Can an employer monitor its employees’ E-mail? Pligel Miller

f you receive a fax, you can be sure that before it reached you several people

may have had an opportu- nity to read it on its journey to and from the fax machines at either end or whilst sitting in the in/ out trays. On the other hand if you receive a telephone call, you expect a higher degree of privacy; you don’t normally expect someone to be listening in. The same is true of E- mail. There is an expecta- tion of privacy, particu- larly with regard to internal E-mail. There lies the problem. Employees expect their E-mail to be private, yet sometimes an employer may want to monitor its employees’ E- mail.

Why might an employ- er want to monitor its employees’ E-mail? There are a number of possible

reasons. At one end of the scale the employer may suspect an employee of acting in bad faith or disclosing confidential in- formation. For instance using the E-mail to send or receive pirated soft- ware (perhaps exposing the employer to the risk of virus or copyright in- fringement claims) or of disseminating porno- graphic material. Or the employee may be sending E-mail containing negli- gent misstatements or committing the employer in other ways. E-mail is also a common feature in sexual harassment cases where the E-mail is used by one employee to harass another. In the UK, there is no limit on the damages that can be awarded against an employer for sexual harassment. In the US, in 1995, Chevron Corp. was forced to settle a discrimination case for

$2.2m where the alleged harassment was said to have been conducted by E-mail. Any of these mat- ters could give rise to loss or liability on the part of the employer.

On another level, the employer may simply be concerned that employ- ees are abusing the E-mail by using it unduly for private purposes.

E-mail can be required to be produced in court in the course of legal pro- ceedings. This can be da- maging where E-mail is sent carelessly, perhaps on the assumption that no-one other than the intended recipient would ever see it. For example, one of the Los Angeles police officers charged with assaulting Rodney King sent an E-mail on the LA Police Department system saying “Oops, I haven’t beaten anyone so

Computer Audit Update l May 1997 1x3 1997, $17.00 Elsevier Science Ltd.

bad in a long time”. Even when E-mail is apparently deleted, experts can often recover it for use in litiga- tion. E-mail sent by Oliver North was recovered from back-up tapes which he had tried to erase and was used in the Irangate in- vestigation against him. Attempts to delete E-mail so that they cannot be used in litigation could have serious (potentially criminal) consequences.

An employer, there- fore. has an interest in being able to monitor em- ployee E-mail. But whilst it may be in the interests of an employer to do this, is it legal?

Because there is no right of privacy in the LJK, employees cannot complain on legal grounds that their privacy has been invaded. This is in contrast to the position in the US where the Federal Communications Privac! Act prohibits E-mail snooping without prior consent. But even in the LJS there is an exception allowing employers to monitor employee E-mail involving business-related information where the employer has a legal inter- est. But monitoring E-mail without employee knowl- edge can give rise to industrial relations issues. Moreover, employer mis- use of information discov- ered during the course of E-mail monitoring may give rise to problems. For example, if employers dis- criminate against an em- ployee on the basis of information concerning

the employee’s sexual or- ientation or out-of-work acti\?ties. As happened in a ITS case, an employer may be liable for unfairl! dismissing an employee on discovering from E- mails that the employee worked as a professional stripper.

In most cases, E-mail which employers wish to review is stored on its own system. This will be the case in relation to internal E-mail and cxtcr- nal E-mail that has ah-l-ad) been downloaded. An em- ployer may feel with jus- tification that it has ever? right to review all material stored on its system. in- cluding (perhaps private) E-mail addressed to its staff. There is no need for employers to attempt to intercept external E- mail from the public tele- communications system, which would be illegal.

By advising employees that E-mail may be mon- itored, the employer ben- efits by addressing the issue of employee expec- tation of privacy and may deter misuse or careless use of the E-mail. These factors have led to an increased interest on the part of employers in in- troducing a corporate E- mail policy, although as yet relatively few IJK em- ployers have such a policy.

E-mail monitoring could be a time-consum- ing matter and in most cases periodic monitoring of a sample of E-mail would be sufficient, backed up by an appro-

priate policy making it plain that such monitor- ing ma)- take place.

Any E-mail @ic)- \vill

need to accord with the business and cult urt-’ of the organisation. The- pol- icy will outline the extent. if at all, to which an employee can use thti E- mail (internal and e>.ter- nal) for private LISC. It will forbid E-mail being usccl

for purposes which ma)’ be illegal or with content that may be offensh-e. The policy will make it plain that no cmployec ma!’ access the E-mail of any other emplo),ee unless specially authorised to do so. Importantly. the polic) will explain to emplo~ecs that the E-mail system is there for the business purposes of the employer. Also that all E-mail rnes- sages are cornpan)’ rc- cords and that t h c company’s management may have access to an)’ E-mail without the em- ployee’s permission.

Employees should not assume that E-mail is pri- v&te and should bear in mind that apparentl), dc- leted E-mail may be held on the system for a con- siderable time or be ac- cessible from hack-ups.

lVigel Miller is CI Commercial and IT

Partner at Fos Williams. CJkF

nnd advises on Internet laud urtd online commerce

Computer Audit Update l May 1997 c 1997, $17.00 Elsevier Science Ltd.