Discussion on:

Who owns corporate e-mail? Is there a right to privacy?

In regards to the original blog piece:

http://blogs.techrepublic.com.com/helpdesk/?p=655

Is corporate e-mail company property, subject to review, or is it personal property with a right to privacy?

Take the poll and share your comments in the following discussion.

I mean seriously? If you transmit message at work it is subject to corporate review. If it's something you wouldn't want superiors to read why the hell are you writing it? Even if you're on a personal website blogging or sending email from your gmail account,you're doing this at work and it is subject to review. Like it or not, our employers have the right to know what we're doing.

Like another poster said, it goes one step farther if you are a government employer. Not only is your info subject to review by superiors, but it may also fall under the public information and disclosure act. So if it isn't something you'd feel comfortable about seeing in the newspaper tomorrow morning...just don't send it.

I think you'll find that the EU deems this personal property - and as long as it is not illegal, can not be viewed without consent.

Those that think that just because its the corporation's property, have clearly been in middle-management too long.

Cisco own the intellitectual property for all the routing software that your messages and data travel through - does that make any data traversing it their's? Of course not.

The 'on company time' doesn't hold water either - who clocks in and clocks out these days? What's to say you didn't send the message/data on your break (your OWN time). You cant be expected to pop out to an internet cafe anytime you want to communicate with a non-work collegue - something the courts agree is unreasonable.

If the data/message is illegal or harmful to the organisation (thus being illegal), then this is a different matter, and can be pursued through the usual procedures, starting with HR, and the data protection officer.

Its an issue of ownership that is the real question. If i create something, and i haven't specifically been governed to undertake the task, then it is mine.

and somebody takes offense at it, then since you own it and not the company, I welcome your survival from the multi-million pound lawsuit you are going to encounter?

You're wrong sir.
If it is on a company asset, it belongs to the company.

Offensive email is exactly the same as if you were offensive to some ones face. you said it, there are consequences. This would be delt in the same disciplinery procedure.

You have actually proved my case further. If you don't 'own it' and the company does - how can you be at fault?

Also since when do offensive emails cause million-pound lawsuits? only an idiot would do something like that surely - it's called common sense.

I guess since I haven't been specifically ordered to come up with the many money making and money saving ideas I've had over the years, I could sell them to all of our competitors. What bad economy? I'm going to be rich. I can get paid by several companies for the same thing. I can just say "you didn't tell me to do that, so it's mine." So what if I used company time and resources, it's all about me now.

dear brthwgcp,

i think your taking the argument too far. if you work in a place where there is development and potential commercialisation, then of course there will be contractual arrangements in place for what is invented/developed in house.

That would be breach of contract - which is illegal - and thus your emails could be viewed no problem.

Notice how the opinion is different between the EU and the US management. In the EU the privacy rights are much more user oriented. In the US there basically no privacy rigths for the user until the company gets sued. So depending on which continent your business is located at, managements opinion will differ on this topic.

I myself have worked both worlds and the key here is the email illigal activity by company policy.

I went too far to make my point. Wether you are in the US or the EU, have a contract or not, have written polices or not, if you're on company time and using company resources it is reasonable to believe that the company can and will monitor you and own what you do. For the most part, if you are doing personal things on company time, it can be considered stealing as if you took home a ream of paper. If your personal email spreads a virus or spyware through the network, who pays for that? Oh sorry, the content of my email is private, but the virus it provided is for everyone's use, enjoy. In this economy, see ya, we'll replace you with someone hungry, for less than we're paying you.

For the sake of arguing you make a case, however the company has provided you a computer and an email account on software and computers that they have provided. They have also told you to email program to use and provided you with the account. You did not have a choice on anything (at least in my case) except the password which I am required to change periodically.
Yes it can be considered my personal account but the company can be held responsible for in appropriate content and although they and not me would be sued, I can assure you I would be looking for a job and in most cases would not have a good argument against the firing. That is also common sense.

Here in the US, idiots file frivolous lawsuits everyday for just such things, and win them. Or the plaintiff will just roll over and settle for an amount that is less then the expected outcome might be. And your moronic claim of " If you don't own it, how can you be liable" doesn't hold water either. What if I borrow your car and hit someone. Am I liable because I was driving, or are you liable because it is your car? In the US, the victims family would not care, and would sue you, me, General Motors for making the car in the first place, and anybody else they think they could get cash from.

