Workplace emails


Private emails sent using a work system are normally protected by Article 8 where there is a reasonable expectation of privacy, for example, if they are clearly marked as “private”. However, in practice, whatever the law says, it is sensible not to use a work computer system to send emails you would rather your employer did not see.


In Barbulescu v Romania [2017] Application No. 61496/08, an employer breached an employee’s human right to privacy by reading obviously private messages (from his girlfriend and his brother) sent using a Yahoo Messenger account that had been set up to service clients. The Grand Chamber of the European Court of Human Rights (ECHR) ruled that although there was a blanket ban on computer use for private purposes in Barbulescu’s workplace, this did not mean that he had no reasonable expectation of privacy at all, especially since Barbulescu had password-protected the account. 


The ECHR ruling in Barbulescu reminds employers that any monitoring of staff computer use must be lawful and proportionate. In particular, employees must be pre-warned, and less intrusive alternatives must always be considered. In addition, employers who read private messages without their employees’ clear, express and freely given consent, risk breaching both the GDPR and the Regulation of Investigatory Powers Act 2000 (RIPA).