Vetting and Monitoring Employees

A Guide for HR Practitioners

Gillian Howard

• Publisher: Routledge
• Year: 2017
• ISBN:
  9781351143387
• Edition: 1
• Topic: Business
• Subtopic: Business General
• Index: Business

Most employers will at some time need to monitor, record and read e-mails sent and received by their staff, or check on their employees' use of the telephone and internet, or access business correspondence received at work but addressed to a member of staff. There may also be clear cases where covert surveillance either by video camera or private investigators is considered as a means to collect evidence of criminal activity on site. The law in this area is complex and, in some cases, contradictory. Gillian Howard aims to set out the law clearly and give practical guidance, both to employers as to their legal rights, and to employees as to what safeguards to their privacy the law gives them. She provides precedents and useful examples of policies and procedures for monitoring employees at work. Vetting staff before taking them into employment can be equally fraught with legal issues. The Data Protection Act 1998 requires employers to obtain explicit consent from an employee before seeking and using certain sensitive information. This book gives guidance in this difficult area of employment law with practical advice, precedents and policies, and details of legal interpretations of the law by the Courts and Employment Tribunals.

Chapter 1
Introduction

General Legislative Framework

The laws relating to employers’ rights to monitor the use of the internet and email, monitor and record telephone calls, secretly record their movements whether at work or out of work and discipline them for breach of the rules, are complex and wide-ranging. Here are some of the most important:

• The Regulation of Investigatory Powers Act 2000 (RIPA) outlaws, except in certain circumstances, employers’ rights to monitor, inspect and record emails, internet use and telephone calls at work.
• The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (Lawful Business Regs) provide ‘gateways’ through which employers may lawfully monitor and record their employees’ calls, emails and internet use.
• Data Protection Act 1998 (DPA) and Codes of Practice (four parts) provide the framework for employees’ rights not to have personal data about them misused or disclosed by their employer to unauthorised sources.
• Computer Misuse Act 1990 makes it a criminal offence to ‘hack in’ to data held on computers.
• Protection from Harassment Act 1977 makes it a criminal offence to stalk or otherwise harass someone.
• Equal opportunities legislation that is, Sex Discrimination Act 1975; Race Relations Act 1976; Disability Discrimination Act 1995; Employment Equality (Religion or Beliefs) Regulations 2003; Employment Equality (Sexual Orientation) Regulations 2003 outlaw discrimination on these grounds.
• Employment Rights Act 1996 (ERA) in this context regulates the fairness or otherwise of dismissals.
• Defamation Act 1996 defines defamation and includes corporate liability for information transferred via the internet and other electronic means and the permitted defences.
• Human Rights Act 1998 – in this context we refer to Article 8 the right to respect for private and family life and correspondence; Article 9 the Freedom of Thought, Conscience and Religion and Article 10 the Freedom of Expression.
• Obscene Publications Acts 1959 and 1964 define ‘obscenity’ and make it a criminal offence to publish material that has a tendency to deprave or corrupt persons.
• The Telecommunications Act 1984 makes it a criminal offence to send any indecent, menacing or obscene message through the public telecommunication system.
• Protection of Children Acts 1978 and 1999 make it a criminal offence to take or distribute indecent photographs of children and provide for a register of persons unsuitable to work with children.
• Public Interest Disclosure Act 1998 now S43A of ERA protects employees who make ‘protected disclosures’ that is, who are whistleblowers on fraud and other matters.

Employers are potentially at risk for a wide range of civil and criminal offences. Understanding the legal complexities of monitoring and recording workers’ telephone calls and reading their emails, investigating their use of the internet, using covert surveillance on them and the introduction of practical policies which are well known to all staff and workers on site, should help in navigating these difficult waters.

As Lord Denning once said about the Treaty of Rome 1957 (now the Treaty of Maastricht 1992) ‘the Treaty is like an incoming tide. It cannot be held back…’.

It is important for employers and employees to understand these legal liabilities and their duties and obligations. Below we summarise a few of the important legal and ‘cyber’ definitions.

History

The Security Service in the UK (commonly known as MI5) has had a long and colourful history operating since the beginning of the twentieth century monitoring and vetting devices in order to safeguard national security. In 1909 Captain Vernon Kell of the Army and Captain Mansfield Cumming of the Royal Navy formed the Secret Service Bureau (SSB) which was then split into two arms – one headed by Kell called ‘K’ who was in charge of counterespionage at home and the other arm ‘C’ headed by Captain Mansfield Cumming responsible for obtaining intelligence abroad. This latter activity is now performed by MI6 (in which the famous fictional spy James Bond served). Other departments under the Directorate of Military Intelligence under which the SSB came in 1916 were those such as code-breaking, aerial reconnaissance, propaganda and censorship.

Today MI5 employs around 1900 staff and has four main functions – to carry out espionage, counteract terrorism, combat serious crime and the vetting of certain foreign nationals who come to the UK to study at university as British universities have access to and help develop modern technology.

Civil servants are subject to positive vetting (PV) since January 1952 when the Government of the day decided to introduce a procedure ‘for ensuring the reliability of government staff employed on exceptionally secret work, especially work involving access to the secret information about atomic energy’.

This included obtaining oral and written references from those well known to the individual in their private life, their close relatives, the organizations and associations to which the individual belongs. At least two referees must fall into this category as well as references from employers.

Electronic Tagging

Some employers are even using electronic tagging to monitor the whereabouts and the work output of their staff.

