Access to employee data on a work phone is a violation of the right to privacy – ECHR

The European Court of Human Rights found a violation of Article 8 of the Convention in the case GUYVAN v. UKRAINE regarding the collection and processing of data from his work mobile phone by the employer during an internal investigation. The Court concluded that the national courts did not provide adequate protection of the right to respect for private life.

Case circumstances

The applicant used a mobile number that was initially his personal number but was later assigned to him as a work phone and paid for by the employer. In 2010, the company set limits on mobile phone usage and established a procedure for expense reimbursement, including international roaming.

In 2015, the employer began an investigation after phone bills revealed roaming usage during periods when, according to attendance records, the applicant was supposed to be at work. During the investigation, the company contacted the mobile operator and obtained detailed information about calls, messages, countries visited, call durations, and subscriber numbers.

Subsequently, the employer filed a criminal complaint against the employee, and the applicant was dismissed for absence from work.

Ukrainian courts denied the applicant's claim, reasoning that the phone belonged to the company and the collected data did not constitute personal information since it was used solely to verify work discipline and presence at work.

ECHR decision

However, the European Court of Human Rights reached the opposite conclusion. The ECHR emphasized that the concept of "private life" is broad and extends beyond the purely private sphere of an individual, also covering their interactions in a professional environment. The Court stressed that private life may include, among other things, data about a person's location at a specific time.

In this case, the Court noted that the information the employer received from the mobile operator concerned the use of a work phone assigned to the applicant but also permitted for private use subject to expense reimbursement.

At the same time, such information included data about the applicant's presence in different countries as well as his phone contacts.

The Court stated that such information can reveal private aspects of a person's life, including their movements and communications, and therefore qualifies as personal data.

Furthermore, the ECHR reminded that even when interference is carried out not by a state body but by a private employer, the state is obliged to ensure effective protection of the right to respect for private life. Such positive obligations may require the state to establish an adequate legal and judicial protection system.

The Court noted that national courts are required to conduct a full proportionality analysis of the interference and consider personal data protection requirements. Failure to perform such analysis constitutes non-compliance with the standards of Article 8 of the Convention. Assessing the case circumstances, the Court noted that the employer was entitled to obtain information from the operator only to determine the work or private nature of calls for reimbursement purposes.

However, the requests made by the employer during the internal investigation exceeded this purpose, as they allowed establishing the applicant's location abroad on certain dates and included data about his contacts and countries visited. Meanwhile, the national authorities themselves acknowledged that such information was not necessary to verify the employee's presence at work.

The Court concluded that such collection and processing of data constituted interference with the applicant's right to respect for private life. However, the national courts did not conduct a proper proportionality assessment of this interference, limiting themselves to the conclusion that the obtained information was not personal data.

Consequently, the Court found that the applicant was not provided with effective judicial control over compliance with the criteria for monitoring communications at the workplace, and the state failed to fulfill its positive obligations under Article 8 of the Convention.

Additionally, the Court noted that the applicant did not submit a claim for just satisfaction, so there are no grounds for awarding any monetary compensation.

Subscribe to our Telegram channel t.me/sudua and to Google News SUD.UA, as well as to our VIBER and WhatsApp pages on Facebook and Instagram to stay informed about the most important events.