Dundas Street Employment Lawyers navigation


Workers should assume their emails aren't private

Date: 13/09/2017

Way back in 2007, Bogdan Bărbulescu was an engineer at a Romanian sales company. That was until he was sacked for using his work Yahoo Messenger account to converse with his fiancée and brother.

The company’s decision to dismiss was made in reliance on internal policies which banned the use of office resources for personal matters. Further Bărbulescu had been expressly told not to use the messenger account for non-business reasons. Given the conversations were apparently lengthy - the employer found 45 pages of messages between Bărbulescu and his family members – the decision was probably not a hard one.

But Bărbulescu was not prepared to accept this outcome. He chose to challenge his dismissal and spent the next 10 years pursuing the matter which led all the way to the European Court of Human Rights.

The Court’s lower chamber initially found against Bărbulescu. However, this decision has now been reversed after Bărbulescu appealed to the Court’s Grand Chamber. Specifically, it decided that the company’s monitoring of Bărbulescu’s emails breached Article 8 of the European Convention on Human Rights which provides an entitlement to respect for private and family life and correspondence.

In New Zealand, the legal position up until now has been the opposite of this. The starting point is that unless an employer has clearly stated that personal communications on work accounts will be treated as private, employees should expect that anything they send through their work email or phone is fair game.

The basic principle in this respect is that business tools – and the information contained on them – are the property of the employer.

Where there is a policy in place which prohibits the use of business tools to send personal communications, the employer will have strong grounds to access and monitor the material and potentially to take disciplinary action in reliance on it.

A clear example of this involved Papataia Toleafoa who worked for Vodafone New Zealand. Toleafoa was dismissed for sending emails from her work account which described her managers in unflattering terms which translated to "d...head" and "f...wit". 

Toleafoa challenged the dismissal in the Employment Relations Authority and tried to rely on a similar argument to Bărbulescu –that the emails she sent were private. However, the Authority disagreed and pointed to a Vodafone policy which explicitly stated that all communications generated in its systems were company property and that Vodafone had the right to monitor these communications.

So, what explains the different approaches between our law and the European position? The obvious difference is that we do not have a clear equivalent to Article 8 of the European Convention on Human Rights. While the Privacy Act does preclude the collection of personal information by means that intrude to an unreasonable extent upon the personal affairs of an individual, this is not as far reaching as Article 8. It is therefore unlikely that the European Court’s decision will result in an immediate and seismic shift in the legality of New Zealand employers monitoring communications sent by employees through work accounts.

That said, the Toleafoa case is now a few years old and more recently, we have seen privacy rights being given much more teeth and scope. A clear example of this is the so-called “Cake case” which resulted in New Zealand Credit Union Baywide having to pay out over $167,000 after it unlawfully accessed and disseminated a photo of a cake iced with profanities found on a former employee’s Facebook page. It is therefore entirely possible that moving forward we will see a broader approach being taken to recognising the privacy expectations of employees who send personal communications at work.

Given this, employers should take the European Court’s decision as a wake-up call to ensure they have clear policies in place dealing with the use of work emails or communication tools, and their right to monitor employee usage is spelt out. In the absence of such policies, monitoring may be on much shakier ground than was previously the case.

As far as employees are concerned, even though Bărbulescu’s case may provide a basis to argue that personal emails sent at work should be treated as private, they would still be well-advised to assume that anything they send or receive will be seen by their employer. At the end of the day, these are tools of business so it entirely appropriate that they be treated as such.