New rules on monitoring telephone, e-mail and internet equipment
One of the hot issues in employment law at the moment is the balance between an employer's desire/need to monitor the use its employees make of its telephone, e-mail and internet equipment with employees' rights pursuant to an employer's duty of trust and confidence and employees' potential privacy rights, particularly once the Human Rights Act 1998 ("HRA") comes into force on 2nd October 2000.
The HRA incorporates the European Convention on Human Rights into UK domestic law; Article 8(1) of the Convention provides that "everyone has a right to respect for his private life and family life, his home and his correspondence". In Halford v UK, the ECJ ruled (in June 1997) that interception of phonecalls made by an employee on a telephone line expressly stated to be for private calls amounted to a breach of Article 8(1) as there was a 'reasonable expectation of privacy'. Although the HRA does not apply directly to private employers, nor to the private employment-related acts of some public bodies, UK courts and tribunals will be required to interpret UK law in accordance with the Convention (eg through developments to the duty of trust and confidence or in determining whether an employer has acted within the band of reasonable responses in unfair dismissal cases). The courts and tribunals will therefore have a major impact on where the balance is to be struck in this area.
However, the Government has also attempted to prescribe where the balance should lie on this issue, initially in the form of guidance given by OFTEL in August 1999 on companies recording conversations for business purposes and now in the form of the Regulation of Investigatory Powers Act ("RIP Act"). Most of the press on this Act have concentrated on its regulation of police powers to intercept communications, but it also applies to other persons who intercept communications, and therefore to employers who monitor their employees' telephone and e-mail use.
The RIP Act replaces and updates the previous legislation in this area to reflect changes in technology and to purportedly ensure compliance with the Human Rights Act. Previous legislation only covered interceptions on public networks (hence it was of no use to Ms Halford, who was forced to go to the European Court of Human Rights for relief); the RIP Act covers private telecommunications systems also.
The RIP Act is primarily intended to protect the confidentiality of communications and it sets out general principles concerning the unlawful interception of communication. For employers interception will only be lawful if the employer has reasonable grounds to believe both the sender and receiver of the communication consented to the interception or the interception is lawful under the draft Regulations on Lawful Business Practice regarding the Interception of Communications (the "Regulations"). Although some lawful interception will therefore be possible, in practice, there will be new restrictions on the monitoring of phone calls, faxes, e-mails and internet access.
The draft Regulations authorise the interception of communications, by or at the request of a person carrying on a business, in connection with that person's business and using that business's own telecommunications system, if the interception is:
(a) for the purposes of preventing or detecting crime, or
(b) for the purpose of investigating or detecting the unauthorised use of that or any other telecommunication system, or
(c) in order to provide evidence of the communications for the purpose of either establishing the existence of facts or ascertaining compliance with practices or procedures relevant to the business carried on by the person by whom the interception is effected
And the person carrying out the interception has made all reasonable efforts to inform every person to whom or by whom the communication in question is made that it will or may be intercepted or otherwise has reasonable grounds to believe that every such person is aware that it will or may be intercepted.
The Regulations raise a number of issues about the way they would be construed in practice. For example, what constitutes a "reasonable effort to inform" users that communications will or may be intercepted? We consider that possibilities could include warning employees in an e-mail policy and each time they log in, and automatically including at the end of each e-mail a warning to the recipient that the employer monitors both incoming and outgoing e-mails. There are also uncertainties about the scope of what is covered - for example would the Regulations cover interceptions to obtain evidence as to an employees failure to follow the employer's conduct rules?
The consultation period for the draft Regulations ended on 15th September 2000. It is hoped that the consultation will result in clarification of the Regulations. The RIP Act and Regulations are expected to come into force on 24th October 2000.
If you require any further advice or assistance on the employment law aspects of monitoring telephone, e-mail and internet equipment, please contact Simon Jeffreys at simon.jeffreys@cms-cmck.com or on Tel+44 (0)20 7367 3000.
