Louise Harrison, Catherine O’Flynn

Recent reports of a viral email controversy should serve as a stark reminder to employers of the importance of robust email and internet policies.  A group of male employees circulated an email rating the looks of some of their female colleagues, including photographs of the women downloaded from the employer’s intranet.  The email was forwarded outside the employer’s network and became viral. The email was published by media worldwide, attracting huge adverse attention.

The employer found itself embroiled in a controversy which presented privacy, data protection, sexual harassment and disciplinary issues, not to mention unwanted negative publicity. 

How can an employer best protect itself?

A block on non-work related email and personal internet usage is an option but may not be realistic.  What is more pragmatic is the proper implementation of an email and internet policy where parameters of acceptable use should be clearly drawn.  Practical, but non-exhaustive, examples of the types of email and/or social networking activities which are not acceptable should be outlined and could include:

• communications containing defamatory comments;
• communications containing comments and/or graphics which could fall foul of the employer’s bullying and harassment policies;
• communications which breach the employer’s equality policy;
• social networking where the employer’s reputation is compromised; and
• excessive use which adversely affects employee’s performance or productivity.  

Transparent disciplinary procedures should be outlined so that employees are in no doubt as to the consequences of a breach.  Enforcement of policy must be proportionate to the circumstances.  An employer should have a legitimate business basis to underpin the disciplinary process and to justify any sanction.  

Monitoring

An employer considering whether to monitor employees’ use of email and internet systems should take care to ensure that such monitoring is conducted legitimately and in accordance with privacy and data protection law.  A prudent employer should notify staff that there can be no expectation of complete privacy but that monitoring will be undertaken only with ‘good cause’. 

‘Good Cause’ should be defined in the policy to include such issues as the need to investigate suspected breaches of contract and/or workplace policies and to protect the proprietary and reputational rights of the employer.  

Employers seeking to protect their business reputation and preserve employee productivity should maintain comprehensive deterrent policies including realistic sanctions.