Monitoring the use of email and Internet access v. the right to privacy: what can the employer do?

The European Court of Human Rights has handed down a judgement on 5 September 2017. A good opportunity for us to briefly refresh the principles applicable in Belgium if the use by the employee of email and internet access that is made available to him by the employer is monitored.

Judgement ruled by the European Court of Human Rights

The European Court of Human Rights has ruled in the judgement of 5 September 2017 that emails of employees in the workplace are covered by the notions of 'privacy' and 'correspondence' within the meaning of article 8 of the European Convention on Human Rights and fundamental freedoms.

In the case that was brought before the Court, the employer had dismissed an employee after having monitored his emails and having found that he had used his Internet access for private purposes. Private use was prohibited by the internal rules of which the employee had been informed.

For the Court, the right of the employee to respect for his privacy and correspondence however was not adequately protected and this, because the national (Romanian) courts amongst other things:

• did not check whether he previously had been informed by his employer of the possibility that his communications would be monitored;
• did not take into account the nature or scope of the monitoring of these communications, nor with the possibility that the employer has permanent access to his messages;
• has not given any reasons justifying the introduction of the monitoring;
• failed to establish whether the employer could have appealed to less intrusive measures with regard to the privacy and correspondence.

What is the situation in Belgium?

A lot of employers offer their employees an email address and/or Internet access, not only for communication purposes within the company/with third parties, but also to increase the productivity and quality of work.

Conditions for the use

If these tools in principle are intended for professional purposes only, the employer generally tolerates that these are also used for private purposes (e.g. obligation to use the Internet access for private purposes only during the breaks).

Mind that if there is no legal/regulatory provision in this respect, the employer will have to see to it that the principles and rules for the use of email and internet are laid down in a written document (preferably in the employment regulations).

Terms and conditions for the monitoring

If the employer wants to monitor the private use of email and Internet access, he must comply with the collective bargaining agreement (CBA) No. 81 of 26 April 2002 on the protection of employees’ privacy for the purposes of the control of electronic on-line communication data.

The principle of finality

The employer can globally monitor the employee’s use of email and internet access for private purposes, when pursuing one or several of the following aims:

• the prevention of illicit or defamatory facts, facts contrary to good morals or that are likely to harm the dignity of others (e.g. computer hacking);
• the protection of the economic, commercial and financial interests of the company which are confidential as well as the prevention of practices conflicting with these interests (e.g. the disclosure of files);
• the security and/or the technical proper functioning of the company's computer systems (the related cost control included) as well as the physical protection of the company’s equipment;
• the honest observance of the principles and user regulations of the on-line technologies established within the company.

The principle of proportionality

In the context of this monitoring, only the electronic on-line communication data of a private nature can be gathered that are adequate, relevant and non-excessive in relation to the pursued purpose. This must be global data (e.g. number of emails sent from one workstation).

The principle of transparency

The employer who wants to monitor the electronic on-line communication data must previously inform their employees and their representatives of this (preferably via the employment regulations).

The individualisation of the collected data

When the employer detects an irregularity during the monitoring, under certain condition he may proceed to the individualisation of the gathered data in order to identify the author of the irregularity.

Mind that it is forbidden to read the content of the electronic communication data, except when all parties involved have (particularly) agreed to this.

In practice

In our opinion, the judgement of the European Court of Human Rights is in line with several decisions that have been taken by the Belgian labour courts.

Although subject to the sovereign powers of appreciation of the labour courts, improper use by the employee of email/Internet access that is made available to him may give rise to his dismissal in the following cases:

• if there are rules in the company with regard to the use of email/Internet access for private purposes;
• if the employee has been informed hereof previously (to the monitoring);
• and if the failure to comply with these rules was determined during the monitoring and after an individualisation of data in accordance with the legal provisions of collective bargaining agreement No 81.

Sources: collective bargaining agreement No 81 of 26 April 2002 for the protection of the privacy of employees with regard to the monitoring of the electronic on-line communication data (Royal Decree 12 June 2002 - Belgian Official Gazette of 29 June 2002), http://www.cnt-nar.be; decision of 5 September 2017 of the European Court of Human Rights, Bărbulescu v. Romania, Application No. 61496/08, http://www.echr.coe.int.