Developing a Policy to Monitor Employee E-Mail, Voice Mail, And Internet Use

Electronic communication in the workplace has overtaken business communications. Instead of the phone ringing, employees and customers communicate via email, text, and instant messaging. Voice mail still has a place, but it's prominence is receding. With all of this electronic communication and use of the internet, is there a way for companies to protect themselves from inappropriate use of these electronic tools?

Why Monitor?

While most employers have found that e-mail, voice mail, and the Internet increase worker efficiency and productivity, some employees have subjected their employers to potential liability for sexual and other forms of harassment by transmitting offensive e-mail and voice mail messages or circulating obscene materials downloaded from the Internet. Employers in these cases face liability for failure to monitor their communication systems and cleanse them of inappropriate messages and materials, as well as for failure to discipline the responsible employees.

In addition, employers may need to review employee communications in connection with investigations of possible misconduct. Also, companies that work with sensitive data may fear that careless or disloyal employees will disclose such information to competitors. Monitoring will help employers discover and avoid such occurrences.

Employee Protections

Under some circumstances, monitoring of communications can result in violation of the Electronic Communications Privacy Act (ECPA), which prohibits interception and disclosure of electronic communications in transit, as well as those found in electronic storage. The statute provides two exceptions employers can use to avoid liability:

1. the consent exception; and
2. the business extension exception.

Under the consent exception, monitoring an electronic communication is lawful as long as one of the parties to the communication has consented to being monitored. Consent may be implied where an employer issues a clearly written monitoring policy, and effectively communicates the policy to all its employees. The business extension exception allows monitoring of employee e-mail if the employer establishes a business-related reason for such monitoring.

Improper monitoring of communications could also lead to invasion of employee privacy claims. Here again, a clearly written monitoring policy, communicated to employees and consistently followed, would give the employer a strong defense to employee privacy complaints.

Policy Development

Before monitoring employee use of e-mail, voice mail, and the Internet, we recommend that employers develop policies regulating employee use of these systems, and informing employees that their communications will be monitored for business purposes. It is recommend that monitoring policies include the following statements:

1. E-mail, voice mail, and the Internet should be used only for business purposes.
2. The employer will monitor e-mail and voice mail messages and Internet use, and may disclose the content of e-mail and voice mail messages, even after they have been deleted, when, in the employer's sole discretion, there is a business need to do so.
3. Occasional personal use is permitted, but the employer reserves the right to monitor personal use to the same extent that it monitors business use.
4. The employer's communication systems should not be used to set up or run a personal business, transmit offensive, derogatory, obscene, or illegal materials, or download such material from the Internet. Violation of this rule is grounds for termination.
5. Employees should not expect that e-mail or voice mail messages, even those marked as personal or accessed by a personal I.D., are private or confidential.
6. Employees should exercise the same restraint and caution in drafting and transmitting e-mail messages as when writing a formal memorandum on company letterhead. Users should assume that messages will be saved and reviewed by someone other than the original addressee.
7. If the employer does not use encryption devices or protective software, employees should not communicate company trade secrets and confidential information via e-mail.
8. Use by employees of the employer's communication systems constitutes consent to monitoring.
9. Continued use of the systems is conditioned on acceptance of and strict adherence to the employer's policy, and failure to adhere to the policy's requirements may result in discipline or dismissal.

Enforcement Guidelines

In addition to developing a monitoring policy, employers should consistently enforce their policies. Employers should take the following enforcement steps:

1. Announce implementation of the policy with an e-mail or memo to employees explaining why the policy has been adopted.
2. Charge only a select group of employees with monitoring responsibilities to ensure that monitoring is consistent and carried out according to guidelines. Only a high-level manager or human resources professional should be authorized to approve even minor departures from the monitoring policy.
3. Implement a uniform system for periodic deletion of all e-mail and voice mail messages and back-up copies. (But note that employers have a legal obligation to retain any messages discoverable in litigation that has commenced or is reasonably anticipated.)

Wrap-Up

In summary, it is recommend that in developing e-mail, voice mail, and Internet policies, employers should strike a balance between their right to control and monitor their communications systems and their employees' right to privacy.