The one place where it's OK to reveal yourself.

In Smyth vs. Pillsbury, a ground-breaking 1996 court case on employee email privacy, an employee sued the company for invading it. Using his home computer, Michael A. Smyth sent email to a supervisor's work email account at Pillsbury Co. In one message, Smyth said he would "kill the backstabbing bastards" in the sales management staff, and in another, he referred to a company holiday party as the "Jim Jones Kool-Aid affair."

In what critics call a shaky decision, the US District Court for the Eastern District of Pennsylvania ruled that Smyth shouldn't expect privacy on the Pillsbury's email system.

Developing an email privacy policy in the workplace is becoming essential. Electronic privacy policies can save companies major headaches, including lawsuits, sexual harassment claims, and lost trade secrets. The key is to let employees know what the company's doing.

Plan for emergencies
Lawyers specializing in ecommerce recommend that companies using email and the Internet develop easy-to-understand electronic use policies that are regularly communicated to employees. Such a policy can also protect employees by letting them know what's expected and by making them aware of the ripple effects of their email and Internet use.

Although the law on electronic privacy in the workplace is far from settled, Eric Freibrun, an Internet law and intellectual property lawyer from Northbrook, Ill., says Smyth vs. Pillsbury and other cases give employers the right to monitor, at least for now.

"Most people don't realize: When they enter the workplace the First Amendment doesn't apply – they're in an environment controlled by their employer," Freibrun says. "The guidance for employees is that they should not say anything in an email that they would be uncomfortable having anybody else in the company read." Or, anyone outside the company, for that matter.

Companies should have a thorough internal discussion about what they want before implementing an electronic use policy, says Parry Aftab, a New York lawyer specialising in the Internet and electronic communications. One size does not fit all.

Consider your corporate culture. A lot of businesses are uncomfortable monitoring employee email, and at some companies, the employee reaction would be so negative, a monitoring policy would be counterproductive, Aftab says. "If they think you're doing it just to be Big Brother, then you're going to have serious morale problems."

Share reasons for the policy
There are plenty reasons to have a monitoring policy, Aftab says, but make sure you communicate those reasons to the employees. Among those reasons:

1. To protect your trade secrets
   Once an employee starts emailing your company's trade secrets, it's hard to make a case in court that the information is a secret any more. One good idea is to prohibit employees from automatically quoting the email they've received in their outgoing email. That way, someone doesn't accidentally send out proprietary information at the bottom of his email.

2. To insulate yourself from sexual harassment or racial discrimination claims
   A policy prohibiting sexist or racist email not only causes employees to think twice, but may also protect the company in a lawsuit.

3. To guard your company name
   If your company name is in your email address, do you really want people sending dirty jokes half-way across the world?

4. To investigate crimes
   Email and computers in general have been used to harass, to threaten, and to download illegal stuff. A monitoring policy allows your company to investigate such activity.

5. To increase productivity.
   If employees know they're being monitored, they're less likely to send 38 pieces of personal email each day or surf the Web on a Friday afternoon.

Reasons not to monitor
On the other hand, some companies are tempted to stay away from monitoring, just to avoid the headaches, says Joseph Schmitt, a Minneapolis labor and employment lawyer. "We're already starting to see privacy added to generic employment claims," he says. "It's going to cause some employers to think twice before engaging in employee monitoring, but employers can be held liable if they don't monitor, [there are threats,] and violence happens."

Organisations such as the American Civil Liberties Union argue electronic monitoring can smack of Big Brother, making employees feel someone is looking over their shoulders every minute of the day.

Where to start
While people on both sides of the issue disagree on appropriate monitoring methods, most say an electronic use policy helps employees understand the rules.

Once you start working on an electronic use policy, there are several issues to deal with:

Let your employees know what you're doing.
If there's one hard and fast rule, it's this – the easiest way to avoid privacy lawsuits. When you have a policy in place, make sure the employees sign it. A couple of states require employers to get permission before monitoring, and that signed policy statement is their permission. "The danger you get into is when you don't tell anybody anything, and employees are left to figure it out on their own," says Schmitt.

Does the company wants to monitor email and Internet use?
Beyond the debate between employee privacy and protecting your company, there's the issue about how to monitor and who's going to monitor. Aftab recommends against spot checking. If you say you'll monitor and you don't, your company could be liable in sexual harassment and other lawsuits.

Decide whether you want to permit personal use.
There are implications for employee morale, as well as legal ones. Aftab points out a couple of legal issues: Courts have ruled that if you allow one employee to send email about the next Girl Scout gathering, you must also allow an employee to send information about the next union organizing meeting. Allowing personal email also could create an expectation of privacy among employees, which can be used as an argument against you in court.

Consider an electronic purge policy.
You've heard stories of the email everyone thought was deleted coming back to haunt a company. "It's like a cancer, it grows," Aftab says. "You know that everybody will keep a copy of that one email you shouldn't have sent." Most companies that rely heavily on computers have back-up sweeps several times a day. Consider a policy that erases those old tapes every six months. When the subpoena arrives, you can tell the opposing lawyer, "Sorry, that information isn't available."

Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved.
ZDNET is a registered service mark of CBS Interactive. ZDNET Logo is a service mark of CBS Interactive.