"Here in the US"

sigh - home of the suing culture. Working out well for ya is it? And you argue my ideas are moronic.

My claim is not trying to absolve oneself from any sort of responsibilty, but rather suggesting that if a company has all rights to your communications during working hours, then surely it must also take that responsibility when its inflammatory/derogatory.
Of course it doesn't as you have responsibility, as does the company to allow you some discretion when using company equipment.
We're not all bank tellers.

Usually from the same people complaining about using content filtering to block twitter, facebook and myspace.

I stand by the fact that you should absolutely not send personal, non work related emails from work. Buy a smart phone with your own money and goof off on your own equipment. It's no different than using the company phone to call your mom and pop on vacation in brazil. You're utilizing company resources for personal business. I don't strictly enforce that, but when in a legal situation I will pull anyone's email if our lawyers ask for it and I have signed authorization from management...and I won't feel bad about it since the user should have been more careful.

Eurojames - I really think you give the United States a lot of credit that it really doesn't deserve.

The reason why we have this Anti-Privacy laws, strict Acceptable Use Policies, etc is because majority of the U.S. has no common sense. Our president has to tell us to wash our hands to prevent a virus outbreak. As well as tell us to check our tire pressure, it helps us save on gas.

In a perfect world where people have common sense we would have less common sense laws.
Would that ever happen? Nope.

I agree with you 110%. Though in the United States that will never happen. System Admins / IT Managers / Tech Professionals, have to babysit people so that they don't go to porn sites, send offensive email, etc.

Which comes to my conclusion on humanity:

Common Sense cannot be taught - you are born with it! You either have it or you don't!

Voltaire - There's nothing so uncommon as common sense.

And my addition - Never underestimate the power of human stupidity.

The lack of common sense is only a symptom. The actual problem is that personal responsibility has been eliminated from both American society and the American legal system.

Corporate email is for business use, and the company can do as they wish with any/all emails that go through their equipment.


Your Cisco thing is just stupid -- yes, Cisco has networking equipment -- mostly sold to others. People/companies pay for bandwidth (rent the equipment) with privacy .

The company not only pays for your email, but also the networking equipment, bandwidth, computer, and the people to represent them. Each employee is a representative of the company. Dont like it -- move along!

If you want complete privacy -- find a job that you can work at home, and only use your personal mail and equipment! Once you join into the companies network -- it is their data. They provide all of these things so that you can do a job/service for the company, not for a personal playground.

i know that middle-management and corporate ladder climbers would love to *think* that the employee has no individual rights, but actually they do.

unless it is specifically stated in your contract that you are NOT to use email for personal use, then most courts (at least sensible ones in the EU) agree that there is to be some expectation of privacy.
Please look up the Copland case.

The reason being for this 'expectation' is that most people do not have the ability or facilties to work from home, nor have the ability to negotiate their contract effectively (since unions are all but illegal).

I'm afraid Mr Scummy One that you are the perfect corporate rottweiler lauding how its company equipment this, and company network that - however it has been proved in courts to be inconsequential.

No one is suggesting that its a free-for-all 'playground' but it is about business practice and work ethic. If you have time to emailing all and sundry then surely its not an email privacy problem but a workload issue?

there have been written policies in place regarding email -- and all of them stated that email was for business use only.

All of them stated that any/all emails may be monitored as well.

And to add that all email is considered a 'document' and must follow the document retention policies.

Not being able to do this would be a big problem for companies, they wouldnt be able to do an investigation into wrongdoings without a court order, and needed items could go missing.

Email has proven time and again to be a major item in courts/litigation issues. It is used for business to conduct business, therefore it is business property.

I am not saying that anyone can go by and look over any emails, however HR, IT security/network admins, etc. do have the right to go through the emails, under certain circumstances, which do not require a court order beforehand.

Dear Scummy one (i'm not that happy calling you that!)

I agree with you that HR or Police etc should be able to review email that has come into or out of your mailbox. But there has to be some procedures for this - regardless of what the contract says - you cannot just rummage through peoples emails as they please.
Time and time again courts have said this is an infringement of privacy unless there is a good reason (illegal activities, discplinery procedure that the employee is going through).

