn to the fact that, shortly before the applicant’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes, and that the employees had been warned that their activities were being monitored (see notice no. 2316 of 3 July 2007, which the applicant had signed [after] acquainting himself with it – see copy on sheet 64), the employer cannot be accused of showing a lack of transparency and of failing to give its employees a clear warning that it was monitoring their computer use.
Internet access in the workplace is above all a tool made available to employees by the employer for professional use, and the employer indisputably has the power, by virtue of its right to supervise its employees’ activities, to monitor personal internet use.
Such checks by the employer are made necessary by, for example, the risk that through their internet use, employees might damage the company’s IT systems, carry out illegal activities in cyberspace for which the company could incur liability, or disclose the company’s trade secrets.
The court considers that the acts committed by the applicant constitute a disciplinary offence within the meaning of Article 263 § 2 of the Labour Code since they amount to a culpable breach of the provisions of Article 50 of S.’s internal regulations ..., which prohibit the use of computers for personal purposes.
The aforementioned acts are deemed by the internal regulations to constitute serious misconduct, the penalty for which, in accordance with Article 73 of the same internal regulations, [is] termination of the contract of employment on disciplinary grounds.
Having regard to the factual and legal arguments set out above, the court considers that the decision complained of is well-founded and lawful, and dismisses the application as unfounded.”
“The first-instance court has rightly concluded that the internet is a tool made available to employees by the employer for professional use, and that the employer is entitled to set rules for the use of this tool, by laying down prohibitions and provisions which employees must observe when using the internet in the workplace; it is clear that personal use may be refused, and the employees in the present case were duly informed of this in a notice issued on 26 June 2007 in accordance with the provisions of the internal regulations, in which they were instructed to observe working hours, to be present at the workplace [during those hours and] to make effective use of working time.
In conclusion, an employer who has made an investment is entitled, in exercising the rights enshrined in Article 40 § 1 of the Labour Code, to monitor internet use in the workplace, and an employee who breaches the employer’s rules on personal internet use is committing a disciplinary offence that may give rise to a sanction, including the most serious one.
There is undoubtedly a conflict between the employer’s right to engage in monitoring and the employees’ right to protection of their privacy. This conflict has been settled at European Union level through the adoption of Directive no. 95/46/EC, which has laid down a number of principles governing the monitoring of internet and email use in the workplace, including the following in particular.
- Principle of necessity: monitoring must be necessary to achieve a certain aim.
- Principle of purpose specification: data must be collected for specified, explicit and legitimate purposes.
- Principle of transparency: the employer must provide employees with full information about monitoring operations.
- Principle of legitimacy: data-processing operations may only take place for a legitimate purpose.
- Principle of proportionality: personal data being monitored must be relevant and adequate in relation to the specified purpose.
- Principle of security: the employer is required to take all possible security measures to ensure that the data collected are not accessible to third parties.
In view of the fact that the employer has the right and the duty to ensure the smooth running of the company and, to that end, [is entitled] to supervise how its employees perform their professional tasks, and the fact [that it] enjoys disciplinary powers which it may legitimately use and which [authorised it in the present case] to monitor and transcribe the communications on Yahoo Messenger which the employee denied having exchanged for personal purposes, after he and his colleagues had been warned that company resources should not be used for such purposes, it cannot be maintained that this legitimate aim could have been achieved by any other means than by breaching the secrecy of his correspondence, or that a fair balance was not struck between the need to protect [the employee’s] privacy and the employer’s right to supervise the operation of its business.
Accordingly, having regard to the considerations set out above, the court finds that the decision of the first-instance court is lawful and well-founded and that the appeal is unfounded; it must therefore be dismissed, in accordance with the provisions of Article 312 § 1 of the C[ode of] Civ[il] Pr[ocedure].”
Results (sanctions) and key consequences of the case:
FOR THESE REASONS, THE COURT
(a) that the respondent State is to pay the applicant, within three months, EUR 1,365 (one thousand three hundred and sixty-five euros) in respect of costs and expenses, to be converted into the currency of the respondent State at the rate applicable at the date of settlement, plus any tax that may be chargeable to the applicant;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points;
44. The relevant provisions of the Charter of Fundamental Rights of the European Union (2007/C 303/01) are worded as follows:
Article 7 – Respect for private and family life
“Everyone has the right to respect for his or her private and family life, home and communications.”
Article 8 – Protection of personal data
“1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.”