ECHR Rules on Employee Data Privacy: The Guyvan v. Ukraine Judgment
This case before the European Court of Human Rights (ECHR) primarily concerned a complaint under Article 8 (Right to respect for private and family life) of the European Convention on Human Rights, specifically regarding the processing of data from an applicant's work mobile telephone by his employer.
Facts
The applicant, was an employee whose work mobile phone was also used for private calls. In the context of an internal investigation related to the use of the phone, his employer, P. company, obtained detailed information from the mobile phone operator. This information included the date, time, and type of communication (incoming/outgoing), and details about international roaming services. The employer requested this data to verify the applicant's presence at his workplace.
The applicant subsequently lodged a civil claim against the
company, arguing that the collection and processing of his personal data were
unlawful and requesting that the company be ordered to provide him with the
collected information.
The
national courts in Ukraine ruled against him, finding that the telephone number
belonged to the company, which was therefore entitled as the owner to request
and receive information from the mobile operator.
The
domestic courts concluded the purpose was related to labor relations and not to
determine where the applicant was on holiday or who he was communicating with,
and that the content of the communications had not been accessed.
ECHR Ruling (6.11.2025)
The ECHR found that there had been a violation of Article 8 of the Convention.
Violation of Article 8
Interference with Private Life: The Court determined that the information collected—which included when and where international roaming services were used, thereby revealing details about the applicant's whereabouts and, potentially, his social ties and habits—did constitute the applicant's personal data and thus fell within the scope of his "private life". The employer's action constituted an interference with the applicant's right to respect for his private life.
Absence of Legal Basis and Safeguards: The Court noted that an interference with Article 8 must be "in accordance with the law." In this case, the national courts had simply relied on the fact that the company owned the telephone number. However, the ECHR stressed that the domestic law on data protection did not clearly specify the scope and manner in which an employer may process an employee's data derived from the use of work tools, particularly when those tools are also used for private purposes. Crucially, the law lacked the necessary safeguards to prevent the arbitrary use of such data, such as a requirement for prior notification, necessity, or proportionality.
Conclusion: The ECHR concluded that the interference was not "in accordance with the law" because the legal framework in Ukraine did not offer sufficient protection to the applicant against the employer's processing of his personal data, thereby failing to secure the applicant's right to respect for his private life.
Just Satisfaction (Article 41)
The Court held that the finding of a violation constituted in itself sufficient just satisfaction for any non-pecuniary damage suffered by the applicant.
The
judgment underscores the necessity for clear, precise, and foreseeable legal
rules at the domestic level governing the collection and processing of an
employee's personal data from work devices, especially those used for private
calls. The lack of such a legal framework with adequate safeguards for
the employee was the core reason for the finding of a violation of the right to
respect for private life under Article 8. (photo vecteezy.com)
Comments
Post a Comment