The case of Barbulescu v. Romania Application no. 61496/08 [2016] ECHR 61 (12 January 2016) (available here ) clearly set out the limits in relation to monitoring employee communications. The case involved the dismissal of an employee as a result of his personal communications at work, which were monitored. The Grand Chamber of the European Court of Human Rights confirmed the conditional nature of the right to privacy (Article 8, ECHR) and held that, in order to fulfil their positive obligation to protect the right to privacy, Member States should ensure that employers take measures to ensure that appropriate safeguards are in place to guard against abuse of monitoring communications and other interference with privacy rights, rather than to outlaw this activity per se. Such measures include full and clear notification of the monitoring, in advance, limiting monitoring to what is strictly necessary to achieve the specific aim, using the least intrusive methods and providing further information to the employee if the content rather than the flow of communications is to be monitored. The ICO has produced ‘The Employment Practices Code’ that provides sound advice and guidance, though caution must be exercised due to the publication date. Additionally, Part 3 of ‘The Employment Practices Code: Supplementary Guidance’ addresses monitoring at work. Again, please exercise caution due to the publication date; the latest case law and the GDPR are not included, but the principles and advice remain sound. A Data Protection Impact Assessment that takes into account the principles provided in the judgment of the above case would demonstrate compliance and best practice.
