Workplace emails



Private emails sent using a work system are normally protected by Article 8 if there is a reasonable expectation of privacy, for example, if they are clearly marked as “private”. In practice, whatever the law says it is sensible not to use a work computer to send emails you would rather your employer did not see.



In Barbulescu v Romania [2017] Application No. 61496/08, an employer breached their employee’s human right to privacy by reading obviously private messages (from his girlfriend and his brother) sent using a Yahoo Messenger account set up to service clients. The Grand Chamber of the European Court of Human Rights (ECHR) ruled that although Mr Barbulescu’s employer operated a blanket ban on computer use for private purposes, this did not mean that Barbulescu had no reasonable expectation of privacy at all, especially since he had password-protected the account. 



The ECHR ruling in Barbulescu reminds employers that covert monitoring of staff computer use must be lawful and proportionate. In particular, employees must be pre-warned that this may be happening, and less intrusive alternative ways of proceeding must always be considered. 


Employers who read obviously private messages without their employees’ clear, express and freely given consent also risk breaching both the GDPR and the Regulation of Investigatory Powers Act 2000 (RIPA).