The General and Municipal Boilermakers’ Union (GMB) has reported that workers in warehouses and distribution centres are being required to wear microcomputers fitted to their bodies.

This electronic tagging is supposed to reduce costs and increase efficiency. It works by way of a satellite which beams the radio waves to a central station where the employee can be monitored.

A very interesting article on this matter has been written by Jeffrey Jupp at 7 Bedford Row, ‘Tagging – a technology too far?’, in July/August 2005 edition of Employment Law Journal.

Chapter 2
The Law on Monitoring Telephone Calls and Emails and Internet Regulation

Introduction

There is no reason why employers should not lawfully monitor their employees both for business reasons and to protect themselves from liability under the anti-discrimination legislation and the laws of defamation. Employers are vicariously liable for the acts of their employees committed in the course of employment – both at common law and under the anti-discrimination legislation (s.41 of the Sex Discrimination Act 1975; s.32 of the Race Relations Act 1976, s.58 of the Disability Discrimination Act 1995, Regulations 22 of the Employment Equality (Sexual Orientation) Regulations 2003 and Employment Equality (Religion or Belief) Regulations 2003) as well as for defamation. This is because of the relationship of Principal and Agent rather than on the basis of vicarious liability.

An employer is vicariously liable for negligent acts or omissions of their employees acting in the course of employment, whether or not such act or omission was specifically authorised by the employer. To avoid vicarious liability, an employer must demonstrate either that the employee was not negligent in that the employee was reasonably careful or that the employee was ‘on a frolic of their own’ rather than on the employer’s business.

It is rare for the courts or tribunals to find an employee on a frolic of their own. In one case where employees committed racist or sexually offensive acts, branding a black colleague and calling him ‘chimp’, ‘monkey’ and ‘baboon’ (Jones v Tower Boot Co Ltd [1997] IRLR 168 Court of Appeal), the Court held that the employer remained firmly fixed with vicarious liability even though the employees concerned were not employed to brand their colleagues or to make offensive racist statements.

Statistics

According to Personnel Today on 9 July 2002, 25 per cent of dismissals concern the misuse of the internet and of those, 69 per cent relate to downloading pornography. Cyberskiving, that is, employees wasting their work time on the internet, was also high on the list of complaints by employers with 40 per cent of companies referring to this issue in the survey and 9 per cent of these complaints concerned discriminatory emails.

Reasons Why Employers May Wish to Monitor and Record Communications at Work

Firstly, for sound business reasons the employer may wish to monitor and control what employees are writing or saying by telephone. Legally binding contracts can be formed either orally or in writing by email.

Secondly, some dishonest employees may try to disclose or ‘sell’ confidential information or may be involved in other dishonest activities, using the telephone or email system at work to do so.

Thirdly, employees who post defamatory notices on websites, orsending offensive or libellous emails (sometimes with offensive attachments downloaded from the internet) can lead to serious legal penalties for the employer.

Fourthly, there may be health and safety reasons for example, where workers work alone or in isolated locations.

Fifthly, employers may seek to protect their workers and customers by recording telephone calls (to ensure that there is a faithful record of what has been said) and monitoring emails in order to prove whether an order was sent and received and so on, if done by email.

The Law

There are several statutes and sets of regulations and a Data Protection Code of Practice regulating the legality of monitoring and/or recording telephone calls, emails and the internet at work and using closed-circuit television (CCTV) to record and monitor the activities of those at work.

RIPA

The Regulation of Investigatory Powers Act 2000 (RIPA) was enacted in 2000 as part of the UK’s response to Article 5 of the Telecommunication Data Protection Directive (EU 97/66). The Directive established the basic principle that communications cannot be intercepted unless there are reasonable grounds for believing that both the sender and the intended recipient have consented to the interception.

The Act established a legal framework for carrying out surveillance and other forms of intelligence gathering.

The Act created criminal offences in connection with the unlawful interception of communications on a public or private telecommunication systems and a civil offence based on the tort of unlawful interception of telecommunications. A civil action can lead to an injunction restraining the unlawful interception and/or damages for any financial loss suffered

The Act therefore covers telephone conversations, faxes, emails and internet communications. Video surveillance or other forms of covert surveillance may be covered depending upon the system used.

The only exclusion would be a free-standing intranet (internal company) system, not connected to a public telephone network.

Mobile and wireless application protocol (WAP) telephones are also not covered by the Act.

The Regulations

The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 - SI 2000/2543 (the Regs) provide ‘gateways’ through which employers may lawfully monitor telephone calls and so on.

Data Protection

The Data Protection Act 1998 (DPA) and in particular Part 3 of the Code of Practice published under the Data Protection Act 1998 covers any personal data and gives individuals at work additional protection from unlawful ‘snooping’. The Code of Practice (Part 3) gives guidance to employers as to how they may lawfully monitor calls, faxes and emails and so on, and use covert surveillance.

The Human Rights Act 1998 (HRA)

The HRA provides, under Article 8(1) for the ‘right to respect for an individual’s private life, family life and correspondence’.

Guidance

The Home Office

The Home Office has produced its guidance on covert surveillance for the purposes of Regulation of Investigatory Powers Act 2000.

OFTEL

OFTEL’s guidance covers the recording of telephone calls.

The Regulation of Investigatory Powers Act 2000 (RIPA)

RIPA reflects the changes which have taken place in the communications industry over the last 15 years. It also ensures that the UK’s interception regime is compliant with Article 5 of the Telecommunication Data Protection Directive EU 97/66 which requires member states to protect the confidentiality of communications.

The basic principle is that communications may not be intercepted unless t...