Monitoring in the workplace: can employers read employees’ emails?
A recent European Court ruling has held that a Romanian employee’s right to privacy was breached when his employer monitored his email account.
Mr B set up a Yahoo Messenger account at his employer’s request to deal with client enquiries. The Company’s policies prohibited any personal use of its IT equipment. The Company monitored Mr B’s email communications and considered that he had used the account for personal purposes in breach of their policies. He stated that he had only used the account for professional purposes. The employer then produced a transcript of his Messenger communications which included the text of messages that Mr B had exchanged with his brother and his fiancée, containing intimate personal information.
Mr B was dismissed and brought a claim in the Romanian courts to challenge his dismissal which was unsuccessful. He then brought a claim in the European Court of Human Rights (ECHR) arguing that there had been a breach of his right to privacy under the European Convention on Human Rights. His claim was initially unsuccessful, but on appeal the Grand Chamber of the ECHR held found that there had been a breach of Mr B’s right to respect for his private life and correspondence. Although Mr B had been informed of the prohibition on personal use of the equipment, he was not told in advance of the nature and extent of the monitoring, or the possibility that the employer might have access to the actual content of his communications.
In the UK, the issue of monitoring employees’ emails is regulated by legislation including the Data Protection Act 1998 and the Regulation of Investigatory Powers Act 2000. These pieces of legislation place limits on an employer’s power to monitor their employees’ private communications. An employer that does not provide information to its employees about the method by which it monitors its communications systems, the information it collects and how that information will be processed may be in breach of its obligations.
Employers should also be aware of the Employment Practices Code, issued by the Information Commissioner. The Code recommends that before monitoring communications, employers should carry out an impact assessment to demonstrate that they have achieved the correct balance between protecting workers’ privacy and the interests of the business. This assessment could include, for example, identifying the purpose behind the monitoring and the benefits likely to be delivered, any likely adverse impact of the monitoring, whether there are any alternatives to monitoring or different, less intrusive, ways in which it might be carried out and deciding whether monitoring is justified.
One of the core principles of the Code is that for monitoring to be justified, it must be proportionate. This requires an employer to consider whether its reason for carrying out the monitoring is sufficient to justify an intrusion into an employee’s private life; and whether the method of monitoring is proportionate to meet that need. The Code also states that employees should be given information if monitoring is to take place, which should give the employee an understanding of the circumstances in which monitoring may take place, the nature of the monitoring, how information obtained through monitoring will be used and the safeguards in place for the employees subject to the monitoring. Simply telling an employee that their emails may be monitored is unlikely to be sufficient.
Employers should also take into account the duty of trust and confidence that is implied into an employee’s contract of employment. Monitoring an employee’s email and internet use could place the employer in breach of this duty and lead to a claim of constructive dismissal.
Comment
Employers who wish to monitor employees’ emails and internet use should make their employees explicitly aware of it. Email and internet policies should be reviewed and an impact assessment carried out before any monitoring takes place. Although there is often tension between the right to privacy and an employer’s business interests, employees have an expectation of privacy which extends into the workplace and this cannot be totally eliminated.
22 September 2017
©2017 SCRASE LAW LTD. THIS POST IS FOR GENERAL INFORMATION ONLY AND IS NOT ADVICE. YOU ARE RECOMMENDED TO SEEK COMPETENT PROFESSIONAL ADVICE BEFORE TAKING ANY ACTION ON THE BASIS OF THIS POST.
