Urteile

Überwachung von Telefon- E-Mail- und Internetnutzung durch Arbeitgeber - Verletzung der Privatsphäre

Entscheidungsgründe

1. The case originated in an application (no. 62617/00) against the United Kingdom of Great Britain and Northern Ireland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by Ms Lynette Copland.

2. The applicant was represented before the Court by Mr James Welch of Liberty, a non-governmental civil rights organisation based in London. The United Kingdom Government (“the Government”) were represented by their Agent, Mr J. Grainger of the Foreign and Commonwealth Office.

3. The applicant complained about the monitoring of her telephone calls, e-mail correspondence and internet usage under Articles 8 and 13.

4. By a decision of 7 March 2006, the Court declared the application partly admissible.

5. The applicant, but not the Government, filed further written observations (Rule 59 § 1).

THE FACTS

I. THE CIRCUMSTANCES OF THE CASE

6. The applicant was born in 1950 and lives in Llanelli, Wales.

7. In 1991 the applicant was employed by Carmarthenshire College (“the College”). The College is a statutory body administered by the State and possessing powers under sections 18 and 19 of the Further and Higher Education Act 1992 relating to the provision of further and higher education.

8. In 1995 the applicant became the personal assistant to the College Principal (“CP”) and from the end of 1995 she was required to work closely with the newly appointed Deputy Principal (“DP”).

9. In about July 1998, whilst on annual leave, the applicant visited another campus of the College with a male director. She subsequently became aware that the DP had contacted that campus to enquire about her visit and understood that he was suggesting an improper relationship between her and the director.

10. During her employment, the applicant's telephone, e-mail and internet usage were subjected to monitoring at the DP's instigation. According to the Government, this monitoring took place in order to ascertain whether the applicant was making excessive use of College facilities for personal purposes. The Government stated that the monitoring of telephone usage consisted of analysis of the college telephone bills showing telephone numbers called, the dates and times of the calls and their length and cost. The applicant also believed that there had been detailed and comprehensive logging of the length of calls, the number of calls received and made and the telephone numbers of individuals calling her. She stated that on at least one occasion the DP became aware of the name of an individual with whom she had exchanged incoming and outgoing telephone calls. The Government submitted that the monitoring of telephone usage took place for a few months up to about 22 November 1999. The applicant contended that her telephone usage was monitored over a period of about 18 months until November 1999.

11. The applicant's internet usage was also monitored by the DP. The Government accepted that this monitoring took the form of analysing the web sites visited, the times and dates of the visits to the web sites and their duration and that this monitoring took place from October to November 1999. The applicant did not comment on the manner in which her internet usage was monitored but submitted that it took place over a much longer period of time than the Government admit.

12. In November 1999 the applicant became aware that enquiries were being made into her use of e-mail at work when her step-daughter was contacted by the College and asked to supply information about e-mails that she had sent to the College. The applicant wrote to the CP to ask whether there was a general investigation taking place or whether her e-mails only were being investigated. By an e-mail dated 24 November 1999 the CP advised the applicant that, whilst all e-mail activity was logged, the information department of the College was investigating only her e-mails, following a request by the DP.

13. The Government submitted that monitoring of e-mails took the form of analysis of e-mail addresses and dates and times at which e-mails were sent and that the monitoring occurred for a few months prior to 22 November 1999. According to the applicant the monitoring of e-mails occurred for at least six months from May 1999 to November 1999. She provided documentary evidence in the form of printouts detailing her e-mail usage from 14 May 1999 to 22 November 1999 which set out the date and time of e-mails sent from her e-mail account together with the recipients' e mail addresses.

14. By a memorandum dated 29 November 1999 the CP wrote to the DP to confirm the contents of a conversation they had had in the following terms:

“To avoid ambiguity I felt it worthwhile to confirm my views expressed to you last week, regarding the investigation of [the applicant's] e-mail traffic.

Subsequent to [the applicant] becoming aware that someone from [the College] had been following up her e-mails, I spoke to [ST] who confirmed that this was true and had been instigated by yourself. Given the forthcoming legislation making it illegal for organisations to examine someone's e-mail without permission, I naturally felt concerned over recent events and instructed [ST] not to carry out any further analysis. Furthermore, I asked you to do likewise and asked that any information you have of concern regarding [the applicant] be forwarded to me as a matter of priority. You indicated that you would respond positively to both requests, whilst re-affirming your concerns regarding [the applicant].”

15. There was no policy in force at the College at the material time regarding the monitoring of telephone, e-mail or internet use by employees.

