Is Workplace Privacy Dead? Comments On The Barbulescu Judgment

Steve Peers

When tin an employer read an employee’s e-mails or texts, or rail her role of the Internet? It’s an of import inquiry for both employers in addition to employees. Influenza A virus subtype H5N1 judgment this calendar week inwards Google Spain); in addition to non-EU countries are judged past times the European Union on whether their constabulary is ‘adequate’ from the EU’s perspective, important it has to survive quite similar to European Union constabulary (Schrems).

Secondly, the physical care for in addition to remedies are different. European Union constabulary is commonly developed past times way of a national courtroom pausing its proceedings, scream for the CJEU to a greater extent than or less questions in addition to thence reopening the illustration at national score in addition to applying the answers it gets. It tin thence apply the remedies available inwards national law, which tin sometimes survive affected past times European Union constabulary likewise (see Vidal-Hall in addition to Benkharbouche). In this case, the Romanaian courts noted the European Union constabulary points, but decided against the applicants on the merits without scream for the CJEU questions. Arguably the concluding national courtroom should possess got sent questions to the CJEU, in addition to its failure to create thence is itself an ECHR breach (see Daniel Sarmiento’s intelligence here), but Mr. Barbulescu didn’t heighten that point. If he had won inwards the ECHR, the only remedies he could move would survive a declaration, costs in addition to damages.

European Union constabulary tin also survive applied against individual parties, champaign of report to the express powerfulness to apply it inwards the illustration of Directives. That limitation volition shortly disappear when the upcoming information protection Regulation comes into force. The ECHR cannot apply to individual parties every bit such, which is why this illustration had to survive brought against the Romanaian state, non Barbulescu’s employer, although the ECtHR swept aside that distinction past times referring to the doctrine of positive obligations (ie the State must ensure that human rights are protected inwards individual relationships).

The biggest effect is whether noun European Union constabulary would give greater protection. While the ECtHR noted that this illustration involved Mr. Barbulescu’s ‘personal data’ inside the important of European Union law, it did non examine the European Union legislation (the electrical flow information protection Directive) further. The dissenting approximate did so, taking into trouble concern human relationship also ‘soft law’ of the EU’s ‘Article 29 working party’. This trunk of national information protection supervisors oftentimes meets to adopt detailed policy statements taking a real assertive sentiment of how to translate European Union information protection law. Then they furnish home, in addition to neglect to enforce the policies they agreed to.

Under the European Union Directive, tin his employer justify collecting Barbulescu’s personal data? He did non consent to the collection of that data, thence the employer would either possess got to debate that it was ‘necessary for the functioning of a contract’, or for its ‘legitimate interests’. In the latter case, those interests could survive outweighed past times his rights. There’s no clear respond from this wording whether the CJEU would determine this illustration the same way, interpreting the Directive: it’s arguable (as the national courts held) that it was ‘necessary’ to monitor the employee’s communications inwards social club to enforce the dominion against individual role of communications, or that the factors referred to past times the ECtHR were plenty to give precedence to the employer’s interests over the worker’s rights. But the overall pro-privacy tone of recent CJEU rulings on information protection (Digital Rights, Google Spain, Rynes, Schrems) advise that the CJEU would survive to a greater extent than probable to dominion that to a greater extent than or less prior notification of surveillance was required.

Another effect is that to a greater extent than or less of the information concerned the employee’s wellness in addition to sexual practice life. European Union constabulary prohibits processing this, in addition to other ‘sensitive’ personal data. But this prohibition is a legal fiction, every bit inwards fact a number of grounds for processing sensitive information are permitted. In practice, it’s to a greater extent than accurate to say that it’s harder to justify processing such data. Applying that dominion to this case, the Directive states that such information tin survive processed if ‘necessary’ to behavior out the employer’s obligations in addition to rights ‘in the specific champaign of work law’, if that is ‘authorized past times national constabulary providing for adequate safeguards’. It’s difficult to know if these criteria were met inwards this case. (These rules volition non alter much nether the futurity Regulation. There volition survive a novel clause allowing Member U.S. of A. to possess got exceptional rules for work issues, but there’s no specific elevate of employer surveillance).

Given that Romania is saltation past times the European Union Directive, should the ECtHR possess got looked farther at the European Union constabulary issues? It’s an awkward point, since the ECtHR doesn’t possess got jurisdiction every bit such to dominion on European Union law. But interferences amongst the correct to privacy must survive ‘in accordance amongst the law’. So at that spot should at to the lowest degree possess got been a cursory attempt of whether the national law, in addition to the national court’s interpretation of it, appeared to survive consistent amongst the relevant European Union law. The ECtHR avoided doing this, because (very unusually for a privacy case) it ignored the ‘in accordance amongst the law’ attempt entirely.

Conclusion

Altogether, this judgment is non the ECtHR’s finest hour. But it may non survive the concluding intelligence on this of import effect either. It remains to survive seen whether the Grand Chamber mightiness review this case, or whether the CJEU or national courts, maybe excited past times the novel Regulation, mightiness insist that higher standards apply inwards national law. For the fourth dimension being, though, employers should survive aware that at that spot is however a fine trace betwixt acceptable in addition to unacceptable monitoring of their employees.

Barnard & Peers: chapter 9

Photo credit: tony_anscombe_work_privacy-618x336.jpg

Share this post