Developing a Policy to Monitor Employee E-Mail, Voice Mail, And Internet Use
By |
The use of e-mail in the workplace is growing at an exponential rate, with an estimated 20 million users sending approximately 60 billion messages annually. Some speculate that the rate will double by the turn of the century. Studies suggest that 90 percent of all companies with over 1,000 employees regularly use e-mail in their daily activities. Voice mail is used as extensively as e-mail, and usage of the Internet is growing rapidly.
Why Monitor?
While most employers have found that e-mail, voice mail, and the Internet increase worker efficiency and productivity, some employees have subjected their employers to potential liability for sexual and other forms of harassment by transmitting offensive e-mail and voice mail messages or circulating obscene materials downloaded from the Internet. Employers in these cases face liability for failure to monitor their communication systems and cleanse them of inappropriate messages and materials, as well as for failure to discipline the responsible employees.
In addition, employers may need to review employee communications in connection with investigations of possible misconduct. Also, companies that work with sensitive data may fear that careless or disloyal employees will disclose such information to competitors. Monitoring will help employers discover and avoid such occurrences.
Employee Protections
Under some circumstances, monitoring of communications can result in violation of the Electronic Communications Privacy Act (ECPA), which prohibits interception and disclosure of electronic communications in transit, as well as those found in electronic storage. The statute provides two exceptions employers can use to avoid liability: (1) the consent exception; and (2) the business extension exception. Under the consent exception, monitoring an electronic communication is lawful as long as one of the parties to the communication has consented to being monitored. Consent may be implied where an employer issues a clearly written monitoring policy, and effectively communicates the policy to all its employees. The business extension exception allows monitoring of employee e-mail if the employer establishes a business-related reason for such monitoring.
Improper monitoring of communications could also lead to invasion of employee privacy claims. Here again, a clearly written monitoring policy, communicated to employees and consistently followed, would give the employer a strong defense to employee privacy complaints.
Policy Development
Before monitoring employee use of e-mail, voice mail, and the Internet, we recommend that employers develop policies regulating employee use of these systems, and informing employees that their communications will be monitored for business purposes. We recommend that monitoring policies include the following statements:
- E-mail, voice mail, and the Internet should be used only for business purposes.
- The employer will monitor e-mail and voice mail messages and Internet use, and may disclose the content of e-mail and voice mail messages, even after they have been deleted, when, in the employer's sole discretion, there is a business need to do so.
- Occasional personal use is permitted, but the employer reserves the right to monitor personal use to the same extent that it monitors business use.
- The employer's communication systems should not be used to set up or run a personal business, transmit offensive, derogatory, obscene, or illegal materials, or download such material from the Internet. Violation of this rule is grounds for termination.
- Employees should not expect that e-mail or voice mail messages, even those marked as personal or accessed by a personal I.D., are private or confidential.
- Employees should exercise the same restraint and caution in drafting and transmitting e-mail messages as when writing a formal memorandum on company letterhead. Users should assume that messages will be saved and reviewed by someone other than the original addressee.
- If the employer does not use encryption devices or protective software, employees should not communicate company trade secrets and confidential information via e-mail.
- Use by employees of the employer's communication systems constitutes consent to monitoring.
- Continued use of the systems is conditioned on acceptance of and strict adherence to the employer's policy, and failure to adhere to the policy's requirements may result in discipline or dismissal.
Enforcement Guidelines
In addition to developing a monitoring policy, employers should consistently enforce their policies. Employers should take the following enforcement steps:
- Announce implementation of the policy with an e-mail or memo to employees explaining why the policy has been adopted.
- Charge only a select group of employees with monitoring responsibilities to ensure that monitoring is consistent and carried out according to guidelines. Only a high-level manager or human resources professional should be authorized to approve even minor departures from the monitoring policy.
- Implement a uniform system for periodic deletion of all e-mail and voice mail messages and back-up copies. (But note that employers have a legal obligation to retain any messages discoverable in litigation that has commenced or is reasonably anticipated.)
In summary, we recommend that in developing e-mail, voice mail, and Internet policies, employers should strike a balance between their right to control and monitor their communications systems and their employees' right to privacy. Should you have questions about developing a policy to monitor employee communications, please feel free to contact us. Thank you.
© 1998 Duff, White & Turner, LLC