16. In about March or April 2000 the applicant was informed by other members of staff at the College that between 1996 and late 1999 several of her activities had been monitored by the DP or those acting on his behalf. The applicant also believed that people to whom she had made calls were in turn telephoned by the DP, or those acting on his behalf, to identify the callers and the purpose of the call. She further believed that the DP became aware of a legally privileged fax that was sent by herself to her solicitors and that her personal movements, both at work and when on annual or sick leave, were the subject of surveillance.

17. The applicant provided the Court with statements from other members of staff alleging inappropriate and intrusive monitoring of their movements. The applicant, who is still employed by the College, understands that the DP has been suspended.

II. RELEVANT DOMESTIC LAW

A. Law of privacy

18. At the relevant time there was no general right to privacy in English law.

19. Since the implementation of the Human Rights Act 1998 on 2 October 2000, the courts have been required to read and give effect to primary legislation in a manner which is compatible with Convention rights so far as possible. The Act also made it unlawful for any public authority, including a court, to act in a manner which is incompatible with a Convention right unless required to do so by primary legislation, thus providing for the development of the common law in accordance with Convention rights. In the case of Douglas v Hello! Ltd ([2001] 1 WLR 992), Sedley LJ indicated that he was prepared to find that there was a qualified right to privacy under English law, but the Court of Appeal did not rule on the point.

20. The Regulation of Investigatory Powers Act 2000 (“the 2000 Act”) provided for the regulation of, inter alia, interception of communications. The Telecommunications (Lawful Business Practice) Regulations 2000 were promulgated under the 2000 Act and came into force on 24 October 2000. The Regulations set out the circumstances in which employers could record or monitor employees' communications (such as e-mail or telephone) without the consent of either the employee or the other party to the communication. Employers were required to take reasonable steps to inform employees that their communications might be intercepted.

B. Contractual damages for breach of trust and confidence by employer

21. The House of Lords in Malik v Bank of Credit and Commerce International SA [1997] IRLR 462 confirmed that, as a matter of law, a general term is implied into each employment contract that an employer will not “without reasonable and proper cause, conduct itself in a manner calculated and likely to destroy or seriously damage the relationship of confidence and trust between employer and employee”. In Malik, the House of Lords was concerned with the award of so-called “stigma compensation” where an ex-employee is unable to find further employment due to association with a dishonest former employer. In considering the damages that could be awarded for breach of the obligation of trust and confidence, the House were solely concerned with the payment of compensation for financial loss resulting from handicap in the labour market. Lord Nicholls expressly noted that, “(f)or the present purposes I am not concerned with the exclusion of damages for injured feelings, the present case is concerned only with financial loss.”

22. In limiting the scope of the implied term of trust and confidence in Malik, Lord Steyn stated as follows:

“the implied mutual obligation of trust and confidence applies only where there is 'no reasonable and proper cause' for the employer's conduct, and then only if the conduct is calculated to destroy or seriously damage the relationship of trust and confidence. That circumscribes the potential reach and scope of the implied obligation.”

C. Tort of misfeasance in public office

23. The tort of misfeasance in public office arises when a public official has either (a) exercised his power specifically intending to injure the plaintiff, or (b) acted in the knowledge of, or with reckless indifference to, the illegality of his act and in the knowledge or with reckless indifference to the probability of causing injury to the claimant or a class of people of which the claimant is a member (Three Rivers D.C. v. Bank of England (No.3) (HL) [2000] WLR 1220).

D. Data Protection Act 1984

24. At the time of the acts complained of by the applicant, the Data Protection Act 1984 (“the 1984 Act”) regulated the manner in which people and organisations that held data, known as “data holders”, processed or used that data. It provided certain actionable remedies to individuals in the event of misuse of their personal data. The 1984 Act has now been replaced by the Data Protection Act 1998.

25. Section 1 of the 1984 Act defined its terms as follows:

“(2) 'Data' means information recorded in a form in which it can be processed by equipment operating automatically in response to instructions given for that purpose.

(3) 'Personal data' means data consisting of information which relates to a living individual who can be identified from that information (or from that and other information in the possession of the data user...)

(4) 'Data subject' means an individual who is the subject of personal data.

(5) 'Data user' means a person who holds data, and a person 'holds' data if –

(a) the data form part of a collection of data processed or intended to be processed by or on behalf of that person as mentioned in subsection (2) above; and

(b) that person... controls the contents and use of the data comprised in the collection; and

(c) the data are in the form in which they have been or are intended to be processed as mentioned in paragraph (a)...

