Ensuring Appropriate Email Use
As we have already seen, the flexibility of email has led to a user culture where email is routinely used for a variety of formal and informal purposes. It is therefore vital that the institution clearly defines what is and isn't 'acceptable use' of email and that users are informed of the distinctions.
Appropriate Use Policy
Formulating an email appropriate use policy provides an essential cornerstone of this strategy. Without a clear definition of what is and isn't acceptable the institution will not be able to demonstrate that responsibility for any breaches of the law rests with the individual and not the institution. It is also less likely that the institution will be able to take punitive measures against any staff found using email inappropriately.
Some categories of inappropriate content/use will be easier to define than others. The table below includes categories of email which will need consideration when formulating an appropriate use policy - whether they are deemed 'inappropriate' will, in some cases, be dependent upon local circumstance. As the table below makes clear, inappropriateness might equally be judged according to whether email is considered the safest, most appropriate format for transferring what is actually perfectly 'legitimate' content.
Table below - categories of email content which may be deemed inappropriate
| Category | Examples |
| Malicious | Viruses, worms, Trojans etc. |
| Illegal | Pornography, terrorism/extremism, libellous |
| Offensive | Sexist, racist, harassment, bullying |
| Sensitive personal data | Disciplinary matters, health/medical information etc. |
| Commercially sensitive data | Financial information, contractual negotiations, intellectual property |
| Personal use | Online shopping, gossip, arranging social life, etc. |
Making Staff Aware
It is an important first step to formulate what is and isn't acceptable use into a policy, but this alone is not sufficient. The most obvious additional requirement is that staff are informed and regularly reminded of the policy and its contents. The policy should be endorsed by senior management and distributed to all users bearing this official endorsement. Including it as part of induction packs for new starters will ensure all new staff also receive it. Its content should form part of any IT user training (e.g. as part of Introduction to Outlook courses) and links to it should be provided from the institution's webmail service home page and the intranet.
Enforcement
Breaches of the policy should be stated as a disciplinary offence and potential grounds for dismissal within staff contracts. Consideration should also be given to internally publicising breaches of the policy and any measures taken as a warning to others.
