Snooping in the mail

These days you can't escape it. In almost every work situation, employees have access to the Internet. Either through employer-owned devices or their own. The employer may ensure that employees perform their duties properly. But does this mean he may also monitor Internet use? What about employee privacy?

As a health and safety professional, you are concerned with the well-being of your employees. Privacy is very important in this context. The right to privacy is protected by the European Convention on Human Rights (ECHR). According to the ECHR, the government must ensure that human rights are adequately protected by, among other things, incorporating European legislation into national law. In doing so, the employee must first invoke this protection before the national court (part of the government). Only if the national judge rules against the employee can the employee go to the European Court of Human Rights (ECHR). Before the ECHR, he must then sue not the employer, but the government, claiming that it provides legislation and rules that violate human rights.

Black

However, ERVM protections are not black and white. For example, the law infringes on the right to privacy in many cases, such as police investigative powers. Even without a clear legal basis, an invasion of privacy may be justified. In the workplace, an employee must behave as a "good employee" and the employer as a "good employer. These are general and rather vague standards that can be interpreted differently from case to case. For example, a good employee may be expected to engage in the performance of his duties during working hours. The employer may monitor this, but must, as a good employer, respect his employees' privacy to some extent. How the employer may monitor (for example) the Internet use of his employees is further defined by case law. The ECtHR has commented on this in a recent judgment (ECHR 12 January 2016, 61496/08, Barbulescu vs. Romania). This case concerned a Romanian employee who was fired after his employer spent two weeks monitoring his Internet usage through the messaging service Yahoo Messenger. The employee challenged his dismissal because he believed that his right to privacy protection had been violated. The Romanian employee was employed as a technician, responsible for the Sales department. At the employer's request, he had created a Yahoo Messenger account to answer customer questions. The employer had company regulations that clearly stated that employees were not allowed to use the Internet and other resources provided by the employer for personal purposes. The Yahoo Messenger account was also intended for business messages only.

Monitors

However, the employer suspected that the employee was also using the account privately. When the employer asked about this, the employee indicated that this was not the case. The employer then decided to monitor his activities through the Yahoo Messenger account from July 5, 2007 through July 13, 2007. This investigation revealed that the employee had sent numerous messages containing sensitive personal information to his brother and his fiancée. Since the employee had frequently used the Yahoo Messenger account for personal purposes in violation of company regulations, dismissal followed on August 1, 2007. The employee did not leave it at that and went to court. The national courts of Romania ruled against the employee. Under Romanian labor law, the employer had the authority to monitor compliance. Here, privacy had to give way in some cases. In this case, the employee knew that the employer could have monitored Internet behavior, as the employer had warned about this in advance.

Necessary

According to the judge, the employer did not have to expect to encounter privacy-sensitive correspondence precisely because the employee indicated that he only used the Yahoo Messenger account for business purposes. The judges further emphasized that some control is necessary to protect business interests. Before the ECtHR, the employee sued Romania for a violation of his right to privacy. He accused the government of maintaining legislation that does not adequately protect workers' privacy. After all, the state has an obligation to act when situations arise that violate human rights. The state argued that the monitoring of Internet use covered a limited period of time. Furthermore, the employee had been warned in advance and had a fair chance to challenge his dismissal before the Romanian courts. The ECtHR ultimately vindicated the state. The Court pointed out that the employee had violated company regulations known to him. According to the ECtHR, the employer had a reasonable interest in supervising the employees' work. It added that this monitoring was time-limited and only concerned Internet use through the Yahoo Messenger account.

Proportional

This ruling is in line with previous case law of the Dutch courts on this subject. This shows that checks on Internet use must serve a legitimate purpose as well as be proportionate. For example, the employee must be aware in advance of the possibility that internet use will be monitored, for example through staff regulations or under the employment contract. According to Dutch case law, monitoring is possible even if the employee is not aware of this possibility. However, stricter requirements apply. For example, there must be concrete facts and circumstances on the basis of which the employer considers monitoring necessary. In that case, he must be able to prove that there is reason to assume that something is wrong. You can see that even if the employee did not have to expect an inspection, sometimes the right to privacy must still give way. In addition, a personnel regulation is important with clear rules about the use of the Internet for private purposes. As a health and safety professional, you would do well to explicitly point this out to employees as well. In addition, you can block certain websites. This way, employees will not be tempted to use the Internet in the wrong way.