Clear Policy Muzzles Email, Internet Abusers

08/20/08

The Case Beth, the HR person for her company, stopped Tom, her boss, in the hallway. I’ve been looking at the e-mail messages people have been sending out and I have some real concerns.” “Shoot,” said Tom. “Well, for starters we have one person in shipping who seems to be running some kind of side business using his company e-mail address selling magnetic jewelry, and another person in customer service who’s e-mailing Asian porn sites for more information about things you don’t even want to know about. Oh, and there’s a manager at your level whose e-mail is almost strictly family stuff—writing nieces, aunts, mother and father, brothers, and so on. She must send out ten a day like that! And then there’s—" “Stop,” Tom said laughing. “I can see we have a problem. What does our e-mail policy say?” “We don’t really have one,” said Beth. “Our handbook says we can monitor all communications, but I doubt these people know anyone is watching what they’re up to. We need to make sure e-mail is used strictly for business.” “Let’s see what our lawyer suggests for a policy,” said Tom. “And whether we can discipline people now for looking at porn and running side businesses.” The Analysis The Internet is both a wonderful, efficient tool for employees as well as a means for them to engage in all sorts of mischief. It appears that some of this employer’s employees have chosen to use it for the latter. Although it’s hard to imagine any way an employer can completely eliminate this problem short of monitoring every e-mail communication, there are several effective steps employers can take—and some steps this employer should definitely take right away. First: Write a Policy First, this employer needs to draft an e-mail policy that clearly states that employees should have no expectation of privacy in organizational communications. The policy should explain that the employer reserves the right to monitor any communications employees send or receive using the employer’s systems, including, but not limited to, Internet, Intranet, e-mail, voicemail, desktop and laptop computers, and fax. Employers may also wish to remind employees that communication systems should be used for company business only. Inform Employees To be in the most defensible legal position, inform all employees of the policy. That means, ideally, providing each employee with a copy and asking them to sign an acknowledgement that he or she has read, understands, and agrees to comply with it. Include a copy in the employee handbook and/or post the policy where it can be readily seen by all employees. The purpose of all this effort is to remove any argument an employee might have that he or she had a reasonable expectation of privacy in his or her communications. Deal with the Offenders Now to the specific offenders in this situation—one employee is running a side business, one is surfing the net for porn, and another is using the e-mail system for personal communications. In each case, the employee is using company time to engage in personal pursuits and misusing company resources. If this employer disciplines these employees in the absence of a specific, clearly communicated policy that explains that employees have no expectations of privacy in their communications, is it taking a big risk. In large part, the answer depends on where the employer is located. Courts in some states have held that monitoring employees’ workplace communications (even in the absence of a specific policy giving the employer the right to do so) does not violate the law as long as there is a reasonable business justification for doing so. A few courts, however, have held that such conduct violates employees’ privacy rights. So, the least risky course of action for this employer would be to institute the policy, continue to monitor communications, and take action based only upon misconduct engaged in after the policy has been disseminated. A slightly riskier option would be for this employer to introduce the policy but also to counsel each of these employees separately about their Internet misconduct. Practically speaking, if an employee is checking out porn sites or running a side business on the job using the employer’s e-mail system, he or she probably expects to be disciplined (even terminated) if the misconduct is discovered. An employee who is merely counseled or disciplined rather than discharged will probably feel that he or she got lucky, and will not be very likely to take action against his or her employer. A third option would be for the employer to terminate some or all of these employees and assume the risk that it could be sued. Depending on the law in the state where the employer is located, this option may actually carry little risk. In any event, regardless of any action it decides to take regarding these three individuals, this employer needs to implement a clearly articulated e-mail/internet/computer usage policy right away.