Bridge HR articles

What is Article 8 and how does it affect employers?

Article 8 gives individuals a right to respect for private life, family life, home and correspondence.

Looking at how this right to keep private life and correspondence confidential might cross over into workplace issues is important- here are some employer/HR do’s and don’ts.

Read Article 8 of The European Convention On Human Rights here.

What exactly is the right when it comes to private life and correspondence at work?

Everyone has the right to have their privacy respected when it comes to their private life and their correspondence unless certain legal tests are met to justify “interfering” and even the level of interference still has to be proportionate to the outcome.

Common HR challenges occur when employers are faced with the need to investigate and search emails, for example, to examine whether or not the employee has sent private emails from your system - would that be a breach of Article 8?

So, what can you do as an employer if an employee is suspected of being in breach of your internet usage policy?

Common questions often arise around the following:

• Accessing CCTV for investigations;
• Monitoring business and personal phone calls;
• Monitoring their ‘business’ social media accounts; and
• Relying on comments made on their private social media accounts.

Whilst employees must be guaranteed some degree of privacy in the workplace which extends to their communications, including social media usage, does the employee have a reasonable expectation of privacy in relation to the communications in question? If so, Article 8 will likely kick in.

The courts will examine whether the interference with that privacy was legal and proportionate in deciding whether Article 8 rights have been infringed.

What is a reasonable expectation of privacy?

If your staff have not been told that calls may be monitored, and in fact might even have a telephone designated for their own private use, then this may give rise to a reasonable expectation of privacy, triggering Article 8.

Monitoring such calls may, as a result, be in breach of their rights in such circumstances.

Emails and personal messages

In the case of Barbulescu v Romania:

• Mr Barbulescu’s employer accessed intimate messages he had sent to his fiancée using his work messenger account.
• The account had been set up for work use only and Mr Barbulescu denied any personal use at all.
• In its investigation into allegations that he had breached the internet usage policy, his employer searched these messages and also accessed messages sent using Mr Barbulescu’s own personal Yahoo messenger account on his work computer.
• Mr Barbulescu was dismissed following a disciplinary hearing where the messages were printed off and used as evidence in his disciplinary hearing.
• It was found that Mr Barbulescu’s Article 8 rights had been infringed by his employer as the court decided that “private life” extended to the right to lead a private social life at work and that he had that reasonable expectation of that.
• Incidentally, it was also found that the employer’s internet policy was overly restrictive to the point of being draconian and in fact that it attempted to invade privacy altogether which, the court said, was also an infringement of Article 8.
  
  

CCTV

This issue also crops up when we are talking about CCTV surveillance in the workplace and there have been cases where installing CCTV has also violated Article 8 in relation to the right to respect for private life – people are entitled to have the right to lead a private social life at work and surveillance cameras can violate this right in certain circumstances.

This can be the case even if the staff know the cameras are there.

What about negative social media posts?

If an employee makes a derogatory comment about your organisation, then this can be tricky and often depends on how publicly available their post is.

If the post is public, then they cannot be expected to be protected by Article 8 even if they have made the comment outside of work or in their own time.

But, if they post in a private setting, this is not as clear and relying on such evidence in, say, a disciplinary process might risk an infringement of their Article 8 rights.

Next month, we will look at how far you can go, as an employer, to restrict employees’ use of social media without breaching their rights to freedom of expression under Article 10.

Employers must justify the interference

It is a complex area of law and turns upon the facts in each case and the balance between the individual’s rights to protection under Article 8 and the interests of the employer, for example, to protect its property, and also the public interest in ensuring that justice is properly administered.

But as long as the interference in the individual’s private life, for example, CCTV or email monitoring is restricted to what is necessary to achieve its aims, for example, often the prevention of theft or policy breaches, then Article 8 may well not be infringed – but such justifications must be well laid out in advance and searches must be proportionate to the aims and sensitivities of the case in hand.

So, how can you protect your business?

1. Make sure that the reason you want to monitor is legitimate and also that it is sufficiently important as to justify limiting that person’s rights under Article 8, that is balance the aim against the effects – and make a note to show you have considered this, setting out the rationale for why you need to do it.
   
   
2. If you do decide to monitor, for example, staff email or social media activity, then make sure you carry out a data protection impact assessment given the high risk to their rights and freedoms.
   
   
3. Make sure that the method you choose to monitor goes no further than it needs to in order to achieve that objective.
   
   
4. Once you have decided on the monitoring systems you want to implement, make sure you inform staff of the nature and extent of the monitoring and also of the fact that you might also access the actual content of the messages to reduce, where possible, that reasonable expectation of privacy:

• Get this all set out in a clear policy that sets expectations and covers, clearly and in advance, what will be monitored and the overall purpose - your legitimate reasons for doing the monitoring in the first place; as well as
• How it will be monitored/for what purpose and the extent of it;
• That this might also extend to actual content; and
• Also, make clear the possible outcomes if the policy is breached. 

5. Make sure any such monitoring is then carried out only in accordance with your policy and as necessary and proportionate. If you want to monitor someone’s emails, think first - for example, do you need to monitor all communications in a flow or only part of them? Think about this and make notes, being as minimally intrusive as possible. Consider how many people need to see them and keep this to a minimum.
   
   
6. Always consider whether you could rely on a system of monitoring that is less intrusive. Pause and assess the circumstances of each case and choose a less intrusive means where possible, if the outcome can still be achieved that way.
   
   
7. Consider (and make a note of) the consequences of the monitoring for that employee – take that into account in considering whether a less intrusive means is possible and do consider adequate safeguards for the individual whose Article 8 rights may be potentially impacted too.
   
   
8. Always make unacceptable conduct clear as you go along – if a staff member is on notice that a certain type of conduct is not acceptable, then it will be harder for them to reasonably expect that any materials or communications linked to that conduct would remain private – this is part of overall staff management but can assist in defending any claims that Article 8 has been infringed. 

9. Don’t assume that, because your staff member has put information about herself into the public domain, this means she can have no expectation of privacy after that – the Article 8 right can still exist; and 

10. Link to other policies where possible too, for example, a policy on social media usage so that all requirements and expectations are clear.