The Issue

Using Internet and e-mail facilities for personal use at work costs businesses in the UK nearly £10 billion each year! Coming from another angle, over 60% of personal on-line shopping is conducted at work.

The abuse of Internet and e-mail use not only costs money but also slows down production. In reality, it is a case of theft.

However, the material that is distributed via e-mail and downloaded from the Internet by employees can land the employer in court, in addition to damaging the reputation of the company.

Some offences are liable to warnings where other offences, such as downloading offensive material (i.e. pornography) and distributing e-mails that could be classed as harassment, are cases for immediate dismissal.

It has therefore come to no surprise why there has been a sudden demand from employers for law to give them a chance to monitor how their employees use communications at work.

Many disputes have arisen about how far an employer can (and should be able to) monitor the use of communications by an employee at work. An employer will see it as an attempt to ensure business efficiency, where an employee may see it as an invasion of privacy.

Creating an Acceptable Use Policy (AUP)

It is essential that you create an AUP policy stating how employees are expected to use business communications. This will inform your employees about when (if at all) they may use business communications for personal use. If you intend to monitor e-mails and telephone calls (regularly or occasionally) you should also make employees aware of the fact. You should also inform the employees that their e-mails may be looked at during periods of absence to continue the operations of the business.

This policy should be made aware to all employees and in turn, should be agreed to by all employees.

The policy will give you support for your actions should an employee violate the policy. If you dismiss an employee without a policy, you could be sued on the grounds of unfair dismissal.

Protecting Monitored Data

If you record any monitored data (i.e. phone calls) you must comply with the principles of the Data Protection Act.

E-mails

An employer can read business related e-mails addressed to an employee, however, they cannot read their personal e-mails with respect to their rights for privacy which extends from their private life to the work place.

If an employee is away 'ill' or on holiday, an employer still has the right to look at their business related e-mails to attend to any business matters (as stated by the policy).

If an employer opens a personal e-mail (believing it was a business related e-mail), they should immediately close the e-mail without reading on.

• Regulations have suggested that you should:
• Initially monitor e-mail 'traffic' as opposed to 'content'
• Monitor at regular intervals as opposed to constant monitoring
• Monitor only those employees that you consider a high risk
• Automate as much of the monitoring as possible (using specialist software)

Telephone Calls

If the employer does not provide a policy then they must inform an employee prior to monitoring their telephone calls with an 'acceptable' reason. By doing so, the employer has the legal right to monitor the call if the employee agrees. If an employer fails to inform the employee prior to monitoring, they have breached the employee's right to privacy.

It is more practical to log the telephone calls of employees as opposed to personally listening in on calls (this can be very nerve-racking for employees therefore causing them to make more mistakes). This way, you can identify where the phone call was made to and for how long instead of invading employee privacy.

You should set up a telephone line that is never monitored so that employees can make personal calls if required (with your permission).

Internet

You should inform your employees that they should never delete the 'history' and 'temporary' files on their internet options.

However, it is more practical and less privacy invading if you monitor the time that individual employees spend using the Internet, before you personally look through the history and temporary files under suspicion.

You should further inform employees, how long records of visited web sites will be kept/stored on their computer (should this be for, say, a week, or as long as a year).

CC-TV Recording

If you intend to use TV recording around the workplace, you should only use it where there is no or little risk of invading employee privacy. Such monitoring should be made aware of to all employees and visitors to the premises, with justification of its use.

Vehicle Monitoring

If you provide business vehicles, you can buy technology that records information such as distance travelled and visited locations. However, if you allow business vehicles to be used for private use, you should disable the technology when the vehicle is being used for such private use (with your permission).

Monitoring Without Consent of the Employees

There are certain cases where an employee does not need the consent of the employee to monitor communication use. This is when an employer is monitoring for:

• Any unauthorised use of communications i.e. violating company rules and policies
• Effective operation of the communication systems i.e. viruses and maintenance
• Quality control i.e. if the employees are following set procedures
• Evidence of business transactions
• Criminal activity

Nevertheless, regulations say that you should at least inform staff of your intentions to monitor.

Using Monitoring Software

Monitoring software is widely available and can be the more efficient approach to monitoring employee use of the Internet and e-mail at work. The software can minimise the chances of you violating employee rights to privacy compared to manually monitoring communications.

Governing Bodies

The following laws all contribute legislation to the above:

• The Regulation of Investigatory Powers Act (2000)
• The Data Protection Act (1998)
• The Human Rights Act (1998)
• The Telecommunications (Lawful Business Practise) (Interception of Communications) Regulations (2000)
• The Freedom of Information Act (2000)