(7) 'Processing' in relation to data means amending, augmenting, deleting or re-arranging the data or extracting the information constituting the data and, in the case of personal data, means performing any of these operations by reference to the data subject.

(9) 'Disclosing' in relation to data, includes disclosing information extracted from the data ...”

26. The “data protection principles” to be respected by data holders were set out in Part 1 to Schedule 1 of the Act as follows:

“1. The information to be contained in personal data shall be obtained, and personal data shall be processed, fairly and lawfully.

2. Personal data shall be held only for one or more specified and lawful purposes ...

4. Personal data held for any purpose shall be adequate, relevant and not excessive in relation to that purpose or those purposes.”

27. Section 23 of the 1984 Act provided rights to compensation for the data subject in the event of unauthorised disclosure of personal data:

“ (1) An individual who is the subject of personal data held by a data user...and who suffers damage by reason of -

(c) ...the disclosure of the data or, access having been obtained to the data, without such authority as aforesaid,

shall be entitled to compensation from the data user...for that damage and for any distress which the individual has suffered by reason of the...disclosure or access.”

28. The 1984 Act also created the position of Data Protection Registrar, under a duty to promote the observance of the data protection principles by data users. In section 10 it created a criminal offence as follows:

“(1) If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may serve him with a notice ('an enforcement notice') requiring him to take ... such steps as are so specified for complying with the principle or principles in question.

(2) In deciding whether to serve an enforcement notice, the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress.

...

(9) Any person who fails to comply with an enforcement notice shall be guilty of an offence... “

THE LAW

I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

29. The applicant alleged that the monitoring activity that took place amounted to an interference with her right to respect for private life and correspondence under Article 8, which reads as follows:

“1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

30. The Government contested that argument.

A. The parties' submissions

1. The Government

31. The Government accepted that the College was a public body for whose actions the State was directly responsible under the Convention.

32. Although there had been some monitoring of the applicant's telephone calls, e-mails and internet usage prior to November 1999, this did not extend to the interception of telephone calls or the analysis of the content of websites visited by her. The monitoring thus amounted to nothing more than the analysis of automatically generated information to determine whether College facilities had been used for personal purposes which, of itself, did not constitute a failure to respect private life or correspondence. The case of P.G. and J.H. v. the United Kingdom, no. 44787/98, ECHR 2001 IX, could be distinguished since there actual interception of telephone calls occurred. There were significant differences from the case of Halford v. the United Kingdom, judgment of 25 June 1997, Reports of Judgments and Decisions 1997 III, where the applicant's telephone calls were intercepted on a telephone which had been designated for private use and, in particular her litigation against her employer.

33. In the event that the analysis of records of telephone, e-mail and internet use was considered to amount to an interference with respect for private life or correspondence, the Government contended that the interference was justified.

34. First, it pursued the legitimate aim of protecting the rights and freedoms of others by ensuring that the facilities provided by a publicly funded employer were not abused. Secondly, the interference had a basis in domestic law in that the College, as a statutory body, whose powers enable it to provide further and higher education and to do anything necessary and expedient for those purposes, had the power to take reasonable control of its facilities to ensure that it was able to carry out its statutory functions. It was reasonably foreseeable that the facilities provided by a statutory body out of public funds could not be used excessively for personal purposes and that the College would undertake an analysis of its records to determine if there was any likelihood of personal use which needed to be investigated. In this respect, the situation was analogous to that in Peck v. the United Kingdom, no. 44647/98, ECHR 2003 I.

35. Finally, the acts had been necessary in a democratic society and were proportionate as any interference went no further than necessary to establish whether there had been such excessive personal use of facilities as to merit investigation.

2. The applicant

36. The applicant did not accept that her e-mails were not read and that her telephone calls were not intercepted but contended that, even if the facts were as set out by the Government, it was evident that some monitoring activity took place amounting to an interference with her right to respect for private life and correspondence.

37. She referred to legislation subsequent to the alleged violation, namely the Regulation of Investigatory Powers Act 2000 and the Telecommunications Regulations 2000 (see paragraph 20 above), which she claimed were an explicit recognition by the Government that such monitoring amounted to interference under Article 8 and required authorisation in order to be lawful. Since these laws came into force in 2000, the legal basis for such interference post-dated the events in the present case. Thus, the interference had no basis in domestic law and was entirely different from the position in Peck (see paragraph 34 above) where the local authority was specifically empowered by statute to record visual images of events occurring in its area. In the present case there was no such express power for the College to carry out surveillance on its employees and the statutory powers did not make such surveillance reasonably foreseeable.

