Five months after its judgment in the Bărbulescu case, the European Court of Human Rights delivered another ruling regarding privacy at the workplace. The applicant, Mr Eric Libert, had complained that his former employer, the French national railway company (SNCF), had breached his right to respect for his private life by accessing files that he had stored on his work computer. The Court reaffirmed the Bărbulescu guidelines which were issued in the context of employment by a private company, and found – unlike in the Bărbulescu case – that there had been no breach of privacy. T he judgment is not yet final, however, as referral of the case to the Grand Chamber has been requested.
The Libert v. France case at the ECHR
Mr Eric Libert, former deputy head of a Regional Surveillance Unit of SNCF, had lodged a complaint with the European Court of Human Rights that SNCF had, in his absence, opened personal files stored on the hard drive of his work computer, as a result of which he was dismissed. Mr Libert alleged that this constituted a breach of his right to respect for his private life as enshrined in Article 8 of the European Convention on Human Rights. The personal files comprised, among other things, 1,562 files with pornographic images and films.
The Court adjourned its examination of the case until the Grand Chamber rendered its judgment in the Bărbulescu case, on 5 September 2017. For a summary of that judgment, we refer to our earlier analysis (Eubelius Spotlights September 2017).
The judgment in the Libert case was eventually rendered on 22 February 2018 (application no. 588/13).
The Court first pointed out that, whereas the Bărbulescu case involved a private commercial employer, the employer in the Libert case was SNCF, which qualifies as a public authority in the meaning of the Convention. Hence, unlike with the Bărbulescu case, the Court did not examine the Libert case from the angle of the positive obligation of the State to ensure respect for private life, but from the angle of the negative obligation of the State to refrain from breaches of Article 8 of the Convention.
The Court confirmed the application of the principles of the Bărbulescu judgment in the case at hand. The Court thus reaffirmed that an employer has a legitimate interest in ensuring the smooth running of its business, and that this can be effected by means of monitoring of the use of the IT equipment, provided that this surveillance is accompanied by adequate and sufficient safeguards against arbitrariness and abuse.
The applicable SNCF policy provided that the IT system was for professional use, with private use only tolerated to a limited extent, and that private information and carriers of such information had to be clearly identified as "private".
Mr Libert had stored the pornographic material in a file named "laughter" on a hard drive on his work computer that he had renamed "D:/personal data" (the default name of the hard drive being "D:/data").
According to the French case law, data on a work computer are deemed to be of a professional nature, and the employer is entitled to consult these data, with the exception of data that are identified as personal. In the case of Mr Libert, the domestic courts held that he was not entitled to reserve the entire hard drive for private use, and that his renaming of the hard drive as containing "personal data" did not confer "private" status on the data that was stored on it. The courts observed that "personal data" is a generic term which can also relate to professional files that are handled by an employee in person, and thus does not in itself and explicitly identify the data as being part of the employee's private life.
The European Court of Human Rights validated the judgment of the French domestic courts, stressing the clear requirements of the SNCF policy as well as the huge number of contentious files that Mr Libert had stored on his work computer. The Court thus held that the national authorities had not exceeded their margin of appreciation, and hence there was no violation of the right of respect for private life.
A request has recently been made for referral of this case to the Grand Chamber of the European Court of Human Rights. The Grand Chamber may decide to hear if it considers that the case raises either a serious question affecting the interpretation or application of the Convention, or a serious issue of general importance. The Grand Chamber would then render a final judgment in this case.
Lessons from this case
In this judgment, the European Court of Human Rights examined whether the French judges had properly assessed Mr Libert's complaint. The Court took into account the case law of the French Court of Cassation ("Cour de cassation") as well as the margin of appreciation enjoyed by the French State in applying the Convention. The Court also referred to the judgment of the Grand Chamber in the Bărbulescu case.
A number of lessons of interest to employers in Belgium can be drawn from the Libert judgment, albeit subject to possible reform of the judgment by the Grand Chamber.
The Court did not accept the argument that when an employee names a storage space on his work computer as a space containing "personal data", the data and files stored in that space would consequently lose their professional nature.
An employee is not entitled to reserve for his private use the entirety of the workspace on a computer that is put at his disposal for professional use. The Court also affirmed that an employer can invoke a company policy requiring that private information on a work computer has to be expressly and separately identified as private.
The right to respect for private life is not absolute. The employee's interests have to be balanced against the employer's interests. When an employee uses a work computer in breach of the company policy, this will put him at a disadvantage in the balancing exercise.
However, the right to respect for private life as enshrined in Article 8 ECHR is not the only norm that has to be respected. Employers in Belgium should pay particular attention to the rigid rules prohibiting the accessing of communications such as e-mails sent or received by others, the personal data protection rules, and – in the private sector – CLA no. 81 of 26 April 2002 regarding protection of the privacy of employees in relation to the monitoring of online electronic communication (e-mail and internet).
The consultation by an employer of data and files stored on an employee's work computer thus requires a prudent, sensible and proportionate approach, in accordance with the right to respect for private life, as applied by the European Court of Human Rights, as well as with the other binding rules. Employers who have a clear company policy in place establishing the rules and limits regarding the use of their IT equipment are much better off in this delicate balancing exercise.
We will be observing closely whether or not the Grand Chamber will render a judgment in this case.