E-mail privacy in the workplace is a concern of employers and employees everywhere. Few realize, however, that companies have very broad privileges when it comes to monitoring workers' electronic communications.
"Essentially, the employee has very little right to privacy when he's on company time and on company equipment," said Catherine Pennington Paunov, principal at Pennington Consulting, a Staten Island, N.Y.-based technology-consulting firm.
Some states do not legally require companies to inform employees about their e-mail monitoring policies, but organizations leave themselves open to employee harassment lawsuits if they do not inform them, Pennington Paunov said.
"[A potential problem] is not just the harassment issue," she said. "It's breach of official duty, violation of attorney-client privilege, trade secrets... it's all kinds of things that would be of concern to an employer.
"Our sense is a company needs to have a firm, well-written and well-distributed e-mail computer-use policy. It is the best protection for the company and the worker," Pennington Paunov said.
However, James X. Dempsey, senior staff counsel for the Center For Democracy & Technology in Washington D.C., disagrees.
"I think the [corporate] legal risk is way over-exaggerated," Dempsey said. "If an employee does something illegal using company e-mail, all the company has to do is say, 'You can't use e-mail for illegal purposes [or] for offensive purposes, and anything you do that's illegal or tortious, we're not responsible for it. We'll fire you for doing something like that.' That will go 90% of the way to protecting a company from liability."
Pennington Paunov's said in her experience having a monitoring policy in some form helps to ensure a suitable working environment.
"I happened to help write the Internet policy for some of my major clients. Within a few days after we had established and distributed the policy [for one client], I got a call from their security department. The first thing they discovered was that they had employees in porno sites, using company equipment to view them," Pennington Paunov said.
Dempsey said managers should have a "light touch" and create a work environment where employees are valued and trusted rather than emphasizing stringent policies.
"Employers can set whatever use [restrictions] they want," Dempsey said. "But they have to figure out how they're going to treat their employees."
Pennington Paunov recommends companies with e-mail monitoring programs make sure their employees follow three rules:
- Employees should review the policy, become familiar with it, and make sure they are in full compliance.
- Though it goes without saying, do not use e-mail to harass others, commit terrorist activity, or solicit sex.
- "Assume that your e-mail would be read my by your mother," Pennington Paunov said. "If you're not embarrassed for your mother to see it, you're probably okay."
Dempsey said even if a workplace doesn't state that it has an e-mail monitoring policy, employees should never use company e-mail for anything very personal.
"You should assume your fellow employees are seeing your e-mail," Dempsey said. "Never say anything in e-mail that you don't want posted above the coffee machine.
"So if you send an e-mail saying, 'Honey, I love you,' you'd better make sure you're sending it to your wife," he said.