Beware Workplace E-Mail, a New Survey Says; Expert Tells How to Reduce Risk and Avoid Court Dates.

Business Editors

NEW YORK--(BUSINESS WIRE)--Aug. 7, 2001

Smoking gun e-mail has become so common in workplace lawsuits that almost 10 percent (9.4%) of U.S. companies have been ordered by courts to produce employee e-mail, and 8.3% have battled sexual harassment and/or sexual discrimination claims stemming from employee e-mail and/or Internet use.

According to the 2001 Electronic Policies and Practices Survey, a new survey from the American Management Association, The ePolicy Institute, and US NEWS AND WORLD REPORT (the August 13th issue on the newsstand now), employers have become increasingly aware of the dangers in workplace computer use and are taking steps to reduce their liabilities. Of the 435 employers surveyed, 61.6% exercise their legal right to monitor employees' e-mail and Internet connections. Among employers who monitor, 68.3% cite legal liability as the primary reason to keep an eye on employees' online activity. For good reason.

"To reduce liabilities, protect corporate assets, and stay out of court, employers must manage employees' online behavior," says Nancy Flynn, author of The ePolicy Handbook (AMACOM Books 2001) and executive director of The ePolicy Institute (www.ePolicyInstitute.com), the survey's co-sponsor. "Written ePolicies and monitoring software are indispensable business tools for employers operating in the age of e-mail and the Internet," says Flynn.

Monitoring is an effective eRisk management tool, but it cannot eliminate all workplace liabilities. While the federal Electronic Communications Privacy Act (ECPA) gives employers the right to monitor all e-mail traffic and Internet activity on the company system, it does not always prevent outraged employees from filing invasion of privacy claims. Flynn advises employers to use written e-mail, Internet and software policies to give explicit notice that: (1) employees do not have a reasonable expectation of privacy; (2) the company has the right to monitor anything transmitted or stored on its computer system; and (3) management intends to exercise that right.

Business is doing a good job of notifying employees of monitoring activity, privacy rights, and electronic ground rules. Nearly 84% of survey respondents notify employees of the organization's legal right to monitor online activity. Among those monitoring, 86.9% have a written e-mail policy, 83.1% have an Internet policy, and 67.5% have a software policy.

Unfortunately, barely half (50.6%) of employers require staff to acknowledge ePolicies in writing. "Stave off invasion of privacy and wrongful termination lawsuits by securing employees' written consent to have their electronic messages read," says Flynn, who advises employers to have employees sign and date ePolicies to demonstrate they understand them and accept personal responsibility for compliance.

Particularly vulnerable when it comes to saving old e-mail, only 35.4% of employers have a document retention and deletion policy in place. "An employer who retains e-mail on a yearly basis, rather than the recommended 30-day period, could spend six-to-seven figures searching backup tapes in the event of a lawsuit. That's money spent before ever stepping foot in the courtroom," Flynn says. Because it's illegal to begin a document destruction campaign if pending litigation would be affected by it, employers should establish e-mail retention and deletion policies before trouble strikes.

Survey results related to personal use of company e-mail and Internet systems reveal that 4 in 10 companies (39.3%) allow employees full and unrestricted use of office e-mail, while only 1 in 10 (11.7%) grant staff the same unrestricted access to the Internet. Among companies that allow personal Internet use, 65.3% restrict access to Web sites, with 76.6% of employers most concerned about keeping explicit sexual content off employees' screens.

While employers' concern with keeping sexual content off employees' screens is commendable, Flynn suggests employers exercise equal control over other recreational surfing as well. "Hours lost to shopping, chatting, and gambling online have the same impact on productivity as time spent downloading pornography," she says. "Reduce liabilities by taking a comprehensive look at--and restricting access to--all non-business sites visited by employees."

In spite of employers' efforts to monitor online behavior, only 23.9% of companies have put into place training programs designed to educate employees about eLiabilities and ePolicy compliance. According to Flynn, effective eRisk management combines three equally important activities: (1) the development of written e-mail, Internet, and software policies; (2) the establishment of a continuing education program for all employees, from the CEO to student interns; and (3) the installation of software that monitors, filters, and/or logs employees' online activity.

"Employers cannot expect employees to recognize electronic risks or comply with ePolicies on their own. Ongoing training is critical to the success of an ePolicy program," she says.

Finally, employers should know that one of the best ways to control risk is to control content. "Settle for nothing less than good clean content, free from harassing, menacing, threatening, obscene, discriminatory or otherwise offensive language, and you'll be on your way toward a safe and secure electronic workplace," Flynn says.

A copy of the survey and/or summarizing press release, and review copy of The ePolicy Handbook (AMACOM Books, 2001) available upon request. Or you can go to www.amanet.org/research/summ.htm.