Chapter 1 Email, Internet and blogging policies

A Thorogood Special Briefing Chapter 1 Email, Internet and blogging policies The use of email and the Internet at work The cost of the Internet at work Introducing an email policy Further information

EMAIL LEGAL ISSUES Chapter 1 Email, Internet and blogging policies One of the greatest changes in office life in the last ten years has been the move to email. In 2001, The Guardian reported that about 360,000 email messages are sent every second in the UK and in 2008 it will be many more, illustrating how widespread Internet and email use has become. In many cases it is the principal means of business communication. Many office workers now spend most of their day in front of a personal computer and many have access to email and the Internet. Many have their own email capability on their peronsally owned equipment from mobiles, blackberries, PDAs and lap tops with wireless capability. In many businesses email has replaced faxes and letters and (to some extent) the telephone as the primary means of communication. This Report examines the legal issues relating to email, particularly with regards to employees, supervision of employees and potential liabilities. The use of email and the Internet at work In most cases the change to email is desirable. Email is cheaper than long distance telephone calls and some businesses use free services such as Skype for international calls. Indeed, in some areas computer staff chatting for business purposes on instant messaging services such as MSN is common. Email can be quicker and there is a permanent record of what was said. However, it can carry the dangers of employees wasting time online, committing to email statements which may carry liability (such as defamatory words or material which breaches copyright or obscenity laws) and employees acting too quickly without the thought they might give to a formal letter. In general, however, the advantages outweigh the disadvantages. 4 A THOROGOOD SPECIAL BRIEFING

1 EMAIL, INTERNET AND BLOGGING POLICIES The cost of the Internet at work Few managers will need to be reminded about the cost of time wasted on the Internet at work by many employees. For this reason most larger firms now have Internet and email policies, which make it clear what is permitted and what is not. An example can be found in the Appendix. Websense, a company which monitors Internet traffic, suggested that it could cost industry 9.6 billion a year to have workers wasting time in this way. Apparently 44% spend an average of three hours a week surfing the Internet for non-work related reasons. This does not include the cost of bandwidth, storage and human resources costs, but represents a proportion of employee salaries. There are 13.6 million workers in the UK with Internet access and the average salary is 11.88 per hour. Websense supplies Internet monitoring tools, including a Websense Reporter, as does Netsiren. The law does not cause too many problems. The Regulation of Investigatory Powers Act 2000, and regulations made under it on lawful business practice allow most employers to supervise employees by intercepting their emails and telephone calls lawfully without employee consent, as long as the employees know this is going on. This legislation is considered in Chapter 2 Checking up. However, most employers should consider having a standard notice on emails and an email and Internet policy for employees so they know where they stand. If they do this, then there are unlikely to be many legal problems. The first issue for employers is often whether or not to allow employees to use the Internet at work. A standard question the author asks at legal IT conferences at which she speaks, is who has an employee Internet policy and who allows all employees access to the Internet at work? The answers vary widely. The larger UK plcs with tens of thousands of employees will often have clear policies and may restrict access or ban it altogether. Smaller businesses typically trust employees more or do not have the need for a detailed policy and allow more access. However, having a strict policy and then letting everyone breach it is the worst of all worlds. In such instances, trying to discipline an employee who breaches the policy becomes much harder as they can point to the examples of others who got away with it. A THOROGOOD SPECIAL BRIEFING 5

EMAIL LEGAL ISSUES Key advice: Tell employees their emails and internet use may be checked by the employer Have a workable written policy on email and internet use Enforce it Modify it if circumstances change Treat everyone identically under the policy if they breach the rules Some companies positively encourage employees to get to know how to use email and the Internet and are pleased that staff will book a holiday online at work, rather than queuing in a travel agent s for an hour and arriving back late from lunch. In other companies it is a sackable offence. Neither attitude is right or wrong, but in law the important issue is making sure that all employees know where they stand. One private company, Phone4You, made the headlines when it banned all emails at work, even business emails between members of staff (who were encouraged instead to visit each other s offices). Some UK companies have a no emails on Friday policy so that staff concentrate on other work or speak to each other. The Trade Union Congress recommends that employers of unionised workforces enter into agreements with the union about what type of surveillance is to be instigated (see their report at http://www.tuc.org.uk/). Employers in general should consider consulting with employees, as this is as much a psychological issue as a legal one. Staff who feel they are not trusted and their every move is being watched are unlikely to work as well as those who feel their personal autonomy is unchallenged. However, some of the legal risks employees can foist on their employer through unsupervised use of the Internet and email mean that surveillance in many cases is advisable. 6 A THOROGOOD SPECIAL BRIEFING

