Monitoring Email Use
As in most areas of institutional life it is comparatively easy to draft and approve policies, such as the Email Acceptable Use Policy mentioned in the previous section. However, it can often prove far harder to actually ensure that the policy is being adhered to. It also raises the question of what the institution will do if and when it discovers user activity which is in breach of its policy. Thanks to the concept of vicarious liability outlined in the section of email disclaimers the institution is liable for the actions of its employees. In legal terms having a policy which is generally ignored and widely flouted is unlikely to be considered much of a defence against any claims of culpability.
However, the institution must also ensure that any actions it takes to monitor the email activities of its staff are also legal and conform to all relevant legislation. Otherwise not only will the institution find itself unable to take appropriate measures against any users found breaching the rules, but may even find themselves on the wrong side of the law with action taken against them accordingly. The key pieces of legislation to consider in this area are:
- The Regulation of Investigatory Powers Act 2000
- The Human Rights Act 1998
- The Data Protection Act 1998
The JISC Legal Information Service contains specific guidance relating to the monitoring of electronic communications as well as more general information about such. These include:
- Interception & Monitoring Law (webcast)
- Interception & Monitoring Law (transcription)
- Interception & Monitoring Law (FAQ)
- Data Protection Act 1998
- Monitoring Internet Use
As stated in all of the above sources, these are intended as legal information only and it is advised that institutions seek their own legal advice in relation to specific issues.
Further information is also available from the Office of the Information Commissioner
