· Features

Using personal data in workplace investigations

Recent case law has clarified whether employees can expect personal information used in disciplinary investigations to remain private

Monitoring an employee’s emails and internet usage as part of a workplace investigation could give rise to issues in relation to the right to a private life under Article 8 of the European Convention on Human Rights, data protection rights, and the duties of trust and confidence owed to the employee. A recent European Court of Human Rights (ECHR) decision, Garamukanwa v United Kingdom, considered whether the employer’s reliance on Mr Garamukanwa’s ‘personal’ communications in reaching the decision to dismiss him amounted to a breach of his privacy.

Garamukanwa sent emails in 2012 to his colleague and former partner raising the issue of her new relationship with another colleague. She complained to their employer (Solent Trust) and he was warned that his emails had been inappropriate. Subsequently a number of anonymous malicious emails were sent to a number of employees. A criminal investigation into online bullying took place in 2013 and when police accessed Garamukanwa's personal mobile they found photographs of the bullied employee’s home address and details of the email addresses from which anonymous harassing emails had been sent. The police, acting on legal advice, passed on this evidence to the employer and disciplinary proceedings were commenced.

During the course of the disciplinary hearing, Garamukanwa voluntarily provided the disciplinary panel with ‘personal’ email and WhatsApp messages between him and his former partner/colleague. Solent Trust concluded that it had sufficient evidence that Garamukanwa had harassed and bullied his colleague and dismissed him for gross misconduct. Garamukanwa brought claims for unfair dismissal and a breach of his right to privacy arguing that the Trust had relied on his private and personal material to justify its decision to dismiss him; material he reasonably expected would remain private.

Garamukanwa’s claim for unfair dismissal was dismissed by the tribunals. In considering whether his right to privacy had been breached, the ECHR held that correspondence sent from a workplace email account, or that involves both professional and private matters, does not automatically fall outside the definition of 'private life'. The ECHR decided that Garamukanwa had sufficient prior notice of the harassment allegations made against him in June 2012 and could not therefore have reasonably expected that any material linked with the allegations would remain private thereafter, and his right to a private life had not been breached.

This case turned on the fact that Garamukanwa had been warned a year before the disciplinary proceedings (when the bullied employee had made an initial complaint) so he had no reasonable expectation of privacy in his later communications. Wherever possible, employers should therefore warn employees as early as possible when their behaviour has been inappropriate.

In most cases where an employee has made a complaint of harassment or bullying, however, an employer would conduct an investigation into this serious complaint (rather than dealing with the matter informally as Solent Trust did) before the employee is notified that their behaviour has been considered inappropriate. To avoid the risks of claims:

  • It is important for employers to have an electronic communications policy that sets out when monitoring may take place, for instance to investigate any allegations of harassment and bullying, and this policy should be clearly communicated to employees.
  • Before conducting a review of an employee’s email and internet usage employers should carry out an impact assessment to judge whether the use of the information is a proportionate response to the problem it seeks to address, and whether any less intrusive alternatives are available (and this impact assessment should be documented). Suggestions on how employers could show that such efforts are proportionate include:

-Implementing proper training for those dealing with the information and limiting the number of employees who have access to it; for example to the investigator, members of IT who are conducting the search, and the HR professional who is supporting the investigation.

-Ensuring that only the information really needed is kept and that it is not stored for longer than necessary.

-Using the information obtained only for the purpose it was originally collected i.e. for the purposes of the investigation into bullying or harassment.

Louise Lawrence is a partner and Leah Caprani is a paralegal in the employment team at Winckworth Sherwood