1 EMAIL, INTERNET AND BLOGGING POLICIES Introducing an email policy Employers who have allowed extensive free use of email and the Internet for private purposes and then want to change the rules, will be varying the employment contract. This should only occur with employee consent. However, the employment contract itself may well say that internal rules can be introduced from time to time, which may have the effect that such change can be brought in whether employees agree with it or not. As always, it is best to take legal advice. The law makes it clear that secret monitoring is unlikely to be lawful. It could be a breach of the Regulation of Investigatory Powers Act 2000. Employees should therefore be told what monitoring will occur and they should ideally be given a written email policy. Case study The Huge Company PLC is known for its inflexible policies. It does not therefore surprise the workers very much when it introduces, rather belatedly, a new email policy which is rather stringent. Hugh and James are complaining about it in the office canteen over lunch. Look, no one could comply with all this. How can I stop my latest girlfriend sending me explicit material? It wouldn t be my fault would it and you saw some of the emails the last one sent me didn t you? They had a mutual snigger at the memory and continued to flick through the document. Also, it s such a liberty, isn t it? James says, They don t trust us. That s what it comes down to. They ll be having us clocking in and out next and asking permission to visit the loo. Why can t I look up holiday details on the Internet at lunchtime? They obviously would prefer me to be stuck in a travel agent queue and be back late from lunch. Hugh knew how long James often spent on the Internet at present and it wasn t all sites as innocuous as holidays. Do you think it s not lawful then? Hugh asks. Some of your Internet use must step over the line surely. What line? It s a free country. Anyway watch what you say. It wouldn t surprise me if this lot have CCTV cameras trained on us even now and hidden microphones in the flowers. Let s call the union and see what they say. A THOROGOOD SPECIAL BRIEFING 7

EMAIL LEGAL ISSUES After lunch they call their union and are told that the TUC is currently working on email guidelines which are likely to allow reasonable use of the Internet for personal purposes at work. They are told: 1. Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (SI 2000/2699) came into force on 24 October 2000 and allow employers to read employees emails for all sorts of purposes connected to the business. (See Chapter 2.) 2. However, employers must also follow the Data Protection Act 1998. A Code of Practice for Employers (which includes a section on Employee Surveillance under the Act) was issued in June 2003. The Guidance provides some standards for the monitoring of communications, covering matters such as letting employees know what will and will not be read, of their emails at work. There is also a section on telephone monitoring. The Code also states that the main reasons given by employers for monitoring Internet access by employees is to prevent time wasting and to prevent the downloading of pornography. 3. The Human Rights Act 1998 came into force on 2 October 2000, providing a right of privacy of communications. However, it is arguable that an employer (who has prohibited the employee from using the employer s property for personal purposes), who then reads an email which should of course be work related but is not, is unlikely to breach the Act. It is the employee who is in the wrong. James and Hugh reading the data protection information from their union are encouraged. I don t think this new strict code would stand up under this data protection legislation, Hugh says. I think they ve gone too far. They also ask the union if the employer is really allowed to change the rules. We ve had free and unrestricted Internet access up until now. We are allowed to make personal telephone calls which are short and local such as to fix up doctors appointments. Can they really change the rules now? It means we are losing a perk. The union advises that this is unlikely to be regarded as such a major change to their employment contract that they could walk out and claim constructive dismissal. They are also told that their current employment contract allows the employer to introduce new employee policies from time to time and this change was instituted under this policy. Apparently in addition, although James and 8 A THOROGOOD SPECIAL BRIEFING

