UK: Monitoring Staff Communications – Is It Lawful?

Last Autumn saw the arrival of a number of new laws relating to the monitoring by employers of employees' emails and telephone calls.

The new laws include:

This Act created an offence of intercepting e-mails and other forms of communication without the consent of the sender and the recipient.

These Regulations have had effect since 24th October 2000. They allow businesses in certain circumstances to monitor telecommunications for certain purposes, including:

• detecting unauthorised use of the system
• national security
• prevention / detection of crime
• establish compliance with regulatory or self-regulatory procedures

Interception will only be authorised where:

• it is effected in the course of business
• the telecommunications system is provided wholly or partly in connection with that business, and
• the person making the interception has made all reasonable efforts to inform all parties to the communication that it may be intercepted or where he has reasonable grounds to believe that such a person is aware that it may be intercepted.

In force since 2nd October 2000, it has drawn attention to the right to privacy enjoyed under the European Convention on Human Rights, including with respect to correspondence.

Consequently, to monitor telephone calls in an authorised way an employer should consider implementing the following:

• Inform the employees that monitoring may/will happen: include reference to it in standard terms and conditions of employment, and display staff notices.
• Inform external callers that calls may be recorded: refer to it in advertising and customer literature.
• Ensure some phone lines at work are for private calls which will not be recorded: these could, for example, be pay phones.
• Be aware of the need for proportionality: it may be a more proportionate response to have an itemized bill if someone is suspected of using phones for personal calls rather than listen into all of the office phones.

Similarly, to monitor e-mails, an employer should consider:

• Ensuring employees are aware that their use of email and the internet may be monitored.
• Indicating to employees whether private use of emails and the internet is allowed.
• Stipulating rules and restrictions on use, such as for downloading of information and images from the internet.
• Creating sanctions for those employees who break the policy.

By considering these issues, employers should ensure that a balance is achieved between the employees’ expectations of privacy on one side and the employer’s needs for security and propriety in business operations on the other.