The employer’s managerial prerogative and the Personal Data Act
The employer’s access to employees’ e-mails and other files are regulated by the Personal Data Act. The employee’s consent or a balancing of interests pursuant to section 8, litra f, of the Personal Data Act, is the most commonly applied legal basis for such access. The employer may, due to its managerial prerogative, decide that an employee may only use the enterprise’s data processing systems for job-related purposes. However, an employer may not reserve the right to read all e-mails entering into or sent from the enterprise’s system. One reason for this is that an employee cannot control what comes into his/her e-mail box. There is for example no guarantee that an employee’s acquaintance will not use his/her e-mail address at work to send photographs of last weekend’s fishing trip. Such photographs are private, and the employer will have no objective justifications for accessing them. The employer may, through regulations or instructions, reserve the right to delete any private messages entering into the enterprise’s e-mail system. In such cases, common courtesy requires the employer to notify the sender that the e-mail has been deleted. It would also be reasonable that the employee to whom an e-mail is addressed is notified when the e-mail is actually deleted.
Most employers think it is all right that employees use the system for certain private purposes. Most employees therefore use their employer’s data processing system for both job-related and private business. Private business may for example be sending messages to acquaintances by e-mail, or using a home computer owned by the employer to write private letters. From time to time, the question arises of whether an employer may check what an employee has done on the data processing system, to whom he/she has written, what has been written, etc. This type of problem usually comes up because
· The employee is for some reasons (such as illness or holiday) absent from work. The employer may then have an objective need to check that no enquiries or orders are left unanswered.
· The employer suspects that an employee is acting disloyally. Examples of this may be a suspicion that information is being passed on to competing companies.
· The employer suspects that an employee is acting in conflict with the enterprise’s instructions and regulations or Norwegian law. An example is forwarding films with undesirable or illegal contents by e-mail.
The enterprise must have clear guidelines for use of the data processing system
An employer’s access to employees’ e-mail boxes at work may to a certain extent be compared to an employer going through the contents of its employees’ mail shelves. There will be situations in which the employee will have an objective justification for going through the mail shelves to look for enterprise-related mail. One reason for this may be that the employee has been absent for a long time. The same applies to the employee’s e-mail box.
Rules or instructions for using the data processing system must be available at the place of work. These rules or instructions must indicate to what extent use of the system for private purposes is permitted. They must also indicate the situations in which employees must expect the employer to check their e-mail box or files in their area on the computer. This information must form part of the enterprise’s internal control system. It is important that employees are kept well informed of the guidelines, so as to be able to comply with them. If, for example, the staff has been notified that the enterprise will check e-mail boxes for new orders once a week when employees are on holiday, they will be able to make sure that their incoming e-mails are sorted in the e-mail box, so that the employer will not need to access their private e-mails. The guidelines could for example instruct employees to sort their e-mails in this way. The employer’s right of access to e-mail boxes must be exercised with care, as they differ from ordinary mail shelves because it is more difficult to distinguish between private information and enterprise-related information. The employer should therefore ask for the employee’s consent to check an e-mail box before he/she goes on holiday or while he/she is on sick leave. One problem is that automatic preview of e-mails is often used, so that the employer may get access to more information than that which it has objective justifications to see. The preview function may in this case be disabled.
The employer will as a rule not have any objective justifications for access to obviously private information in e-mails and files. Nor has an employer in principle any right to ask for consent to such access. However, the major problem is most often deciding whether an e-mail or file is private or enterprise-related. Read more about this below.
What is meant by a private e-mail box?
Most enterprises use e-mail addresses with the employee’s name, initials or the like in the address, and then the name of the enterprise, such as john.doe@enterprise.no or jd@enterprise.no. Employees who log in with their own user name and password will be justified in expecting that this e-mail box will not be handled by other persons, unless otherwise clearly agreed with the employer. This is what is meant by private e-mail boxes in this context.
Obviously, this also applies to e-mail boxes of the type hotmail.com or c2i.net, which have been created by the employee as a private individual. Some enterprises forbid the use of this type of e-mail boxes in their data processing system. The employer may do this by virtue of its managerial prerogative.
Some enterprises use this type of e-mail addresses in relation to work. In that case, the right of access to and the distinction between enterprise-related and private e-mails must be clearly specified in the guidelines. The reason is that such addresses are normally used for private purposes.