I believe as IT professionals it is our job to ensure data protection is upheld, otherwise your not doing your job correctly. No network admin has the right to go into anybodies mailbox. They can monitor the amount of mail passing through for operating procedure/irregularities but that is all.

thats just what i believe and at least in the EU this holds fairly watertight.

Also 'scummy one' (no offence),

Whilst i have been working in the IT industry for only ~10 years, i have worked in numerous countries around the world (not just in the EU), and for various types of organisations (private/publically listed, public sector), and have never ever had the wording 'email is for business use only' in a contract.

Not that I wouldn't signed one of course, but I deliberately have checked the clauses and in almost every case there has been an element of 'email can be used for personal reasons if it does not impact on the business etc etc'.

Could it be that you have worked for particularly draconian - or perhaps where intellectual property was very important in the sector??
It could be the type of business is more sensitive than others. I'd image I wouldn't want to risk client information, or code flying out the door without first being able to check it had been stolen.

my 2 cents (crap I'm up to aabout a buck now!)

I have done work with credit unions and other financial institutions, government (Navy), and Legal. Those would make up most of my technical career.

I agree that there needs to be a reason before a netadmin should be able to scour a persons mailbox, however, it is still not as private as personal email, and is often consideres company property.

This does not stop the 'email is considered documents' portion either. And while there is a lot of personal use in email, it is leniency in the policy (not many want to be the email nazi -- lol). Also note, that many people are told to delete personal emails as soon as possible for several reasons -- 1 being in case of an investigation. And it does not mean that the person in question did anything wrong, it may be someone else -- even a business contact. In that case, the Litigation attorneys may need to see all correspondance between the other party and you, and may secretly sift through emails for this reason.

I dont take offense to those callimg me Scummy or the Scummy one (or even Scumdog), so please do not feel uncomfortable calling me what I list my name as.
As far as I am concerned here, we are having a discussion -- not a shooting match.

No one argues that the company "owns" its workers. But the company clearly owns the communications infrastructure. And all companies I've worked with since external email was provided (1991 in my case) have made rules about use of the infrastructure (telephone, email, internet)as a condition of employment. These are contractual between the employer and the employee. These have been signed at the time of the start of employment.

The courts here will happily enforce these contracts and there are many many cases where this has been upheld.

If you want email privacy, email from someplace other than your employer.

James

"unless it is specifically stated in your contract that you are NOT to use email for personal use, then most courts (at least sensible ones in the EU) agree that there is to be some expectation of privacy."

Like you pointed out, every company I've worked for over the past 10+ years has had an Internet/e-mail usage policy that strictly prohibited company-provided e-mail addresses from being used for personal uses. Some even block access to all but a few approved website on the Internet -- & e-mail providers were usually not on the approved list. Signing a form stating that you had read & accepted the terms of the policy was always required for continued employment with that company.

But even if there isn't any specified Internet usage policy in place at work, it still doesn't matter. If they ask you to stop, & you start yelling about "personal rights", & how there are no rules saying you can't use the company e-mail to send personal stuff to your buddies...pray that your employment isn't "at-will". They don't even have to mention the e-mail usage when they fire you; they can put down generic comments such as "insubordinate", "not a team player", or even just give you a really poor work evaluation & tell you "it's just not working out". Then you're fired, they can give potential employers a negative recommendation... & they don't need to mention anything about e-mail usage at all in any official documentation. And just try to prove that it was because they didn't like your "private" emails; in "he said/she said" situations, courts weigh in on the side of the person with written proof supporting their side... and you won't have any.

yes there are contracts in place where-ever you work that stipluate what you can and cannot do - and what is retained, or monitored. However, as long as it does not impact on the business at large, then an expectation of privacy is to be expected by the employee, and respected by the employer.

it may be totally different in the US of course, and i'm not suggesting that a court order be required - but an employee needs to be made aware if there is active monitoring not just fine print in a contract).

in every place I have worked where email and computer/phone was provided, it was discussed before signing. Also, where I am at now, there is a yearly review (course) that needs to be taken which covers it as well. No exceptions for who you are, the board members have to take the refresher every year as well.

It may be considered the same in the USA as it is in the EU - that unless it is in your contract you may have a presumed right to privacy. However, every company I have worked with has it clearly stated in the Employee Handbook (and thus part of an employee's contract) that company email is not private and is subject to review. To my knowledge, this holds up in USA courts. I do not know about the EU courts.

My personal belief is that, while the company does not own an employee it does own the equipment and therefore can decide what is appropriate use of that equipment. For example, if the company owns a nail gun that doesn't give an employee the right to use it for renovating his property - not in the USA anyway. In my opinion, the same should be said of computer equipment. I am not familiar with EU law and it may be different.

That said, I do believe that there is a privacy right when an employee uses company network hardware to access their private email accounts (on Yahoo, Google, MSN, etc.). I am not saying that the employee shouldn't be reprimanded or fired, just that the employer cannot read the contents.

The companies that I have worked for have not been draconian in trying to prevent use of company equipment for employee's personal business. Bays have been used to work on one's own car, company cars have been used to run personal errands, telephones are used for personal calls, and computers are used to access one's email. If such use is frequent enough that it impinges on an employee's ability to complete their job then they should be terminated.

I expect that smart phones will eventually make this a moot point anyway.

James, as an American in Europe for over 10 years now I see the EU (and it's courts, etc.) becoming more like the US. As a company grows & becomes International it must behave so. Americans are just a little ahead in the sueing game, but Europe is slowly catching up as their corporations become "Internationalized".
And as a manager if I own the resources and pay you to work with those resources then yes they are by all rights mine.
And I do not know what part of the UK you are from but my colleagues in the UK have a very "USA" attitude when it comes to an employee abusing the company owned resources, in some cases more extreme than I've seen in the US.

and the legal relationship will depend a lot upon the terms of the contract.

A contract which permits me to take in other work means I'm a contractor; one that restricts me to only working at that company means I'm legally an employee. Both positions have different legal rights.

As an employee the company is expected to provide all that I need to do my job, including email access if needed.

As a contractor they are only required to supply what's listed in the contract. For me to use their email system would, legally, require the provision of that to be part of the contract with terms on it's use. many courts hold that non mention would see the use of additional corporate assets provided on the same basic terms as provided to an employee.

BTW There have been a number of court cases where correspondence on a corporate mail system has been declared as official corporate documents and thus corporate property.

At most, it only makes the rules for a large section of Europe.

And as far as deeming it personal property... in this day & age of multiple free email providers (gmail, Yahoo, AOL, MSN/Hotmail/Live, etc.), not to mention people having web access to email from their home broadband providers (Roadrunner, Earthlink, Verizon, AT&T, etc.), there's no reason you can't use your non-work email to contact a non-work friend.

Sorry, what's that? Your employer's Internet usage policy blocks access to web-mail sites? Well, for starters, their usage policy also probably mentions something about "not using work e-mail for non-work-related purposes"... & you were almost certainly required when you were hired to sign a paper stating you'd read, understood & agreed to said policy. Even if you didn't really bother reading it, you signed the paper saying you had & that you agreed to follow it, which makes it a binding legal contract. Not to mention that you can always call your friend & talk to them (or leave a voicemail/text). Not allowed to make non-work-related calls from the office phone? That's fine, use your cell phone (or even a pay phone -- they're still around, & still pretty cheap) while you're on break. Or better yet, just call them after you're done at work -- unless it's a real emergency (i.e. family member sick/in the hospital), in which case the average supervisor/manager will be fine with bending the rules on calls (or at least letting you take an extra break to call on your cell).

And you're also on the wrong track with the Cisco analogy. Cisco's already received their "ownership fee", because the ISP has already paid them the royalty fees to use the software. A corporate e-mail/Internet usage policy, however, is no different than an ISP's Terms of Service, and is just as legally binding. In fact, the policy is just like corporate policy on the use of company vehicles. Sure, they may let you take the company truck/car home, if your job requires you to often go straight from home to an off-site location (i.e. repair techs, cable installers, etc.). But over 90% of the companies out there will frown on you using the company sedan to haul your kids down to the movie theater for family night, or to make your weekly grocery run, because you should be using your personal vehicle for personal uses.

