The right to privacy (Art. 8 ECHR) as a limit on internal investigations
Commentary on the Judgment of the European Court of Human Rights of 6 November 2025, Guyvan v. Ukraine
In the recent judgment of the European Court of Human Rights (ECHR) of 6 November 2025, the Fifth Section of the Court unanimously concluded that there had been a violation of the right to private life (Article 8 of the ECHR) of an employee who was the subject of an internal investigation conducted by his employer.
The following is a summary of the facts and legal reasoning of the Chamber.
Facts:
Mr Guyvan, an employee of company P, had a mobile phone and a landline number that he used for work and personal purposes since 2002.
In 2003, the company signed a contract with the telephone operator for the provision of telecommunications services, including those for the line used by employee Mr Guyvan.
In accordance with the company’s internal guidelines, the company covered mobile phone expenses incurred in the course of work, up to a limit of thirty (30) euros per month. International roaming charges were only covered if the employee had to travel for work.
In February 2015, the company launched an internal investigation because Mr Guyvan’s telephone bills showed charges for international roaming services during periods when, according to internal records, the employee had been present at his workplace.
As part of the investigation, company P. requested detailed information from the telephone operator on the relevant calls and the countries in which roaming services had been used between 1 January 2014 and 31 January 2015 in relation to the telephone line used by the employee, Mr Guyvan.
The telephone operator provided the requested information, which included the following:
- The date and time of the communication.
- Whether the call was incoming or outgoing.
- The foreign operator used for roaming services.
- The country in which roaming services were used.
- The telephone number with which the employee’s number communicated on each occasion.
- The type of communication made: call, text message, etc.
- The duration of the communication.
In September 2015, Mr Guyvan filed a complaint before the competent judicial authority in Ukraine, stating that his employer had been collecting his personal data and denying him access to it, in violation of current data protection regulations. The claimant requested that the Ukrainian judicial authorities declare the company’s actions illegal and order it to hand over the information received from the telephone operator.
Mr Guyvan’s claim was dismissed at all levels, until the court decision became final. The reasoning was that the telephone number used by the employee belonged to company P, so the employer had the right to request and obtain detailed information about the service contracted with the operator. As for the purpose of the information obtained, the judicial authorities emphasised that it was to verify the employee’s presence at his workplace and the effective provision of his services during his working hours, not whether the employee had paid for international roaming services used for private purposes, whether he had been on holiday or with whom he had communicated.
On 6 November 2025, Section 5 of the European Court of Human Rights unanimously ruled that the facts described violated Mr Guyvan’s right to privacy (Art. 8 ECHR).
Legal reasoning:
The Court starts from the premise that the request, obtaining and processing of the telephone communications data of the employee Mr Guyvan between 1 January 2014 and 31 January 2015 by his employer constitutes an infringement of his right to privacy, recognised in Article 8 of the ECHR.
The Court does not consider that this infringement is automatically incompatible with the right to privacy provided for in Article 8 of the ECHR, as it admits that, in view of the company’s internal instructions regarding the use of mobile phone lines, the employer was entitled to obtain information from the telephone operator in order to verify whether the calls made by the employee were work-related or not.
However, it can also be inferred from the company’s internal instructions that personal use of the mobile phone line was anticipated and permitted, without prejudice to the employee having to pay the company for such private use. Therefore, in the Court’s opinion, the company’s monitoring measure in question had to be subjected to the proportionality test established by the Grand Chamber in its judgment in the case of Bărbulescu v. Romania (Judgment of 5/9/2017, application no. 61496/08, §§ 121-22), as the information requested from the telephone operator in the context of the internal investigation went beyond what was strictly necessary to verify the work-related nature of the calls, in addition to revealing aspects of the employee’s personal life (country from which the communications were made or received; identification of the numbers with which there was interaction) that were also not necessary to determine whether the employee had fulfilled his duty to attend his workplace.
According to the Strasbourg Court, the Ukrainian judicial authorities did not carry out the slightest analysis in this regard, rejecting outright Mr Guyvan’s expectations of privacy because the telephone line was owned by the company, considering that the measure fell within the legitimate exercise of the right of corporate control.
Therefore, Section 5 of the ECHR unanimously concluded that in the case described, there had been a violation of Mr Guyvan’s right to privacy (Art. 8 ECHR).
Comment:
The Court ruled in favour of the violation of the conventional right to privacy (Art. 8 ECHR) due to a formal defect in the decisions handed down by the Ukrainian national authorities: the lack of adequate reasoning in their decisions.
In fact, in this case, the Fifth Section of the ECHR does not address the substance of the issue, namely the proportionality of the control measure adopted by the employer. Moreover, it starts from the premise that the employer was entitled to collect information on the employee’s telephone communications in order to verify that the calls were related to the performance of his work duties.
What the Court criticises is that the national authorities did not subject the case to the proportionality test established in the case of Bărbulescu v. Romania (Judgment of 5/9/2017, application no. 61496/08, §§ 121-22). However, in its considerations, the Chamber slips in its own assessment of the proportionality test: some of the information requested and collected by the employer from the telephone operator was unnecessary for the purpose pursued (verifying the employee’s attendance at work), however legitimate that purpose may have been.
With this statement, it is difficult to conclude that, in this specific case, the control measure adopted by the employer was proportionate, as it would have violated a basic principle of the test: that of necessity.
What implications the declaration of violation of the worker’s right to privacy may have in the criminal proceedings which, according to the judgment in question, were initiated as a result of the actions taken by the company, is another matter entirely.