E-mail addresses of the type mailbox@enterprise.no or salesdepartment@enterprise.no clearly appear to be enterprise-related. Neither the sender nor the receiver of the e-mail will be justified in assuming that e-mails sent to such addresses will be treated as private mail. However, this could be more questionable if the sender has marked the e-mail with a named employee or has written “confidential” or the like in the subject line. In such cases, the Data Inspectorate recommends that the employee in question is consulted before others open the e-mail.
If an employee is allowed to have two e-mail addresses (john.doe@enterprise.no and john.doe.private@enterprise.no), this could reduce the problem of distinguishing between private and enterprise-related information. Routines for marking private e-mails or files as “private”, or placing these in separate folders, could also be useful. Nevertheless, situations may arise in which a file is for example wrongly saved. There is no guarantee that problems will never arise.
The procedure for access to enterprise-related e-mails
An employer may have an objective need to access the employee’s e-mails and files. If rules and guidelines have been prepared for situations in which the employer may exercise this right of access, and the employees are aware of this, this will be sufficient to allow the employer to read enterprise-related e-mails and files. If there are no such rules or guidelines, the employee must give his/her consent.
Even with rules and guidelines, it is important that the employer to the greatest extent possible informs the employee in advance that access is desirable. If the employee is available, he/she should be given an opportunity to sort out which e-mails and files that are enterprise-related and which are private.
If the employee is absent, it is essential that the assessment of whether the information is private is made before the e-mail or file is opened. If it appears to be private, it must not be opened. However, at times the employer may make a misjudgement and accidentally open a mail or file, which then turns out to be private. In this case, the file must be closed as soon as possible. If an employee is absent, an employee representative should always be present at the opening of his/her e-mail. The employee should, moreover, subsequently be informed of what the employer was seeking to access.
What are the decisive factors in determining whether an e-mail or file should be considered as private?
A specific, general assessment must be made of whether the e-mail or file is most probably private or enterprise-related. Factors in this assessment will include whether the information is marked private or the like, who the sender or receiver is and what title has been used. The employee’s contention that it is private must be given weight in this assessment, but will not necessarily be decisive if other factors suggest the opposite. If the e-mail or file is marked as private, in conformity with the enterprise’s internal rules or instructions, this must also be taken into account. Moreover, each specific situation will be important in deciding what factors should be given weight.
The enterprise’s rules or guidelines should preferably describe the criteria that will form the basis for assessing the issue of access. It should also contain information on how e-mails and files should be marked, if required, to distinguish between enterprise-related and private e-mails and files.
What happens if the employer believes that a private e-mail or file has contents contrary to internal instructions or Norwegian law?
The employer is responsible for its data network and consequently responsible for ensuring that it is not used for illegal purposes. If an employer suspects an employee of using the system to distribute child pornography or other illegal material, for example, the matter should always be reported to the police. It is important to bear in mind that an employer could easily destroy evidence in any forthcoming criminal proceedings if access is made without taking the necessary precautions. It is therefore particularly important that the police is contacted in this type of cases.
From time to time an employer may suspect an employee of using the system for disloyal conduct or in conflict with internal rules and instructions. Such suspicions may often be directed at the contents of what must in principle be characterised as private e-mails and files. If the employer has good arguments for substantiating its suspicions, the requirement to objective justifications for access could be regarded as having been met. In specific cases, the employer’s interest in access may also be considered as weighing more than the employee’s right to privacy, so that access may occur without the employee’s consent.
Weight could be attached to many factors in this balancing of interests. What the suspicions concern would, for example, be important, and the circumstances which the employer wishes to clarify should be serious enough to entail dismissal. What lies behind the suspicions will also be significant. Moreover, the employer must always consider whether such suspicions could be confirmed in a manner representing less of an infringement of the right to privacy. Furthermore, it must be considered whether the employee has been informed of the written procedures for obtaining access. The Data Inspectorate recommends allowing the employee and an employee representative or other representative to attend the opening of e-mails or files. If the situation makes it difficult or impossible for the employee to be present, a representative of the employee should be there. The considerations on which access was based should be recorded.
How should e-mails be dealt with at the termination of an employment relationship?
An employer has no objective grounds for maintaining e-mail boxes in the name of persons no longer working in the enterprise. The e-mail box should therefore be deleted as soon as possible after the employment relationship has been terminated. The enterprise will, of course, need to ensure that it receives enterprise-related e-mails that have been or will be sent to the person who has left. Therefore, an employee should, before leaving, sort out his/her own e-mails and files, so that those relating to the enterprise may be taken care of.
