Balancing Employee Monitoring and the Legitimate Use of Personal Data
Effective protection of personal data throughout the Union requires the strengthening and setting out in detail, the rights of data subjects and the obligations of those who process and determine the processing of personal data. In this regard, employers are tasked with ensuring compliance with EU and local legislation when employee monitoring measures, such as CCTV surveillance, GPS tracking and keystroke logging, are set up at the workplace.
There is considerable discussion concerning the monitoring of employees during working hours. Employee monitoring, which essentially refers to the tracking and surveillance of employee activity data, is carried out with a reasonable and legitimate scope, including to monitor work productivity, safeguard company interests and prevent any confidential data breaches, maintain discipline at the workplace, detect any actions of a criminal nature, for the purpose of an investigation and optimise inefficient workflows.
The right to privacy and data protection have their legal basis in the EU Charter of Fundamental Rights, specifically article 7 which establishes the right to respect private and family life and “communications”, and article 8 which delineates the right to the protection of personal data which concerns that individual. It states that “such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.” To this end, and in the context of employee monitoring, the right to privacy is also enshrined in article 8 of the European Convention on Human Rights, in that all individuals have the right to the respect of their private life, and “correspondence”.
The GDPR and Employee Monitoring
Although it is often argued that an employer may prove to have a legitimate interest to monitor an employee’s data, through emails, telephone calls or use of an employer’s computer system among others, the employer’s interest to do so should always counterbalance the data privacy rights of an employee.
Due to the fact that there is no law specifically regulating employee monitoring locally, the monitoring of employees must have, at its basis, the aim of collecting employee data which corresponds with the principles established by article 5 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the GDPR Regulation). The latter sets out 6 main principles relating to processing of personal data, where although it does not prohibit monitoring at the workplace, the employer must comply with the provisions of the Regulation.
Namely, once any personal data is collected through any form of employee monitoring, such data must satisfy the following principles:
(a) Principle of necessity and transparency –meaning processed lawfully, fairly and in a transparent manner in relation to the employee (being the data subject);
(b) Principle of legitimacy – in that the data should be collected for a specified, explicit and legitimate purpose;
(c) Principle of purpose specification – therefore being data which is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
(d) Principle of accuracy – where necessary, kept up to date, and that every reasonable step must be taken to ensure that personal data which is inaccurate, is erased or rectified without delay;
(e) Principle of security – kept and stored in a form which permits identification of data subjects for no longer than what is necessary for the purposes for which the personal data is being processed;
(f) Principle of confidentiality – where data is processed in a confidential manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
These 6 core principles must remain the guiding framework for all employers who process any personal data of their employees in the context of employee monitoring. The International Labour Office (ILO) in this regard has also issued a Code of Practice on the Protection of Workers’ Personal Data laying down principles of the same nature.
Furthermore, article 5 of the Convention for the protection of individuals with regard to the processing of personal data follows suit. It guarantees that data processing is carried out in a proportionate manner in relation to the legitimate purpose pursued and reflects at all stages of the processing, a fair balance between all public and private interests concerned, and the rights and freedoms at stake, that is, among both the employers and employees. 
Bărbulescu v. Romania – A Case Study
The landmark judgement of Bărbulescu v. Romania (application no. 61496/08), decided by the European Court of Human Rights on the 5th of September, 2017 underscores the necessity for all employers to protect the right to an employee’s privacy and maintaining a balance between the employer’s interest in monitoring communications and such right to personal correspondence or communication privacy. In this case, the applicant, a sales engineer employed in the Bucharest office of S., a Romanian private company (“the employer”), had created an instant messaging account using Yahoo messenger at this employer’s request, for the purpose of responding to customer’s enquiries. Although the employer’s internal regulations prohibited the use of company resources by employees, the regulations poorly lacked any reference to the possibility for the employer to monitor employees’ communications.