1 EMAIL, INTERNET AND BLOGGING POLICIES Hugh did not know this, some employees had been consulted about the new code. They decided there was little they could do. The email policy An email and Internet use policy is designed to show the employee what they may and may not do with the Internet at work. A sample policy is given in the Appendix of this Report but every company s requirements are different. Some will want to ban all personal use of the Internet and email at work, others will allow employees to do what they like, trusting their good sense and others will want a position between those two extremes. Whichever standpoint is taken, employees need to know what is acceptable otherwise if one is penalised where another has not been, then unfair dismissal proceedings may follow. Examples of sackings of employees for breach of an email policy are given in Chapter 4. Blogging Policis Employers may wish to give guidance to employees about internet blogs websites/pages the employee might set up which could, but may not always do so, refer to the employee s work and have implications for the employer. It is useful to have policy details so that employees know what the rules are. An example is given as an appendix to this book. This policy helps ensure employees know what the employer s rules are in this area and provides some legal guidance. An alternative would be to include this policy as part of a staff handbook (in paper or electronic form and/or have it on the company s intranet). Some employers will not want to be so interventionist as to interfere in employees private lives and freedom of expression in this way but it is always wise to advise employees of their duties under the law in relation to public criticism of the employer. There are no statutes or cases under English law specifically on blogging, although the general employment legislation and laws of libel would preclude an employee from making defamatory statements about the employer or bringing their employer into disrepute. Blog is an abbreviation for web log a personalised online digest where a user can share internet links, news stories, opinions and diary entries with a potential audience of millions. In the US there are at least 8 million blogs and 52 million readers of them. A THOROGOOD SPECIAL BRIEFING 9

EMAIL LEGAL ISSUES In one case in the US, Judge James Kleinberg ruled that bloggers do not have the same confidentiality protections as journalists rejecting a protective order motion made in the lawsuit, Apple Computer v Does No 1-04-CV-032178 (Santa Clara Co, Calif, Super Ct). In that lawsuit, Apple Computer Inc had subpoenaed three bloggers to reveal the identities of anonymous sources that allegedly gave the bloggers confidential information. The foundation appealed the decision to the California Court of Appeal in O Grady v Apple Computer, No H028579. Many employee bloggers in the US believe they are protected by the First Amendment, but most US States (unlike the UK) have at will employment laws where employees can be fired at any time, for any reason, even an arbitrary reason. In the US in 2005, Traffic-Power.com sued the owner of a website focused on search engine optimization strategies for postings that appeared on the site s blog. A posting providing details of the suit can be seen at http://tinyurl.com/bq8ol. The interesting legal point is that the alleged liability relates to postings by third parties on the blogger s blog rather than postings by the original blogger. In October 2005, Singapore jailed two bloggers for making racist comments on the internet, in the first use by the government against individuals of a 57-yearold sedition act. Lee Hsien Loong, the Prime Minister, said that use of the sedition law was necessary to preserve Singapore s racial and religious harmony when ethnic tensions in South-East Asia could increase in reaction to Islamic terrorism. Laws around the world differ widely with regards to freedom of expression. For example, the US has more entrenched constitutional rights of expression than exist under English law. However, English law does in practice give employees freedom of speech, provided they do not breach other laws in doing so. Employees Employees, in blogs, are at risk of the following: (a) (b) (c) libelling their employer, its products or customer service levels, colleagues, suppliers, customers or third parties in their blogs; disclosing other people s personal data which is protected by the Data Protection Act 1998 in a blog for example, describing things relating to their spouse or children without permission could be a breach of these provisions particularly if the blogger s identify has become known or could be easily ascertained by personal information in the blog; breaching copyright or disclosing confidential information of the employer by including material protected by such rights; 10 A THOROGOOD SPECIAL BRIEFING