38. The applicant asserted that the conduct of the College was neither necessary nor proportionate. There were reasonable and less intrusive methods that the College could have used such as drafting and publishing a policy dealing with the monitoring of employees' usage of the telephone, internet and e-mail.

B. The Court's assessment

39. The Court notes the Government's acceptance that the College is a public body for whose acts it is responsible for the purposes of the Convention. Thus, it considers that in the present case the question to be analysed under Article 8 relates to the negative obligation on the State not to interfere with the private life and correspondence of the applicant and that no separate issue arises in relation to home or family life.

40. The Court further observes that the parties disagree as to the nature of this monitoring and the period of time over which it took place. However, the Court does not consider it necessary to enter into this dispute as an issue arises under Article 8 even on the facts as admitted by the Government.

1. Scope of private life

41. According to the Court's case-law, telephone calls from business premises are prima facie covered by the notions of “private life” and “correspondence” for the purposes of Article 8 § 1 (see Halford, cited above, § 44 and Amann v. Switzerland [GC], no. 27798/95, § 43, ECHR 2000 II). It follows logically that e-mails sent from work should be similarly protected under Article 8, as should information derived from the monitoring of personal internet usage.

42. The applicant in the present case had been given no warning that her calls would be liable to monitoring, therefore she had a reasonable expectation as to the privacy of calls made from her work telephone (see Halford, § 45). The same expectation should apply in relation to the applicant's e-mail and internet usage.

2. Whether there was any interference with the rights guaranteed under Article 8.

43. The Court recalls that the use of information relating to the date and length of telephone conversations and in particular the numbers dialled can give rise to an issue under Article 8 as such information constitutes an “integral element of the communications made by telephone” (see Malone v. the United Kingdom, judgment of 2 August 1984, Series A no. 82, § 84). The mere fact that these data may have been legitimately obtained by the College, in the form of telephone bills, is no bar to finding an interference with rights guaranteed under Article 8 (ibid). Moreover, storing of personal data relating to the private life of an individual also falls within the application of Article 8 § 1 (see Amann, cited above, § 65). Thus, it is irrelevant that the data held by the college were not disclosed or used against the applicant in disciplinary or other proceedings.

44. Accordingly, the Court considers that the collection and storage of personal information relating to the applicant's telephone, as well as to her e-mail and internet usage, without her knowledge, amounted to an interference with her right to respect for her private life and correspondence within the meaning of Article 8.

3. Whether the interference was “in accordance with the law”

45. The Court recalls that it is well established in the case-law that the term “in accordance with the law” implies - and this follows from the object and purpose of Article 8 - that there must be a measure of legal protection in domestic law against arbitrary interferences by public authorities with the rights safeguarded by Article 8 § 1. This is all the more so in areas such as the monitoring in question, in view of the lack of public scrutiny and the risk of misuse of power (see Halford, cited above, § 49).

46. This expression not only requires compliance with domestic law, but also relates to the quality of that law, requiring it to be compatible with the rule of law (see, inter alia, Khan v. the United Kingdom, judgment of 12 May 2000, Reports of Judgments and Decisions 2000-V, § 26; P.G. and J.H. v. the United Kingdom, cited above, § 44). In order to fulfil the requirement of foreseeability, the law must be sufficiently clear in its terms to give individuals an adequate indication as to the circumstances in which and the conditions on which the authorities are empowered to resort to any such measures (see Halford, cited above, § 49 and Malone, cited above, § 67).

47. The Court is not convinced by the Government's submission that the College was authorised under its statutory powers to do “anything necessary or expedient” for the purposes of providing higher and further education, and finds the argument unpersuasive. Moreover, the Government do not seek to argue that any provisions existed at the relevant time, either in general domestic law or in the governing instruments of the College, regulating the circumstances in which employers could monitor the use of telephone, e-mail and the internet by employees. Furthermore, it is clear that the Telecommunications (Lawful Business Practice) Regulations 2000 (adopted under the Regulation of Investigatory Powers Act 2000) which make such provision were not in force at the relevant time.

48. Accordingly, as there was no domestic law regulating monitoring at the relevant time, the interference in this case was not “in accordance with the law” as required by Article 8 § 2 of the Convention. The Court would not exclude that the monitoring of an employee's use of a telephone, e-mail or internet at the place of work may be considered “necessary in a democratic society” in certain situations in pursuit of a legitimate aim. However, having regard to its above conclusion, it is not necessary to pronounce on that matter in the instant case.

