Do employees have the right to privacy in the workplace?

Employees do not lose their right to privacy as soon as they walk through the doors of their workplace. Employees have a "reasonable expectation of privacy" in the workplace. An employee's right to privacy must be balanced against the rights of the employer to run their business and protect the interests of the company.

What are the sources of workplace privacy law?

There is no specific legislation dealing with the right to privacy in the workplace. General legal principles are set down in:

(1)   the Data Protection Act 2018 and the General Data Protection Regulation (the GDPR)

(2)   Article 8 of the European Convention on Human Rights (the ECHR)

(3)   Article 40.3 of the Irish Constitution

(4)   an implied term of reasonable expectation of privacy at common law

A contract of employment also contains an implied term of mutual trust and confidence which could be said to include a duty on the employer to respect employee's reasonable expectation of privacy in the workplace.

Are employers entitled to monitor employee's internet, email and social media usage?

The key consideration regarding the issue of monitoring email, internet and social media usage by employers is that there must be a balance struck between the competing rights and interests of the employer and employee.

Businesses have a legitimate interest to protect their company, reputation, resources and equipment. To achieve this, they may wish to monitor employee's use of the internet. Any monitoring by an employer in the workplace must be necessary, legitimate and proportionate.

Employers must also inform employees about any monitoring – this notification should be provided by the implementation of a clearly communicated policy. The policy should contain details such as what; who, when and how the monitoring is happening.

Prudent employers will be cognisant of their obligations under the Data Protection Act 2018 and GDPR. The processing of personal data includes for example, the use or storage of information about employees, the monitoring of their email or internet access and/or their surveillance by CCTV.

Can an employer rely on employee's communications in a disciplinary process?

Two recent decisions of the European Court of Human Rights (the Court) examined this question and considered whether an employer can rely on employee's work communications and/or their personal communications in a disciplinary process.

In the case of Garamukanwa v UK , the Court assessed whether there was a violation of an employee's right to privacy under Article 8 of the ECHR. An employer relied on material found on an employee's personal phone, private emails and personal WhatsApp messages during a police investigation to dismiss him following allegations of harassment by a colleague.

The Court confirmed that the sending and receiving of communications is covered by Article 8 under the reference of "correspondence" and that the communications that Mr Garamukanwa was sending from the business premises as well as from his home fell with the remit of "private life" under Article 8. This means employees may have a reasonable expectation of privacy over communications even if they are sent from a work email or cover work issues. In other words, Article 8 of the ECHR may be engaged even where the material relates to work emails or touches upon both work and personal matters.

The Court found that Mr Garamukanwa could have no reasonable expectation of privacy in the situation where he had been aware that a colleague of his had raised concerns about his inappropriate communications a year previously and he did not challenge the use of his private communications during the disciplinary hearing; in fact he voluntarily provided the disciplinary panel with further communications. Whether or not an employee had a reasonable expectation of privacy will be highly fact specific and it may be difficult for employers to assess.

In the 2017 case of Bârbulescu v Romania, the employee, at his employer’s request set up a Yahoo Messenger account to deal with client enquiries. The employee also used this personal account to communicate with his family. The employer had an internal rule in which all personal use of the employer's IT systems was forbidden. The employer advised the employee that they monitored his usage of this personal account for a week and he was dismissed for breaching the company's internal rule. The Court held that his Article 8 rights had been invoked but the Court did not find it unreasonable that an employer would want to verify that employees were completing their professional tasks during working hours. The Court found that the employer’s monitoring was limited in scope and proportionate and there was a fair balance struck between the employee’s right to respect for his private life and correspondence under Article 8 and the interests of his employer.

What do the above cases mean for employers?

The above cases highlight the importance of notifying employees with a transparent policy that they are monitoring their internet and email usage. Before employers implement a policy, they must ask themselves questions such as:

• Is there a less intrusive way of monitoring employee's emails/internet usage e.g. blocking certain websites?
• What is the legal basis for the monitoring, e.g. is it to protect confidential information of the company?
• Is the monitoring proportionate to the perceived risk e.g. is monitoring all emails sent and received by an employee to ensure they are not sharing confidential information proportionate?

Before relying on work and personal communications in disciplinary proceedings, employers would be prudent to conduct their own analysis of any privacy implications. Some work emails may contain a mixture of work and personal content. Employees would need to be mindful of their obligations under data protection legislation and adhere to their own privacy policies.

Employers should note that employees may have an expectation of privacy over certain communications even if they are sent from work emails or cover work issues. It will depend on all of the circumstances and facts. A full assessment of these will have to be carried out.

What do the above cases mean for employees?

Employees should remember that they do not have an absolute right to privacy in the workplace.

Employees should ensure that they follow work policies and take seriously any warnings from their employer in relation to using IT systems for personal use.

If an employee voluntarily hands over any communications (work or personal), during a disciplinary process, it is unlikely that the employee will later be able to state that they should have a right to privacy over that material.

Training Resources

Did you know we offer an eLearning Data Protection in the Irish Workplace course which is tailored specifically to provide your employees with comprehensive training and you with an evidence trail for the DPC, should a data breach occur.