Legal question around unauthorised reading of emails

[james_tigerwoods]

A friend of mine (really, it's a friend) suspects that her manager is reading her emails and she's obviously annoyed.

A little bit of history first - she received a bking over something she did, in good faith, following a mistake from someone else. This mistake was caused by the other person and was directly attributable to them, but in the professional case "she touched it last" so she got the bking - in all honesty, it sounds like a political agenda, but that's another matter.

He's made some comments about things he's not been included in that make it clear that he's been reading her emails - As it's a work setting, I suspect there's something in her Ts&Cs that say something like "your email can only be used for professional use" or something akin to not using work email for personal stuff, but I can't help but think that this is legally wrong.

That's my question - is what he's doing legal as he's accessing her email without her knowledge and there is, as far as she knows, no pending HR case against her.

It's all a bit iffy as far as I can see, but I can't help but think that this is more than a legal "grey" area.

Thanks

JTW

[marshalla]

What do her contract of employment and company IT policy (if she's ever agreed to one) have to say on the matter of monitoring communications ?

[joewilliams]

She needs to check the employment contract.

It's commonplace for managers to have access to employee's work mailboxes.

[Munter]

Someone could be blind copying (or simply forwarding) e-mails to the manager in question. She'd never know the email had got to him as well.

I'm pretty certain that most companies have a bit in contracts saying they have access to all e-mails sent through the companies systems. I'd certainly expect a company to be able to review all mine.

[james_tigerwoods]

She is going to review her contract to see what is says and I hadn't really considered someone forwarding their emails - that's always possible.

I guess I didn't really know how it stands when it comes to your email.

Saying that, I always keep whatever I email on a professional level and limit personal comms.

[DavesFlaps]

With regard to company IT systems, including email, there should be no expectation of privacy. I don't beleive there is an obligation to notify an employee when their data is being accessed, however the company IT policy should be clear in this respect.

[marshalla]

james_tigerwoods said:

She is going to review her contract to see what is says

She needs to look at other docs, which may or may not be referenced in the contract, such as employee handbook and IT usage policy. Chances are that she signed up to some of these during an induction process.

[acd80]

Is there an acceptable use policy which she has read and signed to acknowledge? There's nothing illegal going on if she has.

Best practice (and speaking from my experience of IT Security where I have had to look at emails in ongoing investigations) is to keep your personal emails for your personal email account only and don't access it on work IT systems.

[james_tigerwoods]

Ok, I'll direct her at the IT policy which she will have agreed to, probably without reading. Saying that I haven't read ours either, but as a rule it's common sense.

However, as the internet filter is automatic, I'm expecting a bking at some point for attempting to access an unauthorised site several times on friday. It's http://thisisshorpe.co.uk/

[mondeoman]

Generally (IANAL), companies are allowed to read any and every email that goes through their system. However, that does NOT mean than any Tom, Dick or Manager is allowed to. There will probably be procedures in place that require the manager to raise an issue with HR, who will then instruct IT to go through them and provide "evidence" to HR for them to raise against the individual.

All depends on the size of the company and how well they have structured their IT and privacy policies.

[james_tigerwoods]

mondeoman said:

Generally (IANAL), companies are allowed to read any and every email that goes through their system. However, that does NOT mean than any Tom, Dick or Manager is allowed to. There will probably be procedures in place that require the manager to raise an issue with HR, who will then instruct IT to go through them and provide "evidence" to HR for them to raise against the individual.

All depends on the size of the company and how well they have structured their IT and privacy policies.

It's a small company so there may be grey areas, but what you've stated is what I thought - a company will have a policy to review emails, but for a manager to read his staff's email ought to be handled through HR.

Well, that's my thought anyway.

Would HR be bound to ask the question of whether there's something pending against her to justify this?

[marshalla]

james_tigerwoods said:

It's a small company so there may be grey areas, but what you've stated is what I thought - a company will have a policy to review emails, but for a manager to read his staff's email ought to be handled through HR.

Well, that's my thought anyway.

Would HR be bound to ask the question of whether there's something pending against her to justify this?

It depends on the nature of the company and their business. There may be a regulatory compliance reason for all emails to be checked, or at least dip-sampled.

[james_tigerwoods]

marshalla said:

james_tigerwoods said:

It's a small company so there may be grey areas, but what you've stated is what I thought - a company will have a policy to review emails, but for a manager to read his staff's email ought to be handled through HR.

Well, that's my thought anyway.

Would HR be bound to ask the question of whether there's something pending against her to justify this?

It depends on the nature of the company and their business. There may be a regulatory compliance reason for all emails to be checked, or at least dip-sampled.

Freight /Shipping. ...

[davepoth]

james_tigerwoods said:

Freight /Shipping. ...

No real need then unless it's defence based. Here's what the CAB have to say.

http://www.adviceguide.org.uk/england/work_e/work_...

[james_tigerwoods]

davepoth said:

james_tigerwoods said:

Freight /Shipping. ...

No real need then unless it's defence based. Here's what the CAB have to say.

http://www.adviceguide.org.uk/england/work_e/work_...

Thanks everyone, I'll pass that on

[davepoth]

james_tigerwoods said:

davepoth said:

james_tigerwoods said:

Freight /Shipping. ...

No real need then unless it's defence based. Here's what the CAB have to say.

http://www.adviceguide.org.uk/england/work_e/work_...

Thanks everyone, I'll pass that on

Probably worth suggesting that she stops using her work email for anything not directly related to business.

[james_tigerwoods]

davepoth said:

Probably worth suggesting that she stops using her work email for anything not directly related to business.

Thanks - will advise that

[mph1977]

mondeoman said:

Generally (IANAL), companies are allowed to read any and every email that goes through their system. However, that does NOT mean than any Tom, Dick or Manager is allowed to. There will probably be procedures in place that require the manager to raise an issue with HR, who will then instruct IT to go through them and provide "evidence" to HR for them to raise against the individual.

All depends on the size of the company and how well they have structured their IT and privacy policies.

exactly

like many work place things it does depend what in the contract or associated documents - i.e. the AUP

[Grenoble]

davepoth said:

Probably worth suggesting that she stops using her work email for anything not directly related to business.

AND keep all opinions of any individual out of emails. Simple yes/no with professional comments in bullets. Sterile but useful.

[New POD]

Always apply the principle that all work emails belong to the company, and if anyone is mentioned in your email, that person can end up with a copy of your email, if they request all information held on them by the company, under the data protection act, and the company is vicariously liable for any content.

So NEVER email anything that you wouldn't be happy anyone else reading.

Can't help the OP's friend, but paranoia is never a bad thing if it keeps you in a job.