By John Bowie, Publisher, www.LawFuel.com*
Most companies have neither an email policy, nor immediate plans for their preparation. The need to identify the risks related to an organization and how those risks can best be dealt with is increasingly important as litigation and "e-risk" issues increase on a daily basis with embarrassing headlines and six-figure lawsuits.
Any functioning and effective email policy needs to comprise a blend of form and process. The form itself is relatively straight forward. The process, however, is undoubtedly more complex and requires a change in the culture of an organization towards "safe" e-mail, while avoiding the situation where electronic monitoring and other processes intrude upon and erode the organization's values and culture. The need to avoid a corporate culture of fear and potential retribution is as important as having a functioning and effective e-mail policy.
The organization needs to establish when e-mail can be used under appropriate best practices. The ability to maintain proper discipline in the use of the medium is vital. The requirement for an attitude towards confidential property and other intellectual property assets is fundamental.
Similarly, the legal requirements with regard to privacy, data retention, securities issues and similar render e-mail a company-wide issue that requires an holistic approach that involves the organization from one end to the other. Only that way can a perfectly formulated e-mail policy actually work.
Ask yourself some questions
Before launching your email policy, the organization needs to be receptive to its arrival. This means the policy requirements need to be planted in ground the organization has already furrowed – through consultation, examination of requirements and present e-mail practices and through a recognition of exactly what is sought to be achieved and how e-mail 'fits' the requirements of the organization.
What's the current e-mail policy? How is it communicated? Is it enforceable? How does the company prevent employees from maliciously or inadvertently deleting all of their e-mail?
The following are some preliminary questions to be answered in order to define and shape the policy you will use.
What is the purpose of the company use of email?
For instance:
- is it to be used only for company business?
- may it be used for private purposes?
- are consents from clients required?
What specific requirements does your organization have for an email policy?
- what are the employee numbers?
- what sort of business is it?
- how is e-mail stored in the company today?
- is the organization committed to the policy, including to having it's contents communicated and its provisions enforced (via HR, legal and IT personnel)?
- how many 'employees' are third party contractors or home workers?
- how many are expected (or will) work from home?
What present online and training policies are in place?
- what is presently available on letter writing, confidential information, information security issues, and similar documentation?
- Do you filter e-mail messages prior to delivery to end users? Why or why not?
- is there material on harassment issues?
How far does your organization's email policy need to extend?
- how much confidential information or intellectual property is likely to be involved?
- how much is e-mail used presently?
- are your senior employees/managers themselves fully conversant with the laws relating to privacy, electronic storage issues etc?
Will usage be monitored? If so,
- will the monitoring be permitted for any usage?
- will it be systematic?
- will it only occur when appropriate circumstances arise?
- to what extent is there already monitoring?
- what are the privacy standards the company must adhere to for employees, suppliers, and customers?
What access will be granted to email?
- will there be access without consent (but where the law permits)?
- will there be access with good cause?
- will there be random access?
- when will notification occur?
What is being done about retention and retrieval of emails?
- how is e-mail backed up to ensure recovery in the event of a disaster?
- how are e-mails retrieved? How are multiple e-mails retrieved?
- how long does it take?/Does it need to take?
These are some of the questions you need to ask – and answer – before you can implement an effective email policy for your business. There are others, related to the precise nature of your business, its operational 'reach' and the employees you have. But before any business can adopt a policy that keeps it free of risk and operating securely, you must ask the hard questions.
Only then can you put in place the straightforward measures, as outlined in the Email Risk Report and similar reports that can guide you towards safety and away from the shoals that exist in both the in-box and out-box of any businesses email system.
*John Bowie is a qualified lawyer and publisher of 'The Email Risk Report – Rules and Requirements for the Workplace', available online at http://lawfuel.com/index.php?page=resources&hlr=focus&rid=11
