Employer Monitoring and the Right to Privacy

It can be seen from the comments of the OHCHR that monitoring of e-mail by employers will only be compatible with the International Bill of Rights in very specific circumstances. The CCPR requires that monitoring not be illegal or arbitrary; thus, all monitoring would have to meet not only legal standards, but also the required standards for the infringement of rights; that is, the infringement must be aimed at achieving good ends, it must be necessary to infringe upon rights in order to achieve those ends, and the good to be achieved by the infringement of rights must be proportional to the evil caused by the infringement. Since all infringements upon rights need to be justified on a case-by-case basis, monitoring of e-mail also would need to be justified case by case. This would seem to rule out virtually all monitoring of e-mail by employers , though there may be some exceptions to this in unusual circumstances. ^{[ 3]} Even if the e- mails were not being read by the employer, but rather were being scanned for particular terms, which has been seen as a way of protecting company secrets without requiring mass infringement of rights, this would be a form of arbitrary interception and interference with communication, which is also prohibited by the CCPR.

It could be suggested that since it is the employer s equipment that is being used to send e-mails, the employer has the right to monitor the way in which that equipment is being used and to exercise some control over the use of that equipment. While this may be true, it does not justify the practice of monitoring e-mails sent by employees, for monitoring e-mails sent by employees will infringe upon the employee s right to privacy, and there are many other ways in which an employer might exercise control over the use of their equipment that do not involve the infringement of the rights of others. As Miller and Weckert (2000) point out, employers have certain rights with respect to their employees, but employers are still constrained by the human rights of their employees. An employer cannot imprison, rob, or flog an employee simply on the basis of the employer/employee relationship, since these things infringe upon the employees basic human rights. Similarly, an employer cannot simply infringe upon the right to privacy of their employees .

There are other obvious examples that can be presented to demonstrate that mere ownership of equipment does not justify infringing the privacy of those using that equipment. Consider the example of the telephone. The mere fact that someone is using a telephone that I own does not give me the right to listen in on that person s conversation. In the same way, the fact that an employee is using their employer s telephone does not give the employer the right to monitor the employee s telephone calls. Again, as in the case of computer equipment, ownership of the telephonic equipment does give one the right to exercise some control of the use of that equipment, but there are many ways in which control can be exercised without monitoring calls. Employees could be informed that the business telephone is not to be used for personal calls without the approval of the employee s manager, for example. Or the use of the telephone system could be limited in certain ways, such as by blocking particular telephone extensions from making long distance phone calls. So in the case of computing equipment, an employer may control the use of that equipment in certain ways, such as by insisting that the equipment only be used for work- related purposes, or by restricting access to particular computing functions, ^{[ 4]} and the employer can exercise that control without resorting to infringing upon the basic human rights of its employees.

Perhaps the biggest difference between monitoring employees telephone calls and monitoring employees e-mail, is that it is technically feasible to monitor e-mail, in particular to scan e-mail for certain terms of special interest, in a way that it is not currently possible to do with telephone calls. As I hope I have made clear in the early parts of this chapter, the mere fact that it is technically possible to do something does not mean that it ought to be done. Thus, the difference between the technical feasibility of monitoring e-mail and the technical feasibility of monitoring telephone calls is not a moral difference.

General monitoring of employees Web usage also falls foul of the principles of the CCPR. In order for the monitoring of employees Web browsing habits to be justified, the infringement of the employees rights to privacy would need to be justified on a case-by-case basis in the usual way; the infringement is aimed at a good end, is necessary, and is proportional to the end being aimed at. The need for such justification rules out monitoring in all but the most extreme cases. ^{[ 5]} As was the case with e-mail usage, while ownership of the computing equipment that is being used may give the employer some rights to control the use of that equipment, effective control can be achieved without the employer resorting to monitoring of employees Web browsing habits.

Some people may wonder why Web browsing ought to be subject to any privacy considerations at all, since it is not generally considered to be a form of correspondence in the way that e-mail is. One answer to this objection is the fact that many e-mail programs are now Web-based, ^{[ 6]} which means that a reasonably large proportion of Web usage is actually a direct form of correspondence. Another response to this objection is to liken the World Wide Web to a giant library, and Web browsing to library use. Librarians have been concerned about protecting the privacy of library users for many years , probably since there is usually a strong connection between what people read and what they think. Thus, concern for protection of the privacy of what people read is, in effect, a concern for the protection of the privacy of their thoughts, one of the fundamental bases of the right to privacy (Miller & Weckert, 2000).

One other argument that has been raised in favour of monitoring employees Web usage is the issue of cost. Generally speaking, providing e-mail services to employees will be quite cheap, especially if there are limitations placed upon the size of acceptable attachments to e-mails. Providing Web browsing to employees is usually far more expensive, since it requires much greater bandwidth. Monitoring employee s Web usage is seen as a way of limiting this cost. This may be extremely important to the employer, since accessing high bandwidth sites can be a significant expense, as well as cause a reduction in the performance of the computing system as a whole. While these are genuine and important concerns, they do not in themselves justify monitoring employees Web usage, since there are other, equally effective ways of addressing these problems. This might include limiting access to specific Web sites, restricting employees to a particular download limit per month, and so on.

^{[ 3]} If, for example, there was genuine evidence that suggested that a particular employee was using the company s e-mail facilities for illegal purposes, then monitoring of that employee s e-mail may be justified. In most circumstances of this type, however, I would suggest that there would be justification for relevant law enforcement authorities to monitor the employee s e-mail, rather than for the employer to monitor the employee s e-mail. Even in these circumstances, it is likely that those law enforcement authorities would only be justified in monitoring e-mail sent to or received from particular e-mail addresses, rather than in monitoring all e-mail sent by the employee.

^{[ 4]} Restrictions on particular computing functions are a common means of control. For example, computer users may require special access privileges in order to install programs onto the machines that they use, access to the World Wide Web may be constrained (such as by only allowing employees to access pages on the company s own Web site), e-mail access may be restrained to allow the user to only send mail to a particular range of addresses, and so on.

^{[ 5]} As with monitoring of e-mail, while there may be cases where monitoring of the Web usage of particular employees may be justified (such as if the employee is using company facilities to download illegal material), it usually will be the case that the justification is present for law enforcement authorities to monitor the Web usage of the employee, rather than for the employer to monitor it.

^{[ 6]} This includes obvious Web-based e-mail services such as Hotmail, as well as the remote Web-access services provided by most ISPs that allow users to access their e-mail while away from their main computer.