Canada: Employee E-Mail Use: Big Brother May Be Watching

According to a recent U.S. survey by the American Management Association (AMA), 26% of employers have terminated employees for e-mail misuse. Another 2% have terminated employees for inappropriate instant messenger chat and 2% have terminated employees for posting offensive blog content from a company or home computer. Other surveys have shown that employers regularly audit outbound email and employ staff that read and analyze outbound e-mail content.

In Canada, e-mail monitoring by employers is on the rise. Companies are spending both the time and money to ensure that employees are using e-mail appropriately. Advances in technology allow employers unprecedented opportunity to monitor employees. Common reasons for monitoring include: safeguarding confidential information, preventing harassment, discrimination or misconduct in the workplace, improving productivity, and preventing downloading of pirated software. In extreme situations, misuse of email could constitute criminal activity under the Criminal Code, such as criminal obscenity (s. 163), hate propaganda (s. 139), or criminal harassment (s. 264).

Although the law recognizes the employers' right to monitor employees, employers are charting new territory as they test the boundaries of what constitutes reasonable surveillance. Employees may be surprised to know that an employer can monitor internet use, inbound and outbound e-mails, record keystrokes, take screen shots and monitor the length of time spent on applications or documents. In Re Parkland Regional Library¹, the Library surreptitiously installed keystroke logging software on an employee's computer after the employee received a poor performance review. The information collected could determine how much work the employee did, his style or manner of doing it, and his choices as to how to prioritize it. The Alberta Information and Privacy Commissioner held that the employer did not have the authority to collect information through keystroke logging, noting that less-intrusive means were available for collecting information to manage the employee.

In order to justify surveillance of emails, it is important for employers to demonstrate that the surveillance is reasonable. This includes ensuring that the surveillance is carried out for a valid purpose, is necessary, and not in breach of an employee's expectation of privacy. And, as the Parkland Regional Library case demonstrates, where less intrusive means for monitoring performance are available, they ought to be considered first.

In assessing a valid purpose, surveillance conducted for "random virtue testing", i.e. providing an opportunity for employees to commit an offence, will likely not be considered reasonable. For example, an employer that removes instant messenger chat from its workplace server after advising employees that they will be disciplined for using instant messenger chat, should not thereafter allow access to instant messenger chat solely to test if employees are obeying the rules. As well, continuous and general monitoring of an employee's e-mails to investigate all aspects of an employee's use of time, character and interests, would not be reasonable. In contrast, monitoring in response to a particular workplace complaint regarding an employee's use of e-mail would be considered reasonable.

It is imperative that employees be advised that their e-mails are being monitored to counter arguments that the employee had an expectation of privacy with respect to their e-mails. In Re Treasury Board (Solicitor General Canada – Correction Service) and Briar et al.², fifty or so employees were disciplined for circulating offensive e-mails in contravention of a well-known workplace policy. The arbitrator concluded that the employees knew, or ought reasonably to have known by common sense, that their conduct was against a well-communicated policy permitting monitoring. The arbitrator held that the employer had a duty to act on the complaints that employees were using their computer network to distribute offensive materials against company policy. In these circumstances there was no reasonable expectation of privacy.

According to the AMA survey, a number of employers have not implemented an e-mail-use policy despite their constant monitoring and an even greater number of employers have not trained their employees about e-mail risks and company policy on e-mail use. All employers should implement a policy, ideally by providing employees with notice, and obtain the consent of employees to monitor. The Ontario Information and Privacy Commission asserts that an important part of notice includes educating employees on the perils of e-mail communications, not only from a personal perspective but from a general business liability perspective.

A monitoring policy should include the following:

1. the purposes for which e-mail may be used;
2. the prohibited uses of e-mail (i.e. downloading any material, sending sexually explicit content, hate material or any offensive material);
3. the range of penalties for violating the e-mail policy;
4. the employer's property rights claim over physical and intellectual property;
5. the method and frequency of monitoring, including what information is collected, how it is stored and who has access;
6. reminder to the employee of his or her duty of loyalty and duty of non-disclosure of confidential information; and
7. a link between the e-mail use policy and internet policy to harassment and discrimination policies.

Finally, employers should ensure that monitoring is conducted by a wellinformed individual that understands that the employer may have a legal obligation to safeguard personal information of the employer's clients or third parties. For example, organizations that manage personal information, such as medical records, must ensure that such information is not further disclosed or compromised through the process of monitoring and storing such information.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.