With regards to the second issue on the monitoring, article 5
18 of the Law
190/2018 states that when electronic monitoring systems and/or video surveillance
systems are used in the workplace, the processing of personal data of employees in
order to achieve the legitimate interests pursued by the employer is possible only if:
a) The legitimate interests pursued by the employer are duly justified and prevail
over the interests or rights and freedoms of the data subject
19 ;
b) The employer has made the mandatory, full and explicit prior notice of the
employees;
c) The employer consulted the trade union or, as the case may be, the representatives of the employees before the introduction of the monitoring systems;
d) Other less intrusive forms and ways to achieve the goal pursued by the employer
have not previously proved their effectiveness;
e) The length of storage of personal data is proportional to the purpose of the
processing, but not more than 30 days, except in cases expressly regulated by the
law or in duly justified cases.
The law requires employers to provide Labour Force Information (ITM), particularly with regard to personal data (employee information) that the employer holds,
how they are used and with whom this information is shared. Employers must
provide more detailed information than those currently required in existing EU
data protection laws and must also ensure that their privacy notices accurately reflect
their data processing workforce, according to the provisions of the law 190/2018.
Employers can provide privacy notices to their staff in any way they deem
appropriate. For example, the privacy notice could be included in the salary leaflets
or electronically communicated through the company’s intranet or via email.
With regards to this matter of monitoring employees at work, on 12 January 2016,
the European Court of Human Rights (the “Court”) issued its judgment in the case of
Bărbulescu v Romania, pursuant to application no. 61496/08.
20 In this decision, the
Court ruled that, although there is privacy at the workplace and employers have no
legal right to track their employees’ communications, such interference might be
acceptable in certain conditions.
Mr. Bărbulescu, the applicant was in charge of sales for a private company, for
which purpose he was instructed by his employer to create a Yahoo Messenger
account having as purpose chat communication and created by the employee at the
request of the employer for the purpose of responding to clients’ enquiries. The
employee declared that he was using the account only for professional purposes
(both under the internal regulation and at the separate request of the employer).
In order to check the manner in which professional tasks of Mr. Bărbulescu were
completed, the employer monitored Mr. Bărbulescu’s Yahoo Messenger account
from the company’s computer and alleged that the applicant, by using the company’s
18 Processing of personal data in the context of employment relationships.
19 See Sandru and Alexe (2018).
20 See the Judgement of ECHR, application no. 61496/08, 12 January 2016.
300
E. Lazar and D. N. Costescu
18 of the Law
190/2018 states that when electronic monitoring systems and/or video surveillance
systems are used in the workplace, the processing of personal data of employees in
order to achieve the legitimate interests pursued by the employer is possible only if:
a) The legitimate interests pursued by the employer are duly justified and prevail
over the interests or rights and freedoms of the data subject
19 ;
b) The employer has made the mandatory, full and explicit prior notice of the
employees;
c) The employer consulted the trade union or, as the case may be, the representatives of the employees before the introduction of the monitoring systems;
d) Other less intrusive forms and ways to achieve the goal pursued by the employer
have not previously proved their effectiveness;
e) The length of storage of personal data is proportional to the purpose of the
processing, but not more than 30 days, except in cases expressly regulated by the
law or in duly justified cases.
The law requires employers to provide Labour Force Information (ITM), particularly with regard to personal data (employee information) that the employer holds,
how they are used and with whom this information is shared. Employers must
provide more detailed information than those currently required in existing EU
data protection laws and must also ensure that their privacy notices accurately reflect
their data processing workforce, according to the provisions of the law 190/2018.
Employers can provide privacy notices to their staff in any way they deem
appropriate. For example, the privacy notice could be included in the salary leaflets
or electronically communicated through the company’s intranet or via email.
With regards to this matter of monitoring employees at work, on 12 January 2016,
the European Court of Human Rights (the “Court”) issued its judgment in the case of
Bărbulescu v Romania, pursuant to application no. 61496/08.
20 In this decision, the
Court ruled that, although there is privacy at the workplace and employers have no
legal right to track their employees’ communications, such interference might be
acceptable in certain conditions.
Mr. Bărbulescu, the applicant was in charge of sales for a private company, for
which purpose he was instructed by his employer to create a Yahoo Messenger
account having as purpose chat communication and created by the employee at the
request of the employer for the purpose of responding to clients’ enquiries. The
employee declared that he was using the account only for professional purposes
(both under the internal regulation and at the separate request of the employer).
In order to check the manner in which professional tasks of Mr. Bărbulescu were
completed, the employer monitored Mr. Bărbulescu’s Yahoo Messenger account
from the company’s computer and alleged that the applicant, by using the company’s
18 Processing of personal data in the context of employment relationships.
19 See Sandru and Alexe (2018).
20 See the Judgement of ECHR, application no. 61496/08, 12 January 2016.
300
E. Lazar and D. N. Costescu