New privacy restrictions for monitoring employee communications
If you have operations in Europe, a recent court ruling could affect your access to their electronic communications — even if they are on the company dime.
In September, the Grand Chamber of the European Court of Human Rights scaled back a 2016 ruling in a case where a Romanian man was fired for using a work-created Yahoo Messenger account to chat with family and his fiancée. The employee filed suit in Romanian courts, which ruled against him.
He then took his case to the European Court of Human Rights, which also sided in favor of his employer. “It is not unreasonable,” the court wrote, “for an employer to want to verify that the employees are completing their professional tasks during working hours.”
Undaunted, the employee appealed to the Grand Chamber, which ruled 11-6 that the employee’s right to privacy had been violated. The court found the employee had not been informed in advance of the extent and nature of his employer’s monitoring, or the possibility that the employer might have access to the actual contents of the messages. This ruling is final, as there is no ability to appeal a Grand Chamber decision.
While several European countries have addressed the issue of workplace privacy through legislation, most require employers to let employees know if and when they are monitoring email. The Grand Chamber’s ruling ups that by requiring such notices be “accompanied by adequate and sufficient safeguards against abuse” in 47 European countries.
Legally, Europe offers stronger protection for individual privacy than we do in the United States. In America, privacy rights are balanced against the First Amendment right of free speech, which generally results in information being more widely available.
Also, the federal Electronic Communications Privacy Act permits employers to intercept their employees’ electronic communications if the employer has a legitimate business purpose for doing so. This permission may not extend to employees’ personal communications, though, and some states provide greater safeguards for employee privacy. Some form of employee consent may be necessary to allow employers to engage lawfully in the full scope of electronic monitoring that they wish to conduct, even here in the United States.
In light of the September Grand Chamber ruling, even policies developed consistent with U.S. law may not go far enough to protect employee privacy. Employers with operations in Europe should review and update their policies regarding electronic monitoring and privacy to reflect the expanse of both their operations and the surveillance they intend to conduct. For example, will you need to have policies specific to each geographic region or will one global policy suffice?
When updating policies, employers should incorporate the following elements:
Notice: You must first give employees notice that you are monitoring their electronic communications. Written notice in an employee handbook should suffice as long as the employee receives or otherwise has knowledge of and access to the handbook.
Scope: You must then describe the scope of what you are monitoring and what you are not monitoring, and provide justification for doing so. Recognize the wholesale monitoring of all electronic communications might go too far, especially given the Grand Chamber’s apparent acknowledgment that some incidental use of company computer systems for personal use is reasonable. You must specify some boundaries and controls to ensure that your monitoring is really business-related.
Authorization: A signed authorization form acknowledging the employee’s understanding of your electronic monitoring policy and explicitly granting consent to such monitoring provides you with an added layer of protection.
Norbert F. Kugele is a partner at Warner Norcross & Judd LLP who works extensively with privacy and information security law and can be reached at email@example.com. Allyson R. Terpsma is an associate who focuses her practice on labor and employment law and can be reached at firstname.lastname@example.org.