Internal information is being leaked outside the company to ex-employees by a current member of staff. With a strict email policy, can the company check employees’ emails to discover the culprit? Esther Smith, partner at Thomas Eggar, and Martin Brewer, partner and employment law specialist at Mills and Reeve, offer legal advice.

The question:
We have suspicions that internal company information is being leaked outside the company to ex employees by someone still with the company. We’re only a small company so we can narrow down the potential leak to about eight people. We suspect leaks are occurring using the company’s email system, we do have a robust email policy in place which everyone is aware, has signed up to as part of the staff handbook and has been regularly reminded about.

The policy states “Use (of email system) is subject at all times to such monitoring as may be necessary for the proper management of the network as may be specifically authorised in accordance with the rules laid down to investigate breaches and alleged breaches.” My question is, do we have to gain further consent from the eight people to look at their emails or would we be safe to do so within the policy?

Kirsty van Wijk

Legal advice:

Martin Brewer, partner and employment law specialist, Mills and Reeve

Kirsty, it is perfectly proper to undertake a monitoring exercise for the purpose of business protection. Your policy alerts employees to this monitoring. You do not require further consent.

However, there are some simple guidelines you might like to bear in mind.

• Determine for how long the monitoring will continue and set out the precise purpose
• Determine the extent of the monitoring: who will be monitored and what will you monitor
• Who will have access to the captured information? This should be limited to as few people as possible
• Only retain such captured information as is necessary for the investigation. Discard all other captured information and do not use captured information for any purpose other than that for which the monitoring was undertaken

Overall, this means ensuring that you continue to comply with the Data Protection Act and with employee confidentiality.

Finally, once you have the emails you require, read them carefully and consider whether any parts of them (for example the names of non-employees or employees not involved) should be deleted to retain confidentiality.
So far as monitoring emails are concerned there is a key point to bear in mind: the initial monitoring should be to look at the subject line and only open the email if absolutely necessary.

Martin can be contacted at: martin.brewer@mills-reeve.com

* *

Esther Smith, partner, Thomas Eggar

The general principle with regard to monitoring of communications is that you need an individual’s consent in order to do it. The issue of whether the employee’s acceptance of the statement in the policy confirming that the company will monitor amounts to consent under the relevant legislation is an undecided point, and there are authorities that go either way on this.

My view with these matters is always a pragmatic and solutions focussed one. If you have a real belief of the wrong doing then monitor the e-mails. If you get evidence to confirm your suspicions then go ahead and use it in the disciplinary process. If the employee is guilty of the wrong doing alleged, and the e-mail monitoring supports this, it is highly unlikely in my experience that the employee will want to argue the legal merits or whether or not you had the right to get hold of the evidence which has shown them to be guilty! If the monitoring does not provide any evidence you are unlikely to take the matter forward, and the employees probably won’t know you have monitored. However if they do, rely on the terms of your policy which reserve the right to monitor, which presumably they have all had and either agreed to or failed to object to.

Esther Smith is a partner in Thomas Eggar’s Employment Law Unit. For further information please visit Thomas Eggar