Fresh confusion over email monitoring

Businesses could face legal action from their employees because of a conflict between new snooping and human rights laws.

Earlier this week, vnunet.com reported that businesses had been warned to check whether they have the necessary clauses in staff contracts and handbooks to ensure they can intercept emails without breaking new laws under the Human Rights Act (HRA) introduced on Monday.

However, other experts have since warned that these steps may not be conclusive in two areas where the HRA and the Regulation of Investigatory Powers (RIP) Act are apparently in conflict.

RIP gives businesses the scope to monitor employee communications on corporate-owned networks, down to dismantling PCs if necessary. However, under the HRA, employees have a right to privacy that their employer must respect.

The two regulations clash, experts say, when a worker uses a corporate-owned network but not its server, for example when working from home or using a web-based email service at work which is run from a third party's servers.

Matt Tomlinson, business development director at MIS Corporate Defence Solutions, told vnunet.com: "There is a contradiction between the two pieces of legislation for remote users and for web-based email. Legal advice suggests this is a loophole aggrieved employees could use to sue their employers.

"I suggest firms update their polices again to state that all accounts accessed through organisation-owned equipment, whether using organisation-hosted mail servers or not, may be monitored. Whilst this improves business policy it may not give 100 per cent protection, and may not hold water in court.

"It will take case law, over the next two years, for a clear definition of what is required to emerge. However, whilst what I've suggested may not be 100 per cent watertight, past court decisions have favoured businesses with clearly stated policies of this nature."

Tomlinson went on to say that there is still an opportunity for the loophole to be closed.

"There is a window during the consultation period the government is allowing to discuss the proposed codes of practice on implementing the RIP Act. This consultation period, which ends on 17 November, is an opportunity for legal/human resource departments to make their points known and close this loophole on remote users and personal email accounts," he said.