49. There has therefore been a violation of Article 8 in this regard.

II. ALLEGED VIOLATION OF ARTICLE 13 IN CONJUNCTION WITH ARTICLE 8 OF THE CONVENTION

50. The applicant submitted that no effective domestic remedy existed for the breaches of Article 8 of which she complained and that, consequently, there had also been a violation of Article 13 which provides as follows:

“Everyone whose rights and freedoms as set forth in [the] Convention are violated shall have an effective remedy before a national authority notwithstanding that the violation has been committed by persons acting in an official capacity.”

51. Having regard to its decision on Article 8 (see paragraph 48 above), the Court does not consider it necessary to examine the applicant's complaint also under Article 13.

III. APPLICATION OF ARTICLE 41 OF THE CONVENTION

52. Article 41 of the Convention provides:

“If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”

A. Damage

53. The applicant made no claim for pecuniary damage but without quantifying an amount, claimed non-pecuniary loss for stress, anxiety, low mood and inability to sleep. She produced a medical report dated June 2006 recognising that she had suffered from stress and lack of sleep due to the work environment.

54. The Government submitted that the report presented by the applicant gave no indication that the stress complained of was caused by the facts giving rise to her complaint. Furthermore, as the Court had held in a number of cases relating to complaints involving the interception of the communications of suspected criminals by the police, in their view, a finding of a violation should in itself constitute sufficient just satisfaction (see Taylor-Sabori v. the United Kingdom, no. 47114/99, § 28, 22 October 2002, Hewitson v. the United Kingdom, no. 50015/99, § 25, 27 May 2003 and Chalkley v. the United Kingdom, no. 63831/00, § 32, 12 June 2003). Moreover, since the conduct alleged consisted of monitoring and not interception, the nature of such interference was of a significantly lower order of seriousness than the cases mentioned above.

55. The Court notes the above cases cited by the Government, but recalls also that, in Halford (cited above, § 76) which concerned the interception of an employee's private telephone calls by her employer, it awarded GBP 10,000 in respect of non-pecuniary damage. Making an assessment on an equitable basis in the present case, the Court awards the applicant EUR 3,000 in respect of non-pecuniary damage.

B. Costs and expenses

56. The applicant claimed legal costs and expenses totalling GBP 9,363 inclusive of value-added tax. This included fees paid to a solicitor and trainee solicitor of GBP 7,171.62, disbursements of GBP 1,556.88 and the rest in anticipated future costs.

57. The Government submitted that the hourly rates charged by the solicitors and the rate of increase over the period during which the case was pending were excessive. Moreover, the applicant's original application included a number of complaints which the Court declared inadmissible and therefore the portion of costs related to such claims should not be recoverable. In the Government's view the sum of GBP 2,000 would adequately cover costs and expenses incurred.

58. According to its settled case-law, the Court will award costs and expenses in so far as these relate to the violation found and to the extent to which they have been actually and necessarily incurred and are reasonable as to quantum (see, among other authorities, Schouten and Meldrum v. the Netherlands, judgment of 9 December 1994, Series A no. 304, pp. 28-29, § 78 and Lorsé and Others v. the Netherlands, no. 52750/99, § 103, 4 February 2003). Taking into account all the circumstances, it awards the applicant EUR 6,000 for legal costs and expenses, in addition to any VAT that may be payable.

C. Default interest

59. The Court considers it appropriate that the default interest should be based on the marginal lending rate of the European Central Bank, to which should be added three percentage points.

FOR THESE REASONS, THE COURT UNANIMOUSLY

1. Holds that there has been a violation of Article 8 of the Convention;

2. Holds that it is not necessary to examine the case under Article 13 of the Convention.

3. Holds
(a) that the respondent State is to pay the applicant, within three months from the date on which the judgment becomes final in accordance with Article 44 § 2 of the Convention, the following amounts, to be converted into pounds sterling at the rate applicable at the time of settlement:
(i) EUR 3,000 (three thousand euros) in respect of non-pecuniary damage;
(ii) EUR 6,000 (six thousand euros) in respect of costs and expenses;
(iii) any tax that may be chargeable on the above amounts;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points;

4. Dismisses the remainder of the applicant's claim for just satisfaction. Done in English, and notified in writing on 3 April 2007, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.

T.L. EARLY
Registrar

Josep CASADEVALL
President

Rechtsgebiete