The European Court of Human Rights has issued a major ruling upholding workplace privacy, capping a decade-long struggle by a Romanian man to challenge his dismissal for using his employer’s internet connection for personal reasons.
The court’s grand chamber ruled that Bogdan Mihai Bărbulescu had been let down by the Romanian courts, which didn’t properly look into the privacy implications of his firing. It said the right to privacy continues to exist in the workplace, whatever the employer says.
“As the boundaries of work and private life become even more vague, particularly with the rise of the so-called gig economy and the exploitation of the personal data of individuals working for such companies, this judgement offers some important protections to employee’s right to privacy,” commented Tomaso Falchetta, policy chief at the activist organization Privacy International, after Tuesday’s ruling.
Bărbulescu was working in a sales position for a Bucharest company in 2007 when his employer told him his Yahoo Messenger communications had been monitored. The employer showed him 45 pages of his conversations with his brother and his fiancée, and fired him for breaking workplace rules.
The employer had previously sacked another employee for using workplace resources such as the internet for personal use, and had told all its workers about this dismissal in a notice. When Bărbulescu tried to challenge his firing in the Romanian courts, they ruled against him on the basis that he and his colleagues had been warned.
Get Data Sheet, Fortune’s technology newsletter.
In 2016, the European Court of Human Rights also ruled against him. However, he appealed to the court’s Grand Chamber and on Tuesday it ruled in his favor.
“The court concluded that the national authorities had not adequately protected Mr Bărbulescu’s right to respect for his private life and correspondence and that they had consequently failed to strike a fair balance between the interests at stake,” the Grand Chamber said in a statement.
For that reason, Bărbulescu’s fundamental rights had been violated—in particular, his right to privacy of correspondence, as set out in article 8 of the European Convention on Human Rights.
The court did not say Bărbulescu had a reasonable expectation to privacy at work, given his former employer’s strict rules, but it did say that “an employer’s instructions could not reduce private social life in the workplace to zero.” It said the previous courts should have looked into the scope of the invasive monitoring and its proportionality.
“The right to respect for private life and for the privacy of correspondence continued to exist, even if these might be restricted in so far as necessary,” the court added.
