>And they added that Mr Barbulescu had had prior warning that the company could check his messages.
...and there's the part where I'm not surprised this fellow lost his lawsuit.
Honestly, if I come to a railroad crossing and the gate/arm is down and red lights are blinking, and I go onto the tracks anyway, I think I kind of sort of lose the ability to win a lawsuit against the railroad company for hitting my car.
Yeah, like 15 years ago I was on a legal seminary about how to deal with private messages at work. It's difficult. If you allow your employees to use certain means of communication for private messages, you bar yourself from reading them. If you prohibit private messages on that channel though, you have to enforce that.
As an example you could give employees 2 accounts on the company's email servers: [email protected] and [email protected]. If now [email protected] sent to [email protected] "lets grab a beer after work. Also check this link below. I guess it fixes the problem we had all week with our servers", as an employer you would have to warn and ultimately fire him over such transgressions of the rule to split private from work. The problem is that you are not allowed to read his private correspondence (grepping the backup for business problems like "where was that link again?") but you are allowed to do all this with his business mail. Not enforcing a split leads to the company legally loosing all access to all the correspondence.
> If you allow your employees to use certain means of communication for private messages, you bar yourself from reading them. If you prohibit private messages on that channel though, you have to enforce that.
Just curious, are you in the US? My employer's policy is essentially "Your work-provided laptop is for work. However, we recognize that you'll access personal websites and content from time to time. Don't miss deadlines because you're on Facebook or the NY Times all day." However, they explicitly retain their right (but not responsibility!) to monitor, log, and retain all traffic and activity on not only the work machines, but the work wifi (including guest wifi).
I asked about the US because I know privacy protections are much strong in the EU and I had never heard that allowing private messages bars an employer from reading them.
Very worthwhile deliniations you've put forward - matters of policy and employment agreements, to me, aren't able to address every single instance of good or bad judgment by an employee.
I've worked with several highly regulated industries, and while data preservation is a big deal, very frequently compliance officers have said "Just don't store personal-type or non-material information like calendar meeting requests for off-site dinners" because they're simply outside the purview of what's needed to satsify the rules.
On the other hand, it was quite clearly stated that if doing filing/archiving one comes across correspondence that reflects an error of judgment (intentional or not), say relating to giving a "personal" gift to somebody above/beyond the accepted corporate policy or legal mandates (ex: local government officials), then by all means, that's in the company's interest to review and address.
There's a perfectly fine reason some sensitive conversations should take place over the phone instead of in writing (most notably "OUR IT SAYS WE'VE HAD A BREACH OMG OMG OMG"), just like there's ample reason talking about something sketchy is frequently performed over the phone. Funny creatures, us humans.
This isn't a contract dispute - this is a human rights dispute.
Assault is probably against Romania's laws. As such, any policy or contract specifying assault is illegal.
Invasion of privacy in the workplace is allowed under law; this law was challenged in the ECHR - and the challenged failed, so the law stays. So it is legal to put this in any contracts in EU, since the judgement sets precedence across EU.
>So it is legal to put this in any contracts in EU, since the judgement sets precedence across EU.
Nitpicky, but I believe it says that any European country can have laws which allow this but they are not required to allow it. E.g. the Belgium Gov't might still pass a law which says companies are not allowed to do this.
Right. What the company did was bad, regardless of the warning.
But I think his argument would have been stronger if he had raised the issue after his initial warning. Why did they have to invade his privacy twice for it to become an issue for him? The answer: because he was sacked. This seems to change it from a privacy issue to a retaliation.
Not that I'm okay at all with employers being able to violate his privacy, regardless of his motives for claiming his civil rights.
No, because assault is obviously wrong, whereas his employer having access to his private messaging on his work machine in work time was more of a grey area.
If it wasn't a grey area, why would the European Court of Human Rights be hearing it instead of a local employment tribunal? Lots of law is a grey area, with both sides putting their argument and a judge adjudicating.
On the other hand, an employer physically assaulting an employee (with or without warning) wouldn't need to be heard by the ECHR because there is so much law and precedent to say that employers can't do that.
This is a straw man argument, and it's really not worth debating.
> It indicates this european court believes there is no right to privacy at work
When you're on the employer's dime, using the employer's equipment, and using the employer's internet connection, you don't get to send personal messages. This guy did, and then found out the consequences. It's pretty simple.