1 EMAIL, INTERNET AND BLOGGING POLICIES (d) (e) (f) where writing them at work, wasting employer time in breach of the employment contract; breaching a contractual provision in the employment contract which restrains the blogging activity concerned; breaching some other law which may or may not be sufficiently serious to justify termination of the employment contract there are many cases in the UK which provide examples of when an employee s nonwork activities justify dismissal. A speeding fine would not, but a couple of strangers who met on a plane on a business trip who engaged in a sexual act, which caused many a headline and which mentioned their employers could be. Royal Mail workers arrested abroad for football hooliganism brought their employer into disrepute (see Post Office v Liddiard [2001] EWCA Civ 940). EXAMPLE LE BLOG DE MAX One example of a business blog is Le Blog de Max. Max is a manager in an international company which he hates and in his blog he ridicules his employer and his colleagues. If I say who I am and who I work for, I ll be sacked on the spot, he said. I m paid a lot so I d have to do really well as a writer to be able to maintain my lifestyle. He mocked le boss for attempting to promote a company ethos, and his colleagues for believing it. He was rude about the overweight secretary and the ambitious young man. He sang the praises of a workmate who whiled away his time studying photographs of naked women on the internet. EXAMPLE PETITE ANGLAISE In March 2007, a French court ordered that Dixon Wilson, an Anglo-French accountancy firm must pay 44,000 ( 30,000) in damages to Catherine Sanderson, 34, a secretary who was sacked because of what she wrote in her blog and they were ordered to refund unemployment benefit paid to her since she lost her job at their Paris office in April 2006. Her blog, Petite Anglaise, about life in Paris as a working single mother was very popular and she won a sixfigure book contract with Penguin. The firm, her employer, was not named in the blog but the firm said her unflattering accounts of office life identified the business and were damaging to it. It said that she should not have spent working time on her online journal. A THOROGOOD SPECIAL BRIEFING 11

EMAIL LEGAL ISSUES Using Blogs and Flogs Some businesses use rivals employees blogs to glean useful business information. For example, a team of programmers working on a new software programme for software company X may find valuable information about the progress of a particular project described in a blog of an employee of that rival company. Other companies ask members of staff to contribute positive things about their company s products to interactive blogs of third parties. An employer that finds itself libelled or portrayed in a bad light may wish to find out the identity of the alleged employee of theirs so that they can take appropriate action. Most bloggers go under a user name. It may be possible, particularly if solicitors are used in the UK, to require the identity to be disclosed by court order or simply after dispatch of a solicitor s letter. In the US, where there have been more cases in this area the Delaware Supreme Court ruled in 2005 that if an elected official claims he has been defamed by an anonymous blogger, he cannot use a lawsuit to unmask the writer unless he has substantial evidence to prove his claim. At issue was a defamation lawsuit filed last year by Patrick Cahill, a councilman in the USA town of Smyrna, Delaware. Mr Cahill said he needed the identity of a blogger who in a September 2004 posting praised the mayor but said Mr Cahill was divisive and had an obvious mental deterioration. See http://www.nytimes.com/2005/10/06/technology/06blog.html. Some of the most public blogging scandals have related to staff working in politics, including in Washington. In 2005, the Sorensen Institute for Political Leadership hosted a conference at the University of Virginia to debate political blogging. Attendees debated whether they should adhere to a code of ethical conduct and if there was a need for a common moral compass for this new form of political communication. See <http://tinyurl.com/92vxg>. Flogs Some people deliberately write anonymously on line in public forums praising their company s products or criticising others products. Sometimes this is known as a flog rather than a blog as they are flogging their wares. Indeed, some advertising businesses will pay private individuals to sell (in the editorial rather than advertorial sense) products without their friends and other contacts knowing they are being paid, for the discreet advertising that involves. From 26th May 2008 by the Consumer Protection from Unfair Trading Regulations 2008 (SS1 2008/127) this is now illegal in the UK and similar restrictions apply throughout the EU. Many companies plant positive comment from web sites as diverse as sites devoted to how wonderful or awful a hotel was to electronic products. Often 12 A THOROGOOD SPECIAL BRIEFING