With regard to e-mails sent to an employee who has left, the employer may not automatically forward these to a new case officer without the consent of the employee who has left. This is because private e-mails could also be forwarded. The employer may, on the other hand, ensure automatic deletion of incoming e-mails, combining this with a message that the person concerned is no longer working in the enterprise. Such a message could also contain the new address for enterprise-related e-mails.
By agreement between a former employee and the enterprise, the e-mail box may be maintained for a limited period, and e-mails forwarded to a new address, if required.
Access to employee e-mails and files in case of death
This question must be decided in each specific case. The employer may probably search for enterprise-related mail in these cases. With regard to the employee’s next of kin or heirs, they may not automatically be given access to the deceased’s private e-mails and files.
The decedent’s estate will be subrogated to the decedent’s financial obligations and other matters. An e-mail is probably not such an obligation, and a restrictive attitude should be adopted in granting access to the estate. Handing over information from the data processing system to the police for investigation purposes is considered unproblematic, on the other hand.
What may be the consequences of access in conflict with the Personal Data Act?
An infringement of the Personal Data Act may entail an order and possibly a coercive fine from the Data Inspectorate, or liability for damages. Any person who wilfully or through gross negligence infringes the Act may in addition be liable to fines and possibly imprisonment if the matter is reported to the police. Printouts of files and e-mails have on several occasions been produced as evidence in connection with employment proceedings. A court of law may accept such evidence even if it has been obtained unlawfully. However, experience shows that the courts will to a large extent assess whether such evidence has been produced lawfully, and will normally exclude evidence obtained unlawfully. It is therefore important that the enterprise establishes good routines, in conformity with the statutory requirements.
The Data Inspectorate’s guidelines for its own employees
The Data Inspectorate has guidelines for the e-mails and files of its own employees. We publish these to offer enterprises and others an example of how such guidelines may look.
The Data Inspectorate’s guidelines for use of the Internet and e-mails
The Data Inspectorate has on several occasions urged all enterprises to prepare guidelines for employees’ use of computer systems. Here you may read the Data Inspectorate’s guidelines for its own employees.
The Data Inspectorate’s guidelines for employees’ use of the data system are incorporated in its internal control system. Here you will find excerpts of the provisions relating to the use of the Internet and e-mail, home computers and portable equipment. We would like to underline that each employer must draw up guidelines adapted to the needs of its own enterprise, and that this should be done in a dialogue with employees. It is not least important to ensure that such guidelines are made known to everyone that may at any time be affected by them.
Instructions for the use of the Internet:
Requirement to due care:
· Your starting point is that you are never anonymous on the net and that all communication on the net may be traced back to the machine you are using in the Data Inspectorate.
· As long as you are in the premises of the Data Inspectorate and use its information system, you will be defined as logged on in an official capacity.
· The fact that you are employed in the Data Inspectorate places you under a special obligation regarding good ethics. You must therefore carefully reflect on any searches and downloads of material you make. You must also show special care about what you communicate externally.
· The Data Inspectorate’s policy is not to “monitor” each employee’s use of the Internet. It is assumed that such use is in conformity with the guidelines established. However, you should be aware that security logs may contain information about traffic relating to individuals. These security logs are reviewed regularly by the security manager. This review takes place at management level. If a data protection offence is suspected, security logs may form part of the basis for assessing the offence. In case of access to personal data in logs, the method for access to e-mails must be used.
· The Data Inspectorate permits limited private use of the Internet, though this must in now way come into conflict with the basic rule in bullet point two, which requires due care to be taken.
· Virus control of downloaded files must always be made before such files are used on the Data Inspectorate’s information system.
· No programmes or sound and picture files (for example shareware, MP3 files and films) may be downloaded to your computer unless they may be considered as job-related. This does not apply to attachments received in e-mails.
· No use of chat programmes, messenger, ICR, etc is permitted.
The following is considered as a breach of your employment contract:
· Searches for or downloads of material from websites you know, or should have known, contain unlawful material. To the extent this is necessary in connection with case processing, your immediate supervisor must have consented to this, in consultation with the security manager.
· Infringements of copyrights (texts, programmes, pictures), attempts at hacking or other unauthorised access to other information systems.
Instructions for the use of e-mail:
What must be done:
Each employee must use electronic mail with due care. Electronic mail must, unless it has been encoded, be considered as being relatively easily accessible to third parties.
