30-40% of all personal Internet surfing is done by people at work and 70% of all pornography in is downloaded between 9:00am – 5:00pm according to recent research by John Savage of Beauchamps Solicitors.

A single employee will spend an average of 2220 hours a year surfing on the net on non-work related sites. It is impossible to evaluate how much this is costing Irish businesses but it must run into hundreds of millions of euro every year.

Not only are employees wasting time, they may be putting your companies business at risk by downloading pornography or engaging in criminal activity. An employee may unwittingly or otherwise download a virus and damage your system. The administrative and technical costs of repairing this damage are potentially enormous.

What if you suspect that an employee is involved in criminal activity, or using the companies’ facilities for improper behaviour? Ebay if his/her use of the telephone is to harass or intimidate another person?
Employers are entitled to protect their business, but can they engage in monitoring and surveillance of employees?

We live in an age where it is simple to tap an employee’s telephone, undertake surveillance of an employee by CCTV; hire a private detective to undertake surveillance or even track the employee by use of a Global Positioning System (GPS). Is an employer entitled to undertake these measures? Similarly, are employers permitted to monitor all of their employees’ Internet and email use, to read all employee personal emails and to record every Internet site visited by an employee?

Surveillance V Right to Privacy

The Irish Constitution guarantees Irish employees the right to privacy. The European Convention or the Protection of Human Rights and Fundamental Freedoms guarantees a right to privacy and a right to freedom of expression. This is now part of Irish law.
So how does an employer monitor employees without violating these rights?

Data Protection

If an employer monitors employees, the information received and stored is by law subject to regulation and protection under the Data Protection Acts. The Data Protection Commissioner is responsible for upholding the rights of individuals in respect of data privacy and is independent from Government.

The Data Protection Commissioner is of the view that prevention is more important that detection. Essentially, there must be:

N.B. REMEMBER: If you monitor your employees and retain the data, your employee has a right to access that data.

Employee Monitoring Policy

If it is intended to monitor employees, it is essential that employers have an effective Employee Monitoring Policy. The essential elements of this policy should address the following:

Pornography

This perhaps is the area in which Irish employers are most at risk. Systematic use of the Internet in the workplace by employees to search fro pornography is very widespread.

We remember well the resignation of Michael Soden as Chief Executive of the Bank of Ireland. His resignation arose from a leak to the Sunday Business Post that he had been found to have breached Bank of Ireland’s internet policy in accessing an adult escort agency website in This demonstrates how effective a clear and comprehensive Internet access policy can be. A dismissal in the absence of a clear email and Internet policy will almost always be deemed to be unfair.

The exception to this is when the pornography could be considered obscene. An example of this would be viewing, downloading or distributing child pornography, which could be grounds for summary dismissal (i.e. dismissal without notice).

Harassment

The policy should contain a section, which expressly prohibits harassment. Remarks or jokes sent my email can amount to harassment as with all harassment complaints; the intention of the party sending the email is not relevant. If an email has attached to it a pornographic image, a recipient may find it offensive. Material downloaded from the Internet and left displayed on-screen or passed around employees PC’s can also engender an environment that some employees may find threatening.

In a United Kingdom Employment Tribunal case of Morse of V Future Reality Limited a female employee shared a room with four male colleagues who regularly downloaded pornographic material and commented on it in her presence. Although these activities were not usually directed at her, they caused her to feel uncomfortable. She resigned citing the pictures, the bad language and the atmosphere of obscenity in the office as a reason for doing so. The Tribunal held the activities of her male colleagues constituted sexual harassment and the company was liable because it had taken no action to prevent the discrimination.

Defamation

Is the publication of an untrue statement which adversely affect a person’s or a company’s reputation. Publication may be of work of mouth, the telephone, the Internet or email. This should be specifically prohibited in the policy.

One of the most famous examples of how far an email can reach, is the Chait/Swire email in December 2000. Claire Swire sent an e-mail joke to her boyfriend, Bradley Chait, a solicitor in Norton Rose, a prestigious law firm in Claire Swire was the daughter of one of their biggest clients. The joke prompted a private conversation by email between the pair during which Swire made what would later prove to be embarrassing revelations about their personal life. Chairt shared the exchange with some of his best friends who in turn mailed the entire conversation to additional acquaintances.

Within 24 hours millions of people worldwide had received a copy of the e-mail. It appeared on the front of The Times in the Although Norton Rose sought initially to discipline Chait and his colleagues for sending the e-mail, no action was taken on the basis that no Internet or email policy was in place in the company.

Copyright

The owner of a copyright has the exclusive right in certain works such as documents, articles, books, plays and musical compositions so that they cannot be copied or used in certain ways without the consent of the copyright owner. A policy should prohibit an employee infringing copyright such as downloading pirated music or using pirated software.

Entering Contracts

In addition to this, if an employee is trading on sites such as eBay or Buy and Sell while on Company time, he/she is wasting Company time and in effect, working for another employer while being paid by the present employer.

Viruses or damage to company property

An unsupervised employee may inadvertently download a virus or worm, which infects or damages a Company’s system. While most anti-virus software will filter out viruses, they are far from foolproof. The policy should specifically state that such downloading is prohibited and whether inadvertent or otherwise, will be dealt with as a disciplinary matter.

CCTV or GPS Monitoring

Similar rules apply for monitoring of this nature. If you have CCTV cameras in operation in a workplace and the public have access, then it is important that a notice is displayed informing the public. If CCTV footage is taken of employees, then not only should the employees be put on notice of it, but they must consent to it.

Monitoring by a Private Investigator

There is widespread use of Private Investigators by employers to investigate fraud at work or malingering while on sick. A PI will be deemed to be a data processor under the Data Protection legislation. An employer should ensure that the information gathered by the PI is well protected. Similarly an employee has access to the written record of the information gathered by the PI and is entitled to view video surveillance footage.

Conclusion

Against the backdrop of increasing use of new technology to monitor employees, the frontier between private life and work life is becoming increasingly blurred.

To monitor employees, it is imperative that a monitoring policy is in place and has the consent of the employees. There is no point in having an excellent and comprehensive policy unless employees are informed of its contents and trained in its application. Similarly, the employer must consistently and uniformly enforce it. If the policy is not implemented rigorously by the employer or a “blind eye” is turned to some practices, then it will be a defence for an employee who is dismissed or disciplined as a result of breach of the policy to say that the Company was inconsistent in implementing the policy.

It is also very important that the consequences of breaching the policy are clearly explained to the employee. There have been a number of cases where it has been successfully argued by employees in their defence that although they were in breach of the policy, they were unaware of the consequences of that breach.

Finally any personal data processed in the course of monitoring must be adequate, relevant and not excessive and must not be retained for longer that necessary for the purpose of which monitoring is justified.