1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192 
Big brother shouldn't be watching you
Page 38
Page 39
If you've noticed an error in this article please click here to report it so we can fix it.
The employer may be paying for the equipment, but employees still have the right to privacy when using the internet, e-mail or telephone at work.
Aonghus Martin reports.
Arecent case in the European Court of Human Rights should act as a sharp reminder to employers of what happens when employee monitoring goes wrong: the UK government was ordered to pay £3,000 in damages and 16.000 in legal costs when a Welsh college unlawfully monitored the internet, telephone and e-mail use of an employee in 1999.
The decision is a reminder that employees' telephone calls, e-mails and internet usage are afforded protection under human rights legislation and that employers must tread carefully when monitoring employee usage of its communication systems. Simply informing employees that monitoring is taking place does not allow carte blanche monitoring.
Employee monitoring is a minefield for employers. Below are some hints and tips on what employers should and should not do in relation to employee monitoring. Note that these hints and tips are based on a communications policy that permits limited personal telephone, e-mail and internet use.
Have a clear policy An employer's communications policy should stipulate the exact level of permitted personal use and possible consequences for failure to comply All existing and new employees should be made aware of and sign up to this policy prior to accessing any communication systems.
Remind employees An employer should regularly remind its employees of the communications policy by sending updates via e-mail, the intranet or newsletters and if necessary provide training on correct e-mail. internet and telephone use.
Deal with blogs More and more employees now have personal blogs or websites.These are a potential minefield of liability for employers. Therefore, the communications policy should clearly address personal blogs and websites, eg by prohibiting the updating of personal blogs at work, due to the risk of the employer being associated with the blog.
Comply with the DPA In order to comply with the Data Protection Act (DPA),an employer should: • ensure that its communications policy is comprehensive and covers the nature, extent and reasons for the monitoring that is taking place • ensure that employees are informed when information is being obtained, how it will be used and to whom it will be disclosed — and not use the information collected for any other purpose (unless the information could not be ignored, eg criminal activity) • conduct an impact assessment prior to monitoring An Employment Practices Code has been published by the Information Commissioner. This recommends that employers must ensure any monitoringis reasonable and proportionate and that employers should undertake an impact assessment prior to introducing a communications policy.The impact assessment need not be detailed — it could simply be a mental evaluation. However a written record would be useful if a complaint arose.
Comply with the LBPR
The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (LBPR) were introduced to provide a statutory framework whereby employers could lawfully monitor communications on their own communications systems provided the monitoring fell under one of the lawful purposes set out in the LBPR.These are: • to establish the existence of facts • to ascertain compliance with internal and external practices and policies • to ensure the system is operating effectively • to protect national security or detect/ prevent crime • confidential counselling • to detect unauthorised use of the system • to determine whether the communications are relevant to the business
Take care with CCTV Part 3 of the Employment Practices Code deals with the use of CCTV in the workplace. If CCTV is used in the workplace or surrounding buildings, employers should ensure there are clear signs stating the nature,extent and reasons for any CCTV monitoring. Covertly monitoring employees inside or outside the workplace (eg by using hidden CCTV cameras) will amount to a breach of the Human Rights Act 1998, unless serious criminal activity malpractice is suspected.
Do not view personal items
IL is generally recognised that the LBPR. does not permit the monitoring of non-businessrelated communications, except initially to ascertain whether the communications are business-related. As an employer you should not view communications that are clearly marked as "personal" in the subject heading or are filed in a folder marked "personal-.
Inform third parties
Any business that wishes to monitor its communications under the LBPR must make reasonable efforts to inform every person, including third parties, who may use the system, that communications may be monitored.
Time to update?
Introducing an updated policy presents an ideal opportunity to re-educate the workforce that the company's communications system is first and foremost for business use and that employees must use the company's communication systems responsibly so as not to harm or hinder the company in any way. • Aonghus Martin is a solicitor in the technology group of international law firm Eversheds LLP