The following rules apply:
· No sensitive personal data must be sent by electronic mail. E-mails containing sensitive information must not be distributed, commented on or answered.
· To the extent e-mails with sensitive material have been sent to the Data Inspectorate, such messages must as soon as possible be printed out and registered as a case. The original message (and any copies of it) must be deleted.
· Attachments to e-mails must not be opened, unless the e-mail comes from a sender which it is reasonable to assume would wish to have enterprise-related contacts with the Data Inspectorate.
· The preview pane should not be used, as this may lead to undesired access to e-mails, and may also make virus attacks easier.
· Starting or forwarding chain letters is not allowed.
· Each employee is responsible for successively deleting messages that are no longer of current interest. In addition, periodic reviews and deletions must be made every six months.
· E-mails have not been securely deleted until they have been deleted from the e-mail system’s “recycle bin”.
· Employees are urged, as extra security against access to private data, to mark e-mails with private contents as “private”, or to create a file marked “private” for this type of e-mails.
In case of planned absence exceeding three days, an auto-responder should be created.
Instructions for dealing with e-mail boxes and private files upon termination of an employment relationship
What must be done:
Before leaving, the employee must sort out his/her own e-mail box and private files on his/her home area and ensure that information that is still to be stored is transferred to the right person at the Data Inspectorate. He/she is responsible for ensuring that the address of any new personal e-mail box is provided to contact persons to the extent necessary.
Upon termination of employment, the employee’s personal e-mail box and other files must be deleted from the home area.
In case of death, personal e-mail boxes and files must be deleted, unless it is probable that the police will wish to get access to the information. Before deletion, access may be allowed to sort out enterprise-related e-mails according to the routines for this.
Instructions for access to e-mails
What must be done:
The objective of the Data Inspectorate’s work is to ensure that personal integrity is not infringed in the processing of personal data. This objective also forms the basis for processing data about the Inspectorate’s own employees.
These instructions are to ensure that the Inspectorate gets access to any necessary information stored in e-mails without infringing on the employees’ rights to privacy. The rules below must always be observed if the need should arise for access to this type of information.
Definitions:
"Personal e-mail box": e-mail box linked to an individual employee
"Enterprise-related e-mail": e-mail relating to the performance of work tasks
"Private e-mail": e-mail with contents of a private nature, such as e-mails to personal contact persons, greetings, e-mails sent to or from a trade union, employee representatives or the health service.
The following rules apply:
Access to personal e-mail boxes shall in principle not occur
· In case of long-term planned absence, addressed e-mail must not be opened by the Data Inspectorate. The holder of the e-mail address is responsible for ensuring that e-mails characterised as Inspectorate case documents are not left unopened at the holder’s e-mail address.
· Consent to opening personal e-mail boxes in case of absence must be obtained before the e-mail box may be opened by the Archive for the purpose of sorting out enterprise-related e-mails.
· If it is impossible to obtain such consent, the Archive may open the e-mail box to sort out enterprise-related e-mails following a decision from the immediate superior or substitute of the holder of the e-mail address, in consultation with at least one employee representative. This situation could occur if access should become necessary to safeguard the Inspectorate’s duties. The need for access must be documented.
· At least one witness must be present in case of access without consent, and the procedure, hereunder which e-mails have been opened, must be documented.
Access to private e-mails must not take place. Nor may searches be carried out in information marked “private” or collected in a folder marked “private”.
When suspecting a criminal offence in connection with the use of e-mail/the Internet, the police must be contacted. To secure evidence, a mirror copy of the e-mail box may be created. The need for mirror copying must be documented. Access to the mirror copy must take place according to the above procedure.
Instructions for the use of home office equipment
These guidelines apply to the use of home office equipment provided by the Data Inspectorate for use in an official capacity.
The following has been stipulated:
· No sensitive personal data shall be processed.
· Case documents shall not be stored permanently on a local disk in a home office. The reasons for storage in excess of 60 days must be stated.
· A user name and password must be used to access a home office.
· No programmes may be installed on the computer unless approved by the system operator.
· An anti-virus programme must always be used. This must be regularly updated and run.
· A firewall must be used.
Instructions for the use of portable equipment
These instructions are aimed at securing appropriate use of mobile equipment, hereunder PC, USB-pen, PDA and the like, and apply to all employees using mobile equipment.
The following has been stipulated:
· No sensitive personal data must be processed
· A user name or password or other authentication must be used
· No programmes must be installed on the computer unless approved by the security manager
· An updated antivirus programme must always be used.