To monitor or not to monitor: the new media question

Businesses could be forced to retain records of e-mails and internet usage for 12 months under new anti-terrorist legislation, announced by the Home Office on Tuesday.

The exact nature of the data to be retained is yet to be announced by the Home Secretary David Blunkett, along with which businesses would be required to retain the records. In light of the impending legislation, businesses should assess their existing e-monitoring practices to ensure that they are legally compliant.

The truth is that the e-mails sent at work are anything but personal - they belong to the employer and perhaps now the government. People look on e-mail as a very transient, free form of communication even though once deleted from a PC they can still be recovered from the company's servers.

E-mail therefore has the same permanence as any other written form of communication, and as such needs the same amount of care. E-mails are legally binding documents that can be used as evidence in courts.

The Regulation of Investigatory Powers Act (RIP), tabled at the end of last year is due to come into force on October 24th. This will allow businesses to intercept telecommunications such as telephone calls and e-mails on their own systems without the consent of their employees.

Diane Sinclair, employee relations advisor at the Chartered Institute of Personnel and Development explains: All businesses must have a policy, and let the staff know what the consequences will be if they break it.

The Regulations place a requirement on business to 'make all reasonable efforts' to inform the users of their systems that interceptions might take place. What amounts to 'reasonable' however, is a vexed issue. In the context of the workplace, simply publishing a computer policy or another notice that is readily accessible to employees may be enough.

Sue Nickson, national head of employment law at Hammond Suddards Edge says: RIP gives employers the right to monitor e-mail without the consent of their employees. However, the Lawful Business Practice does require their consent, and this can be very confusing. Still, that is no excuse for not addressing the issue.

The Lawful Business Practice regarding the Interception of Communications drawn up in October last year by the Data Protection Committee is intended to give simple guidelines to employers on how to handle the RIP. It is also meant to take into consideration the translation of the European Convention on Human Rights into UK domestic law. Article 8(1) of the Convention states that 'everyone has a right to respect for his private life and family life, his home and his correspondence.'

However, as Sue Nickson explains there are many incongruities: The RIP has a long list of what measures are allowed. However, the Data Protection guidelines are much more restrictive, stating that an employer can only monitor if they think that e-mail is being abused.

For the moment there is no uniform way of reconciling the differences between RIP and the Human Rights Act. We will have to wait for it to be litigated through the courts to see if the Act overrides, she adds.

The key for all concerned is making sure that there is a regularly updated computer and telecommunications policy, making it clear that communications may be monitored under some circumstances. Precisely what these circumstances are should be set out clearly, as should the legal consequences of breaching the company's policy.

Monitoring programs can identify words and selected phrases that may have a sexual connotation. Other businesses may carry out random checks, for instance when an employee hands in his or her resignation to see whether any confidential information has been leaked.

Although in Tuesday's announcement the government stated that it would work with industry on a code of practice - putting policies into place now is of crucial importance. Sue Nickson explains: Problems will arise where there are no proper procedures in place. People are now rushing to get policies in place. Most are running them past lawyers to make sure that they are as water tight as possible. E-mail took employers by surprise, and basic monitoring is simply implementing a policy that all the staff are aware of.