YOUR BOSS CAN'T MONITOR YOUR E-MAIL

We all need to make ourselves aware of the implications and take the necessary steps. Be warned people!

'Your boss can't monitor your email'
November 07 2003 at 09:27PM
By Douglas carew

Big Brother shouldn't be watching your email at work. Companies have been warned that getting written consent to monitor staff email and Internet activities may not be enough to escape fines of up to R2-million under the new Regulation of Interception of Communications Act. The act, which was signed by President Thabo Mbeki last December but has yet to become a reality in the workplace, aims to control Big Brother by protecting privacy rights of individuals and imposing penalties on anyone who unlawfully intercepts or monitors a communication.

Capetonian Steve Ferguson, of electronic or e-law specialists NicciFerguson, said this did not mean companies could not monitor such activities but they would have to do so under specific conditions to ensure it was done in a fair and lawful way.

'Employers and employees are in the dark about exactly what the act permits'

Although the act had not yet come into operation, commentators had expressed conflicting views on what it meant for workplace monitoring. "As a result, employers and employees are in the dark about exactly what the act permits," said Ferguson, who has studied the issue of workplace monitoring in relation to comparative practices in the European Union and United States.Section 5 of the act allowed monitoring where one of the parties to the communication had given prior written consent. But Ferguson said companies wanting to protect themselves against criminal or civil liability would have to go further than simply getting written consent."Consent alone does not always justify an invasion of privacy, especially in the context of the employment relationship. Consent cannot be seen as freely given when a staff member feels that failing to co-operate could result in dismissal or being passed over for promotion. "Written consent also only applied to emails written and sent by staff and not to third parties sending emails to staff from outside the company.

'Consent alone does not always justify an invasion of privacy'

Ferguson suggested companies ask their staff to inform friends and other contacts that incoming emails could be monitored. A message to that effect could be placed at the bottom of all outgoing emails. The need to ensure that employees did not make confidential information available to rival companies was just one of the reasons for companies introducing monitoring. Companies could also be held legally liable if offensive material, such as racist jokes, was circulated via company email or by what an employee did on the Internet.

Businesses would also want to make sure staff were not wasting work time on personal emails or surfing the Internet while large attachments, including pornographic photographs and viruses, could slow down or even crash networks and severely affect efficiency. "Any company, regardless of its size, can be plunged into financial ruin as a result of email or internet abuse by its employees." The advantages to monitoring were clear, but Ferguson said it could have a negative effect on the relationship of trust between staff and employer, resulting in a lack of motivation on the part of the employee. Therefore when developing communication policies employers should not think only about protecting business interests and avoiding liability under the new legislation but aim at policies that respected the privacy and dignity of employees.

Transparency was the key and a blanket statement that monitoring could take place would not be sufficient. Companies should detail the method and duration of monitoring, the type of information that would be collected, the reasons for doing so and then outline how the policy would be enforced and the penalties. "Assumed understanding among employees and employers is dangerous and can lead to costly disputes." Personal e-mails could result in much work time being lost but they should only be monitored in exceptional circumstances, such as when a company needed to protect the security and efficient operation of its network.

Ferguson suggested companies either set up a separate Internet email address for staff for personal use, or encourage staff using the company network to indicate on the subject line that the email was personal.Either way, companies could keep track of how much work time was being lost to personal business without having to read email content. "A complete ban on all personal email and Internet activities is unrealistic. Permitting a degree of personal use could make for a more efficient staff." Ferguson said informing staff how email and Internet activities were automatically stored on the computer hard drive would probably go a long way towards reducing levels of abuse.