One of the hot issues in employment law at the moment is the balance between an employer's desire/need to monitor the use its employees make of its telephone, e-mail and internet equipment with employees' rights pursuant to an employer's duty of trust and confidence and employees' potential privacy rights, particularly now the Human Rights Act 1998 has come into force.
Difficulties in balancing rights are compounded by the variety of different measures recently introduced (or awaited) affecting employee privacy. For example, in relation to e-mail monitoring in particular, measures for the protection of employees’ privacy include, the Human Rights Act 1998, the Regulation of Investigatory Powers Act 2000, The Telecommunication (Lawful Business Practice) (Interception of Communications) Regulations 2000, the draft Code of Practice on the Use of Personal Data in Employer/Employee Relationships 2000 and last but not least the implied term of trust and confidence in all employment contracts.
The Human Rights Act ("HRA")
The HRA incorporates the European Convention on Human Rights into UK domestic law; Article 8(1) of the Convention provides that "everyone has a right to respect for his private life and family life, his home and his correspondence".
- application of HRA
- UK courts and tribunals required to interpret UK law in accordance with the Convention.
Regulation of Investigatory Powers Act (“RIP Act”)
The Government has also attempted to prescribe where the balance should lie on this issue in the form of the RIP Act. The Act applies to persons who intercept communications, and therefore to employers who monitor their employees' telephone and e-mail use.
- purpose of RIP Act
The Regulations
The Regulations came into force on 24th October 2000. They authorise the interception of communications without consent (if the interception is by the employer, or with the express or implied permission of that employer) in connection with the employer’s business and using that business's own telecommunications system in certain circumstances.
- Practical issues
In practice this means that employers will be able to monitor e-mails for quality control purposes to ensure that their staff are providing a proper service for example if they advise clients by e-mail. In addition, employers will, it seems, be able to monitor e-mails to ensure that an employee is complying with company policies on e-mail use. Employers may be able to access e-mails where employee conduct is an issue either to check that time at work is being spent properly or to gather evidence of facts (for example where bullying or harassment may be an issue).
The Code of Practice on the Use of Personal Data in Employer/Employee Relationships 2000 ("the Code of Practice")
The Data Protection Commissioner is currently developing a Code of Practice. A somewhat draconian draft was published on 9th October 2000. The Code of Practice was subject to a consultation period which closed on Friday 5th January 2001. The Code of Practice will address the impact of the Data Protection Act 1998 on the monitoring by employers of telephone calls, e-mails and internet access involving their employees. The Commissioner intends that the Code of Practice will take account of the Regulations and address their inter-relation with data protection requirements. The odds are the draft will be toned down in the interests of workability.
- Format of Code
- Content of Code
- The Data Protection Principles
- interaction with Regulations
Conclusion
Although the monitoring of e-mails is very much a hot topic at present, the recently revised Regulations mean that employers will now have a fairly free reign to intercept communications made by their employees provided they behave reasonably. However, employers could be vulnerable in other ways. The Human Rights Act and any new Code of Practice mean that there is an increased risk that unless an employer is cautious in its monitoring it may face legal challenges. Employers should therefore take practical steps to safeguard themselves. As a minimum, employers should ensure that there is a reasonable objective justification for the monitoring of e-mails and that the employees are informed that there is a possibility that their communications may be monitored.
For further information, please contact John Armstrong by e-mail at john.armstrong@cms-cmck.com or by telephone on +44 (0)20 7367 2701.
