Negotiating the monitoring minefield
- Page 2
|
|
In some contexts, eg. financial services, monitoring is required to comply with industry specific regulations, but in most other sectors, the question whether to monitor will be answered by business-driven priorities balanced against the interests of staff and customers. Potential reasons for monitoring include:
· Protection of employees, eg. from injury or assault at work or allegations from customers or fellow staff members.
· Preventing employees from committing criminal offences. The possession (by downloading) of child or extreme pornography is an offence under the Obscene Publications Act 1959 or the Protection of Children Act 1978.
· Ensuring internet and email are not used for undesirable purposes. Firms may make downloading legal pornography a dismissible offence and require evidence for the purposes of enforcing dismissal.
· Ensuring levels of permitted personal internet and email use are kept to a reasonable minimum.
· Avoiding liability for defamation by employees making statements about suppliers or customers to colleagues or others by email.
· Avoiding liability for discrimination or harassment (on grounds of sex, race, sexual orientation, religion or philosophical belief) of colleagues or third parties via emails or by downloading pornography. An employer who failed to stop a workplace culture of obscenity fuelled by pornography has been held vicariously liable for sexual harassment to a woman worker by an employment tribunal.
· Ensuring integrity of firm’s contract making. Emails are as effective as “hard copy” letters in committing the firm to a binding legal contract or changing the terms of an existing contract. They are also far easier to write and send without reflection or taking a second opinion. Employers should remind staff of this and include it in email use policy. Disclaimers on emails and in company standard form contracts are also helpful here.
· Avoiding liability for breach of copyright. An employer who permits staff to download music mp3s or films from peer-to-peer websites such as Kazoo and Limewire may be liable for damages to the owners of the copyright for failing to prevent illegal downloads. The willingness of the BPI, the record industry body, to pursue major uploaders in the courts is a timely warning to large employers whose servers might unwittingly be used to download large amounts of bootleg material.
Adverse impact
This includes the intrusion on monitored employees, access of staff to data obtained and the effect on the trust relationship between employer and employee.
Alternatives to monitoring
Would management that was “closer” to employees, with better supervision, training and communication obviate the need to monitor? Or could monitoring be restricted to cases where there is a need to monitor, for instance because of wrongdoing by staff.
Obligations from monitoring
These include notifying staff of monitoring, how data is kept secure and how the firm will meet its obligation to supply copies of data to staff who request it.
Monitoring of emails and telephone calls are subject to the RIPA which, together with the LBPR, makes it unlawful to monitor without the consent of both communicating parties or by satisfying one of the lawful business practice exemptions. Thankfully, these are widely drawn and will justify most monitoring purposes, provided they are relevant to the firm’s business. It is lawful to monitor without consent:-
· to prevent or detect crime eg. threatening callers
· to establish the existence of facts eg. for insurance policies
· to investigate or detect the unauthorised use of telecommunications systems eg. ensuring employees do not breach email use policy
· to ensure the effective operation of the system eg. to check for viruses
· to ascertain whether standards by persons using the system are being met eg. for quality control or staff training purposes.
Where emails or telephone calls are intercepted the employer must endeavour to inform those affected, usually by a recorded announcement or email notice.
The Halford case, mentioned above, was based on the European Convention for the Protection of Human Rights. Article 8(1) provides that: 'Everyone has the right to respect for his private and family life, his home and his correspondence.' The Human Rights Act 1998 incorporates the Convention into UK national law. The Court held that Mrs. Halford’s privacy had been breached because she had not been informed of the phone tap. In the light of the judgment, employers are best advised to cast as widely as possible the monitoring that may occur. So, to inform employees that in order to ensure only authorised use of company technology all emails and internet use may be monitored, including inspection of internet cache access and files saved in password-protected folders.
Data obtained from monitoring may be subject to the DPA. Generally employees should be informed of the purposes data will be put to and who will be able to access them. Data, under the DPA, is any information by which an individual (the data subject) may be identified. So, for example, emails that contain an employee’s email address or name are “data”.
To lawfully gather and process data an employer must satisfy one of three conditions. Either by obtaining the agreement or consent of the employee, by showing that gathering and processing the data is “necessary” for the performance of the contract of employment or that it is in the vital interests of the employee since one of the statutory exemptions apply (eg. the prevention of crime.)
Employers should err on the safe side by seeking agreement to a detailed monitoring policy that is either agreed to directly by staff or is incorporated by reference into each employee’s contract of employment.
There is a mismatch between the wide scope for monitoring for legitimate business purposes by employers under the LBP Regulations and the IC’s more restrictive guidance on monitoring under the DPA, based upon notions of proportionality and human rights. This conflict is unlikely to be resolved soon and further underlines the benefits to employers of implementing a monitoring policy.