On one occasion, the applicant was informed by his employer that his Yahoo Messenger communications had been monitored and that there was evidence that he had used the internet for personal purposes, in breach of the company’s internal regulations. Charts were attached indicating that his internet activity was greater than that of his colleagues, that certain messages related to personal matters, and some were of an intimate nature.
Following this incident, the employment of the applicant was terminated. The employee challenged his dismissal in an application to the Bucharest County Court (“the County Court”), requesting firstly, to set aside the dismissal; secondly, to order his employer to pay him the amounts he was owed in respect of wages and to reinstate him in his post; and thirdly, to order the employer to compensate him for damages suffered from his dismissal. 
In the judgment delivered on the 7th of December 2007, however, the County Court rejected the applicant’s application and confirmed that his dismissal had been lawful, to which end the applicant appealed to the Bucharest Court of Appeal (“the Court of Appeal”). He contended mainly that the County Court had not struck a fair balance between the interests at stake, unjustly prioritising the employer’s interest in enjoying discretion to control its employees’ time and resources, and argued that the internal regulations had not contained any indication that the employer could monitor employees’ communications. Once again, the Court of Appeal dismissed the applicant’s appeal in a judgment on the 17th of June 2008 claiming that his dismissal was founded on good reason.
By virtue of his claim submitted to the European Court of Human Rights (“ECHR”), the applicant submitted that his dismissal from employment had been based on a breach of his right to respect for his private life and correspondence a basi article 8 of the Convention and that the domestic courts had failed to comply with their obligation to protect the right in question.
The ECHR concluded that the national courts indeed failed to consider whether the applicant had been adequately notified about the possibility of his communications being monitored, or informed about the extent and nature of the monitoring measures. There was no exploration as to whether less intrusive means could have achieved the same objectives without infringing the applicant’s personal privacy. Additionally, the domestic courts did not assess the necessity or legitimacy of the employer’s monitoring, particularly as there was no clear justification for the strict surveillance beyond vague concerns about potential risks to the company.
The Court overall found that the domestic courts did not adequately balance the applicant’s right to privacy with his employer’s interest in monitoring communications. Since there was a violation of the applicant’s right to privacy under article 8 of the Convention, where the monitoring of the employee’s work led to his dismissal, the applicant was entitled to one thousand three hundred and sixty five Euro (€1365) in compensation.
Key Take-homes
Employers should always aim to ascertain that the right to private and family life is not breached by monitoring systems which it may deem legitimate to protect the company’s interests and reasonable to pursue a particular aim. In such a situation, it is advisable that any monitoring which may be adopted at the workplace is adequate, restricted to what is strictly needed, and not too intrusive on the employee in his day-to-day tasks. Moreover, the extent of such monitoring and the way it is implemented by the employer must be explicitly conveyed to the employee in an open and timely manner. To achieve this, the employer should establish clear guidelines through the use of adequate company policies, specifying the legal reasons for conducting the monitoring, the situations in which it may take place, and their expectations regarding proper use thereof.
In this respect, employees are entitled to receive copies of the information which outlines how the monitoring will occur, and copies of the information obtained from the monitoring exercise. In the same way, the collected data may be limited, deleted or else corrected in its usage on request by the employee.
Establishing the fine line between the need for employee surveillance and an employer instilling trust in its employees is crucial. While employers have a right to monitor their employees and use various technologies to ensure productivity and business compliance, transparency shown by employers on such right to monitor their employees helps manage expectations and alleviates concerns regarding privacy infringement. By adopting a balanced approach that considers both an employee’s privacy and the company’s needs, employers can create an environment built on mutual trust and productivity. This ensures that monitoring practices from one end optimise company operational efficiency but simultaneously uphold the rights of employee data protection and privacy.
How AE Legal Can Help
Navigating legislative changes in employment law can be challenging. At AE Legal, we provide expert guidance to both employers and employees, offering tailored advice to ensure compliance and promote a safe, fair workplace. Contact us today for a free consultation.