1 EMAIL, INTERNET AND BLOGGING POLICIES very clever IT consumers will be able to trace back the source of that person praising the newly launched software product to employees of the company itself. These are fascinating new legal issues. WHOLE FOODS EXAMPLE John Mackey, co-founder and chief executive of Whole Foods, posted anonymously about his company and a company they planned to buy Wild Oats Markets on the Yahoo stock market boards beginning in 1999 until 2006. He used the pseudonym Rahodeb an anagram of his wife s name, Deborah he criticized Wild Oats, posting nuggets such as OATS has no value and no future, The Wall Street Journal said. That particular post was made in February 2005. In 2007, Whole Foods agreed to purchase Wild Oats for $670 million in February 2007. The information about Mackey s posts came to light in 2007 due to the Federal Trade Commission, which is seeking to block Whole Foods buyout of Wild Oats, under US anti-trust law, saying the deal would damage competition. Ultimately, due to the way it was revealed, it wasn t very good PR for those involved. WAL-MART FLOG EXAMPLE The Wal-Mart flog was designed to persuade readers into thinking it was just an average consumer s blog. It was called Wal-Marting Across America, and was supposedly written by two Americans during their travels across the US lodging in Wal-Mart parking lots. Written in 2006, it was then profiled in Business Week, which exposed the site as a promotional tactic engineered by Working Families for Wal-Mart (WFWM), an organization launched by Wal-Mart s public relations firm Edelman. It was found that the two men were journalists who had probably breached their employment terms. This is so foolish on so many levels, it makes me scratch my head, says corporate blogging consultant Debbie Weil, author of The Corporate Blogging Book. Everyone involved violated the basic rule: be transparent. If you re found out, it comes back as a slap in the face. Wal-Mart had tried to launch a MySpace competitor called The Hub which was closed after 10 weeks. Users had said the site was too promotional and had too many fake user profiles. WARNING: Some industries may require more detailed policies. For example, research workers, those in high profile companies, those working on detailed computer software work, could reveal trade secrets and confidential information on a blog and may need more detailed guidance. A THOROGOOD SPECIAL BRIEFING 13

EMAIL LEGAL ISSUES Facebook, MySpace and Other Networking Sites Some employers routinely check the personal pages individuals have on web sites such as Facebook and MySpace to see what information the individuals have posted about themselves, either before recruiting the employee or after. Individuals are therefore wise to ensure nothing untoward has been put in the public domain. These sites identify the individual and often contain photographs and are even less anonymous than a Blog under an assumed name. MSN/IM Some industries such as IT find that suppliers and customers like to communicate with the business on Microsoft/Yahoo messenger or other forms of instant messaging rather than telephone or email. Companies are wise to ensure they determine if they will allow those communications for business purposes or not. Further information A legal guide for bloggers can be found on the internet at http://www.eff.org/ bloggers/lg/ (this relates to US law). On the same site the following are also of interest: The Overview of Legal Liability Issues FAQ (see the eff website mentioned above) briefly addresses some common legal issues that affect an individual as a publisher, especially situations where that individual may face legal claims or threats based on the information published on the blog. The Bloggers FAQ on Intellectual Property (also on the eff website) addresses issues that arise when an individual publishes material created by others on their blog. The Bloggers FAQ on Online Defamation Law (also on the eff website) provides an overview of defamation (libel) law, including a discussion of the constitutional and statutory privileges that may protect you. The Bloggers FAQ on Section 230 Protections (see the eff website) discusses a powerful US federal law that gives people, as a web host, protection against legal claims arising from hosting information written by third parties. The Bloggers FAQ on Privacy (see the eff website) addresses the legal issues surrounding the privacy rights of people blogged about. Some English law guidance on avoiding defamation actions can be found at http://www.bbc.co.uk/dna/actionnetwork/a1183394. Internet law firms can provide legal advice in this area. A handbook that offers advice to bloggers who want to protect themselves from recrimination and censors has been released by Reporters Without Borders. 14 A THOROGOOD SPECIAL BRIEFING

1 EMAIL, INTERNET AND BLOGGING POLICIES The media watchdog said it gives people who want to set up a blog tips on how to do so, how to publicise it, as well as how to establish credibility. It also offers advice about writing blogs from countries with tough media restrictions, such as Iran and China. See Handbook for Bloggers and Cyber-Dissidents information at http://www.rsf.org/rubrique.php3?id_rubrique=542. An appendix to this book gives an example of a blogging policy. Further information on email policies can be obtained from employment and IT lawyers listed in the Chambers Directory at www.chambersandpartners.com. Some companies have trade unions represented in the workplace that can be informed and even consulted over proposed changes in email policies. A THOROGOOD SPECIAL BRIEFING 15