Oh, and most companies aren't in the technology Dark Ages anymore. They have IT departments that are more than tech-savvy enough to install keyloggers, screen-capture, and other software applications that will track just how productive you are and what you're doing at any given time on the purchased-with-company-cash-for-company-use-only computers, let alone tracking all Internet traffic routed to & from that computer...and will have no trouble matching the timestamps from the software logs with your scheduled breaks & lunches. Oh, & since these are company-owned computers (& not your own personal PC from home), they're legally allowed to install all of that software on the computer... & block all administrative privileges from your login profile so that you can't disable/remove them (kind of like how you can install the same software on your home PC to track what your spouse/children use it for). That's perfectly legal for them to do, especially when they let you know up front that they're doing it.

In short, they're the company's toys, so they set the rules for the game. If you don't like the rules, find another company to work for, but don't complain that their rules are "illegal" because you want to get paid to use their bandwidth & e-mail servers to send stupid jokes & chain letters to your friends, instead of using your personal e-mail account & bandwidth at home.

As work places and personal spaces and times becomes constantly blurred i think its important to be aware that it is not always possible to seperate work and personal calls/emails/time quite as easily as you try simplify.

You are so wrong about company vehicles. If you have a company car, you are free to use it outside work time to run kids to and from sport practice, the cinema etc. What company do you work for that doesn't? Maybe you should think about moving companies.

I'm aware the EU doesn't rule the world. I'm actually an immigrant to it, so please don't preach your 'global philosophy' based on some misplaced bigotry.

I am actually in the IT industry, (thus on tech republic...) so am well aware of what IT departments can do to monitor people. This topic is about legality and privacy of it, not the methods or tools.

As for the company car rules, in my company, that rule applies to senior management vehicles. But the people we have that service our clients are provided with vehicles that are only to be used for company business, and the mileage is monitored to ensure compliance.

As to the work/life balance, we are allowed to use the internet and email for non business purposes, provided we follow some rules. And there is clearly no expecttaion of privacy. My boss could ask for my records at any time, by going to HR.

James

If you have a company car, you are free to use it outside work time to run kids to and from sport practice, the cinema etc.

Must be nice to live in your world. The following text is from my employer's vehicle use policy:

Company vehicles are for company business use. Company
vehicles are to be used solely for company business. Use of
company vehicle for any personal use without express
authorization from your manager is grounds for immediate
disciplinary action, up to and including termination. Company
vehicles are to be driven by authorized employees only, and only
authorized employees are allowed in the vehicles. Family members,
friends, any non-company employee, and pets are not permitted in the
vehicle at any time.

is provided with permission for personal use in the contract no company has a standard rule of allowing personal use, and using a corporate car belonging to a government organisation for personal use can see you disciplined, even terminated.

In one well payed salaried position I held we didn't get company cars, instead we were reimbursed $1 per mile. Granted, we actually went to off site locations maybe once a month and it was a 15-30 mile round trip.

Anyway...if you read the fine print it stated that was once you were in your own vehicle travelling to a company location and claiming reimbursement; the YOUR car became an extension of the company campus. This meant you had the same obligations in MY personal car as a company owned car. No smoking, no cellular without hands free and the usual corporate stuff. All infractions or major traffic violations (15 over and the like) could "potentially lead to punishment up to and including termination dependent upon severity." It was never enforced, but it was understood. I carry a concealed weapon (legally) in my vehicle most of the time, I'm sure that was a definite infraction.

I'm not saying it is right or wrong, it never bothered me...I never sweat the little stuff.

That may have been the company policy, and I can see why they'd have it - mainly so the vehicle looked good and you presented a nice corporate image. But I can't see they'd get away with taking action against you for something you can legally do on your own. If you've got a concealed carry licence and had the weapon in holster under your jacket at work, they'd need a damn good case to justify refusing to allow you to carry it about if you didn't advertise it; and the same would apply to the car. But it does make you wonder about some corporate mindsets.

