European court rules employer legally snooped on private messages at work

Almost everyone’s probably used their own personal Instant Messaging accounts while at work and assumed that those are private, but according to a new European Court of Human Rights (ECHR) ruling today, that might not be the case.

Today the ECHR ruled that a Romanian company’s surveillance of an employee’s personal Yahoo Messenger instant messages was legal because the employer had the right to “check the manner in which its employees complete their professional tasks.”

Bogdan Mihai Bărbulescu, the employee who was a sales engineer at the time, claimed he had set up the account for professional use and that it was only used for this purpose.

He ultimately was caught lying when his employer handed him a 45-page transcription of personal, intimate messages it had captured over a week.

Bărbulescu was laid off in 2008 when he was caught, but challenged his employer in court for unlawful surveillance. That case was dismissed, as the court found the company had informed him of its monitoring policies when he signed an acceptable use agreement.

Later, Bărbulescu argued that his employer had also accessed a separate, personal Yahoo account, though the final ruling didn’t discuss that account.

The ECHR said that “the employer’s right to monitor their employees’ use of the company’s computers in the workplace falls within the broad scope of the right to check the manner in which professional tasks are complete” but didn’t say if the ruling would have been different had it happened on his own computer.

For his part, Bărbulescu argued that because his employer let him choose his own password, he had thought it was for personal purposes, even though the company had a blanket ban on personal communication at work.

Ultimately the ECHR ruled that “[the employer] had accessed the Yahoo Messenger account on the assumption that the information in question had been related to professional activities and that such access had therefore been legitimate.”

The ruling today could have wider ramifications on how employers deal with the separation of personal and work life on accounts that are used outside the office.

However, given the premise of this case occurring on a professional account that was misinterpreted as a personal one, it’s unlikely the ruling will apply broadly — so don’t panic, your WhatsApp messages are probably safe.

You can read the full ruling from the ECHR here.