A number of laws have just been introduced affecting the way firms can monitor staff email, but the extent to which companies have the right to snoop remains unclear.
A study by the University of California has shown that four trillion emails are sent per day in the US. Given such volumes, it is little wonder that firms increasingly want to keep track of the messages sent using their systems to ensure that business resources are not wasted.
The need to monitor emails has been generally accepted by industry, government and interest groups, as firms look to safeguard their reputation by ensuring inappropriate emails are not sent, and that con- fidential information does not leave the organisation. Recent legislation, too, has brought the issue of monitoring staff email into the spotlight. But confusion surrounds what constitutes acceptable practice, and what may be a breach of the law.
In its original form, the Regulation of Investigatory Powers (RIP) Act contained legislation that prevented firms from monitoring any communications on their networks without the consent of those being monitored. However, the government decided this arrangement was too restrictive on business. So the Department of Trade and Industry (DTI) introduced Lawful Business Practice Regulations last month to amend the Act. They give firms the right to monitor all communications without consent if they inform employees that monitoring may be taking place.
The idea that any internal communication could be monitored was contentious so the DTI quickly noted that firms monitoring communication must comply with the Data Protection Act (DPA). Accordingly, the Data Protection Commissioner (DPC) has produced draft regulations, informing firms how the DPA would apply to monitoring.
Unfortunately, the regulations proposed by the DPC appear to be at odds with the Lawful Business Practice regulations. David Smith, the assistant data protection commissioner, commented, 'We suggest managers don't just monitor when they choose to, but when there is evidence that suggests that there is a problem.' Smith also said that, under the DPC's proposals, monitoring would be regarded as acceptable only when the level of monitoring was proportional to the benefits that a 'reasonable employer' would derive from it. This conflicts with the DTI's stance that any monitoring is acceptable providing employees are warned.
Most observers accept that businesses may need to monitor emails, but there is some disagreement about how much monitoring should be allowed. According to Sarah Veale, the TUC's senior employment rights officer, the regulations are well-intentioned, but the confusion surrounding the issues may mean that the only way to gain clarity is through the courts. Veale also believes that the DTI regulations could fall foul of the Human Rights Act, which stipulates the individual's right to privacy in the workplace.
Jon Fell, partner at law firm Masons, told IT Week that the clause in the DPC proposals that monitoring should be proportional to the benefit it brings to an employer stems from the Human Rights Act. 'The Human Rights Act provides individuals with the right to privacy. The concept of proportionality provides a balance between this right, and the necessity for firms to monitor email,' he said.
Fell added that case law may be the only way to determine the appropriate level of monitoring. If the DPC's draft regulations are introduced as they stand, the definition of 'reasonable' could only be resolved through the courts, he said. In the meantime, Fell said firms should introduce policies governing email use, and inform staff.
The answer is to encrypt all your emails. PGP does a good job here. And its virtually uncrackable.
What if you send audio via email? In most countries there are pretty strict restrictions on wiretapping!