Survey Offers Insights on Handling Workplace E-Mail

Almost 10% (9.4%) of U.S. companies have been ordered by courts to produce employee e-mail, and 8.3% have battled sexual harassment and/or sexual discrimination claims stemming from employee e-mail or Internet use.

According to the 2001 Electronic Policies and Practices Survey, a new study from the American Management Association, The ePolicy Institute and US News & World Report, employers have become increasingly aware of the dangers in workplace computer use and are taking steps to reduce their liabilities. Of the 435 employers surveyed, 61.6% exercise their legal right to monitor employees’ e-mail and Internet connections. Among employers who monitor, 68.3% cite legal liability as the primary reason to keep an eye on employees’ online activity.

“To reduce liabilities, protect corporate assets, and stay out of court, employers must manage employees’ online behavior,” says Nancy Flynn, author of The ePolicy Handbook (AMACOM Books 2001) and executive director of The ePolicy Institute (www.ePolicyInstitute.com), the survey’s co-sponsor. “Written e-policies and monitoring software are indispensable business tools for employers operating in the age of e-mail and the Internet.”

Monitoring is an effective e-risk management tool, but it cannot eliminate all workplace liabilities, according to the AMA. While the federal Electronic Communications Privacy Act (ECPA) allows employers to monitor all e-mail traffic and Internet activity on the company system, it does not always prevent outraged employees from filing invasion of privacy claims. Flynn advises employers to use written e-mail, Internet and software policies to give explicit notice that:

Employees do not have a reasonable expectation of privacy.

The company has the right to monitor anything transmitted or stored on its computer system.

Management intends to exercise that right.

Staff Acknowledgement

Business is apparently doing a good job of notifying employees of monitoring activity, privacy rights and electronic ground rules. Nearly 84% of survey respondents notify employees of the organization’s legal right to monitor online activity. Among those monitoring, 86.9% have a written e-mail policy, 83.1% have an Internet policy and 67.5% have a software policy.

However, barely half (50.6%) of employers require staff to acknowledge e-policies in writing. “Stave off invasion of privacy and wrongful termination lawsuits by securing employees’ written consent to have their electronic messages read,” says Flynn, who advises employers to have employees sign and date e-policies to demonstrate they understand them and accept personal responsibility for compliance.

Only 35.4% of employers have a document retention and deletion policy. “An employer who retains e-mail on a yearly basis, rather than the recommended 30-day period, could spend six-to-seven figures searching backup tapes in the event of a lawsuit. That’s money spent before ever stepping foot in the courtroom,” Flynn says. Because it’s illegal to begin a document destruction campaign if pending litigation would be affected by it, employers should establish e-mail retention and deletion policies before trouble strikes.

Personal Use

Survey results on personal use of company e-mail and Internet systems reveal that 39.3% allow employees full and unrestricted use of office e-mail, while only 11.7% grant staff the same unrestricted access to the Internet. Among companies that allow personal Internet use, 65.3% restrict access to Web sites, with 76.6% of employers most concerned about keeping explicit sexual content off employees’ screens.

While employers’ worries about keeping sexual content off employees’ screens are commendable, Flynn suggests employers exercise equal control over other recreational surfing as well. “Hours lost to shopping, chatting and gambling online have the same impact on productivity as time spent downloading pornography,” she says. “Reduce liabilities by taking a comprehensive look at—and restricting access to—all non-business sites visited by employees.”

In spite of employers’ efforts to monitor online behavior, only 23.9% of companies have training programs designed to educate employees about e-liabilities and e-policy compliance. According to Flynn, effective e-risk management combines three equally important activities:

Development of written e-mail, Internet and software policies.

Establishment of a continuing education program for all employees, from the CEO to student interns.

Installation of software that monitors, filters or logs employees’ online activity.

“Employers cannot expect employees to recognize electronic risks or comply with e-policies on their own. Ongoing training is critical to the success of an e-policy program,” she says.

Set Standards

Finally, employers should know that one of the best ways to control risk is to control content. “Settle for nothing less than good clean content, free from harassing, menacing, threatening, obscene, discriminatory or otherwise offensive language, and you’ll be on your way toward a safe and secure electronic workplace,” Flynn says.

A copy of the survey and a review copy of The ePolicy Handbook are available at: