Aside from simply not having an electronic-communications policy, the biggest mistakes that cause legal problems for companies from Internet and e-mail use and abuse are:
- Failure to communicate the policy to employees.
- Selective enforcement of the policy.
- Failure to communicate to employees that they should have no expectation of privacy when they use the company's computer systems, voice mail, e-mail, or connections to access the Internet.
That's why the first thing that an employer should do, after the policy has been crafted, is "effectively distribute the policy to all employees -- and not just in the middle of a handbook," says Gregory Valenza, attorney in the San Francisco office of Jackson Lewis Schnitzler & Krupman. "Distribute it repeatedly in hard copy and via e-mail and get acknowledgments from everyone that the policy was received. Then make sure that it is consistently applied. And when you do enforce it, consistently enforce it." As for the policy, says Jonathan Segal, attorney, Wolf, Block, Schorr & Solis-Cohen in Philadelphia, "make it clear to employees that the documents they download and the Web sites they visit are not private and that the company has the right to access that." Second, make it clear that harassment and discrimination policies apply to electronic communications and "make it clear what uses are not permitted -- things such as violating the harassment policy; sending sexual, racial or ethnic jokes; or visiting sites with sexual content." Segal also suggests that companies make sure their workers understand "that all Internet communications are not private." Most other major issues tend to revolve around monitoring. "Make sure that all employees know that the employer retains the right to all electronic communications and that all electronic communications -- Internet, voice mail and e-mail -- are the company's property," says Valenza. In addition, he says, "the company should reserve the right to store and/or delete electronic communications and reserve the right to access [monitor] its people's accounts and explain why it may need to monitor. Actual monitoring, however, may be one of the stickiest issues. Electronic messages can be accessed legally only when they are in storage. Likewise, companies legally can look only at reports on Internet usage, not monitor the usage as it occurs. As for continuous monitoring, "it is more trouble than it is worth," says Joseph Schmitt, attorney with Halleland Lewis Nilan Sipkins & Johnson, Minneapolis. "It is time-consuming to read and analyze -- and resource-intensive. It also involves making daily judgments with regard to discipline, termination, and discrimination." Plus, there is the employee-morale issue. "Employees can see the need to monitor in a particular instance," he says, "but not the need for across-the-board monitoring." That's why Martin Samson, attorney with Phillips Nizer Benjamin Krim & Ballon, suggests that companies use filtering or blocking software to prevent access to certain types of Internet sites and reserve the right to monitor when there is a valid business reason or a complaint from another employee of harassment or offensive material. Blocking software's popularity is growing: 31% of the executives surveyed last fall by Management Recruiters International Inc. say their companies use filtering software. "It is simpler, cheaper, and causes fewer problems," says Samson. "And employees are somewhat happier because no one is looking over their shoulders." When is it appropriate for a company to monitor Internet usage, e-mail or voice mail? Wolf Block's Segal suggests that the time to monitor is when the company "has reason to believe that a particular employee is engaging in an activity that violates company policy, disclosing information, running a side business, or engaging in inappropriate behavior or visiting inappropriate Web sites." But, Schmitt cautions, even when there is a need to monitor, it's best that companies "minimize the amount of time they monitor and not read any further once they discover something is not business related." The reason? If a company searches through everything, the employee will argue in court -- probably successfully -- that the company had a vendetta against him or her, says Schmitt. "So just answer the specific question and be done with it. And don't disclose anything."