By Olumide Babalola
On Tuesday, 16th day of November 2021, I joined other panelists to speak on ‘monitoring staff working from home: privacy considerations’ at the PrivSec (New Normal) Conference held at the Riverbank Park Hotel, London, United Kingdom.
The allotted time was quite understandably short, hence we could not explore all the ramifications earlier planned and that informed my decision to put my thoughts out here.
While other panelists approached the topic from technical and organisations standpoint, I addressed it through some cases – being the only litigator on that side of the ballroom.
Do employees have reasonable expectation of privacy even at work?
The European courts have ruled in the decisions in Barbulescu v Romania, Copland v United Kingdom and Ribalda v Spain that the notion of privacy/private life extends to communications and interactions in the workplace (see pages 317, 344 and 326 of my Casebook on data protection).
Can employers legitimately monitor employees?
I am not aware of any decision that frontally forbids employers from legitimately monitoring employees. In Kopke v Germany, the European Court of Human Rights noted that a considerable intrusion into an employee’s private life by the employer is permissible. Just as I emphasised during the session, there is no ‘one size fits all’ in privacy cases and no two days are the same.
What is the position of the European courts on monitoring staff?
In Barbulescu’s case, an employee used his official yahoo messenger to send personal messages to his brother and fiancé in violation of his workplace IT Policy. When he denied using the yahoo messenger for personal communication at a disciplinary panel, the employer confronted him with 45 pages of his messages – part of which contained intimate interactions between the employee and his partner.
Consequent to his dismissal for flouting the company’s rules, the employee sued and the European court held among other things that the employer violated the employee’s privacy since the 45 pages which included sensitive intimate contents were not proportionate to the employer’s aim.
In Copland’s case where an employee official email and phone were monitored by the employer to assess whether the employee was using the facilities for personal matters. The court held that his communication on official platforms are contemplated within the notion of privacy and the employer’s monitoring of such emails and telephone calls without a legal basis violated employee’s privacy.
In Ribalda v Spain, the employer suspected foul play by his cashiers and he installed some CCTV cameras in the work place. Some were disclosed while others were hidden. When some staff were dismissed having been caught on camera, the sued the employer for unfair dismissal and the installation of hidden cameras violated the employees’ privacy and that the installation was not proportionate since it was not based on a confirmed suspicion.
How can an employer legitimately monitor staff?
In privacy and data protection cases, the courts have always advised on the necessity of balancing the competing interests: the employer wants to ensure the work is done and the employee wants to be sure no one is snooping. Employers are advised to ensure the following before engaging in staff monitoring activities:
a. Identify compelling and legitimate reasons for surveillance
b. Notify the employees of the measures
c. Ensure the measures are proportionate to the aim
d. Provide safeguards against abuse of such surveillance measures
e. Ascertain that there are no other alternatives to the aim of monitoring
f. Assessment of necessary level of intrusion (Data protection impact assessment) etc.
Conclusively, there is no gain saying COVID has changed the modus operandi of most businesses. Remote working has come to stay and this will continue to breed new species of privacy challenges, hence the need to continue to interrogate best ways to balance the master/servant interests along the lines of business considerations and employees’ dignity and trust which may be threatened by careless privacy-intruding labour measures.