That policy does sound a bit like the MS EULA - hey do all this or else, except the law courts won't support most of it.

you make it very clear in your last two paragraphs "If the data/message is illegal or harmful to the organisation (thus being illegal), then this is a different matter, and can be pursued through the usual procedures, starting with HR, and the data protection officer." by at this point it is a little to late and someone has either been offended or worst by the message sent. Just like it is the responsibility of your company to proctect you while you are at work from harrassment or sexual assult, this would fall under the same goverening rules, they are protecting themself from legal actions. You also forget about the items that come with personal emails WHILE on company time, 90% of the time, surfing, or receiving an email that has a virus attached to it can bring your company and its resources to the ground, who is responsible for this, should I now send the user the bill to clean all infected machine, it is common sense that you do your personal business at home and not on the company network!

Simple test If it needs privacy protection you should not be doing in on company time or using corporate resources. Under Sarbannes Oxley it may be archived including IMs. Your momma was right "If you wouldnt want to see it on the front page of the local paper dont do it" (inlcudes write it, IM it or forward it.

use company property for personal use, you're either in the situation of 'able to be fired for mis use of company property without authority' or 'doing it on company time.'

BTW Many legal jurisdiction also regard people on breaks as being on company time so that they can also be legally covered by workers compensation and similar insurances and also safety laws.

If you email domain is the corporate domain, then it would be the same as writing a personal letter on company letterhead. Anything on corporate letterhead is deemed corporate correspondence, with you being a representative of the company, so how is this different?

As for ownership, the laws/employment contracts in the UK must be very different to in AU. Even idea had during corporate hours is the property of the company under most employment contracts here (of course that's unenforceable - and recognised as such - but it does establish the expectations).

My $0.02 worth

This is a mute issue. The email created by your COMPANY email address is the companies property. The emails are located on the company server (who pays not only your salary but for the resources in question) If you want to write personal emails that are personally YOUR and not subject to any review, Get a PERSONAL email address. Your company can NOT snoop into that...IE a Gmail, or Yahoo, or Live, or whatever. there are enough Web based email accounts out there.

Also think of this, Disclosure. If you start looking for a new job, do you want to use your current company email? or something more private?

Come on people, its simple. It's their computer, Their internet connection, You are their employee, they are paying you in terms you agreed upon for your time, Their servers, hard drives, Server software (about 5k) Exchange/email software (about 3k) and then thier User access license for YOU to check email legally. They pay for it all, they do the back ups, the file retention and everything. What part of that email do you actually think is yours? Because you wrote it?

In the middle of the work day, on work time one shouldn't be communicating with "non-work" collegues. Lunch time is when you pop out to the internet cafe to send the message.

The company owns the computer you send that email from. When it crashes do you pay to fix it yourself....? No? Then how can you expect that it is yours to do with as you wish?

If you create something and haven't been specifically governed to undertake that task (on work time, at work computer) then it's yours...., oh wait...., were you at home at the time? Nope, you weren't. Therefore you should not be working on tasks which are not work related.

See the company which I work for would fire you for failing to do "work" on work time, at a work machine.

If you have a locker, do you expect that you can put anything you want into the locker without fearing that the "company" will peek in? Same thing. If the computer resides in the company office (or was supplied by the company to access company resources) then everything on said computer is owned by the company.

If you leave your job and take said computer with you, that's called theft. Where is the question of ownership....? You don't get to keep a company email address when you leave the company..., so how much clearer does this have to be made?

Work is for work. Go home and send your personal emails from there if you do not wish for others to read what you send.

It's not your computer, you didn't pay for it.

It's not your email server, you didn't pay for it.

Most likely, it's not even your company.

It's not your email and you have no expectation of privacy.

If you work for a public entity, (City, State, school board) it's usually written in the law that it's public.

Get over it.

Company computers. Company network. Company employee.

Corporate email belongs to the corp.
IMO.

the 5% that think company email is personal and should be private! Where are these numbnuts at???

http://techrepublic.com.com/5208-12852-0.html?forumID=102&threadID=308021&messageID=3071726

that s/he/it is more likely one that is doing lots of non-work with email and is now on the defensive due to 'others' opinions

Just like all the dope smokers want to legalize marijuana, the slackers want the company to not be able to make them work.

Some people have been skimming around it but the fact of the matter is you do expect and do have privacy with the corporate email system. You can not view another persons email with out their permission and excluding the equivalent of the police neither can anyone else. Very similar to what you can expect privacy wise with your house. The checks and balances are in place in most corporate environments to ensure your privacy is not violated willy nilly