The company used MSN Messenger for business purposes. This guy took it upon himself to setup a separate account from which he privately messaged people during business hours.
This guy would not have been able to send those private messages had the employer not fully paid for all the equipment and necessary components to facilitate messaging for business purposes.
Imagine the parallel. I hire you to telemarket for me (make sales phone calls). I tell you all calls are recorded. Sometime later, I'm digging through the recordings to find a customer's call, and discover you have been making many personal non-business-related phone calls. Instead of using my equipment to conduct business, you have decided to make personal calls to your friends. Of course you would be terminated, and of course I listened to the calls, because I own them.
> Of course you would be terminated, and of course I listened to the calls, because I own them.
And of course in several EU countries you'd be staring down a possible severe consequences for breach of privacy. Some countries do not consider employment a right to total ownership of an employee.
Several EU countries recognise that employee has a right to privacy even when working (which includes phone calls and other communication with their families while working and sometimes - like France - even on computer equipment).
> Some countries do not consider employment a right to total ownership of an employee
This isn't about "owning" an employee, this is about owning the equipment which an employee uses against it's explicit purpose (to conduct business).
I don't think many would have an issue with an employee stepping out for a few minutes to handle a personal call. But many would have an issue with an employee phoning friends and chatting during regular business hours instead of doing their work.
The guy in the original story was chatting with friends while at work over MSN Messenger... instead of working.
> And of course in several EU countries you'd be staring down a possible severe consequences for breach of privacy
That's not true in this case. If you have a policy that prohibits personal use of company equipment, and another policy which states clearly all communications are recorded for business purposes, and it's signed by the employee, then it's really cut and dry.
You can't have both a "right to privacy" at work, and high degrees of oversight of companies. The way you have oversight of companies is by monitoring and controlling employee actions while at work. There's no separate "company" that can somehow be monitored without its employees. If you want to create more privacy for employees at work, you also must be willing to subject companies to less scrutiny, because all such private channels are also places to hide malfeasance. Given the meager volume of complaints about workplace privacy (basically, we only hear about it when it directly comes up, like in this article) vs. the near-continual torrent of complaints about companies that comes up all the time, I suspect people are generally going to choose corporate oversight.
> It indicates this european court believes there is no right to privacy at work.
The court has been clear (in this case, and cases in the past) that employees do have a right to privacy at work, and that an employer cannot just trawl everything all the time, even if there are policies in place.
How is it clear exactly? Obviously they won't be trawling literally everything literally all the time, but being able to access anything they choose at any time they choose seems indistinguishable from the employee's perspective, and that is apparently allowed?
They can't access anything. They accessed his work work account because they thought it was the work account, and they had already asked him not to send personal stuff through the work account.
They didn't make any judgement about his personal account (which also got read) because as I understand it they've already ruled that you can't read personal accounts without very good reason.
> It indicates this european court believes there is no right to privacy at work.
That's not true and I guess you haven't really read what the ruling is about. It's about this one exact case where the court ruled that the employer reasonably expected that the account they were looking at wasn't personal.
If the employer would knowingly look into employees personal correspondence the ruling would be different.
That cannot be true or you could never do proper security or investigations. How would you know if an employee machine was compromised if you absolutely cannot read their internet traffic? Sometimes you actually have to dump traffic an analyze it with wireshark to figure out something is wrong.
Honest question: What about in issues of court cases? As in, if an Austrian employee is comitting an international crime of bribery and is under investigation, does that forbid the courts or employer from ever reading the internet traffic? Granted, I'm setting up a 'higher bar' to clear than an internal, company-exclusive issue, but if we're talking scope and priorties of laws, I'm curious how they might be reconciled in the situation you present.
Citation needed. Pretty sure onnoffice equipment you are bound by the rules of the company. it's valid for a company to prevent the personal use of office equipment.
You are correct, employers are allowed to block e.g. Facebook (most have given up on that though). But never read or act upon their email/connection data/... in a semantic way.
I have no english source for this, sorry.
If the employer disallows private communication at work and the employee disregards that rule, the employer does not have to special case private data on the company device. This is the same in Austria as the court case here just found.
...and there's the part where I'm not surprised this fellow lost his lawsuit.
Honestly, if I come to a railroad crossing and the gate/arm is down and red lights are blinking, and I go onto the tracks anyway, I think I kind of sort of lose the ability to win a lawsuit against the railroad company for hitting my car.