Cyberslackers ... all in a day's work?

This article is based on UK law and was first published in the Spring 2003 issue of OUT-LAW Magazine.

The latest Claire Swire-style chain email "victim" to hit the headlines was City worker Trevor Luxton. Mr Luxton shot to fame during his employment with Credit Lyonnais, when a casual email to friends boasting of his sexual infidelities was circulated to thousands of internet users. Credit Lyonnais immediately suspended Mr Luxton pending an internal investigation into the abuse of its email policy and Mr Luxton subsequently resigned.

In early 2003, Royal & Sun Alliance dismissed 10 employees when internet monitoring disclosed the circulation of a doctored image of Bart Simpson performing a 'lewd' act. In July 2002, Hewlett-Packard dismissed two staff and suspended around 150 others across its UK operations for alleged email abuse involving what the technology firm described as "viewing and sharing of unauthorised and inappropriate material".

There are countless other examples of employers who are cracking down on email and internet abuse within the workplace. What, though, are the consequences for employers who turn a blind eye?

Recent research has concluded that internet and email abuse is a costly business. According to a recent survey commissioned by Open Orchard, 'cyberslackers' cost UK small businesses almost £1.5bn per year. Of the companies questioned, 30% estimated that more than one day's work per week was lost due to personal email and web surfing.

But damage to the hip pocket does not end there. Employers can find themselves vicariously liable for the actions of its employees, whether or not that action is done with the employer's approval. The reality is that internet and email abuse can leave employers exposed to a variety of 'cyberliability' claims including copyright infringement, defamation, misrepresentation, computer hacking and negligent virus transmission.

Harassment / discrimination – a real risk

In addition, the content of emails and any attachments, particularly where this involves sexually or racially offensive material, can leave employers open to claims that they have not adequately protected their employees from discrimination and/or harassment.

Employers may be vicariously liable for claims of discrimination and have an obligation to protect employees from harassment. In such circumstances, employers may be faced with claims under the Sex Discrimination Act 1975, the Race Relations Act 1976 or the Disability Discrimination Act 1995. Such claims, if successful, have no ceiling and compensation is uncapped.

If the behaviour in question subjects an individual to a detriment and it can be shown that an individual has been treated less favourably on account of his or her sex, disability, race etc, then it is irrelevant whether there was no malice or offence intended.

It is not simply the transmission of email that can be problematic. For example, permitting employees to create an unacceptable working atmosphere by downloading pornography can result in liability. In one case, a female employee with Future Reality Ltd shared an office with a number of men who spent a considerable proportion of their time viewing obscene or sexually explicit images downloaded from the internet. Eventually, the employee resigned and made a claim against her employers of sex discrimination and harassment on basis of the general atmosphere of obscenity in the office. Her complaint was based upon the downloaded images and offensive language. The Tribunal held her claim against Future Reality was well-founded as no steps had been taken by the company to prevent the behaviour complained of.

Proof in such cases is assisted by the fallacy of the "delete" button. Email messages assumed to have been deleted from the system commonly remain backed up on computer systems and accordingly may be recoverable and produced as evidence in any subsequent action against an employer.

Big Brother is watching you...

Awareness of the risks and potential consequences has resulted in an increase of employer monitoring of email and internet use. In the face of such practices there are concerns about the balance which requires to be drawn between the rights of employers to safeguard their position and the rights of employees to privacy.

In broad terms, consent of employees to monitor certain types of communications is key here. Employees must know that their email is being monitored and for what purpose and monitoring must be proportionate to that purpose. Interception and monitoring must be shown to be for a reason that is relevant to the employer's business. Employers must also ensure that any monitoring complies with data protection legislation. Failure to do so may expose an employer under the Data Protection Act 1998, the Human Rights Act 1998 and/or the Regulation of Investigatory Powers Act 2000 (RIPA).

Managing the risks

In defending claims for harassment and/or discrimination, an employer will require to show that it has taken all reasonably practicable steps to prevent its employees from committing discriminatory acts.

An email and internet policy is an essential risk management mechanism. Compliance with the policy should be made part of each employees terms and conditions of employment. In broad terms the policy should include provisions setting out:

• who is permitted to use company facilities to access internet and use email
• permitted uses and the conditions attached to such use
• prohibited uses (such as engaging in any activity which is illegal, offensive or likely to have negative repercussions for the business. This should include for example, downloading , use or distribution of images, texts materials which are or might be considered to be obscene, indecent, offensive or abusive in that its content is discriminatory or generally distasteful).
• that information transmitted in electronic form outwith the employer's organisation must reflect the employer's policies and standards
• the consequences of misuse/abuse of the system, including disciplinary action and summary dismissal.

The terms of the email and internet policy must be communicated to all employees so that they are aware of the terms of the policy.

Senior management must address incidents of email and internet abuse within their organisation as they are encountered. A failure to do so may increase the risk of liability. Fair disciplinary procedures must be followed.

And finally, where monitoring is undertaken, employers must identify in what circumstances monitoring of emails will take place and establish an appropriate framework as to how monitoring will be carried out.