Computers, computer networks and the Internet have become inextricably linked to daily working activities and, as such, the issue of employee data being monitored by the employer is a contentious issue resulting in an increase in employees facing disciplinary action in the workplace, says information security consulting firm Cyberlaw Consulting.

A recent survey by email security company Proofpoint showed that 31% of the US companies surveyed had terminated an employee for violating email policies in the past 12 months, 15% have disciplined an employee for violating media sharing/posting policies in the past 12 months and 8% reported terminating an employee for such a violation.

While the South African Con-stitution recognises the right to privacy, it is not cast in stone, says Cyberlaw Consulting MD Advocate Liesl Briel. She explains that the Constitution gives individuals the right not to have their communications infringed. However, Section 36 of the Constitution says that if there is a law of general application, a law that applies to all citizens and not to a specific group of people, that general law may limit any rights of a citizen that is contained in the Bill of Rights.

The Regulation of Interception of Communications and Provision of Communication-Related Information Act No 48 of 2008 is such a law and, provided the employer follows the rules, it will not be unlawful to intercept communications. Rica generally prohibits the interception and monitoring of communications; however, there are exceptions, such as consent by the one party and if there is a business reason. Each of these exceptions has its own set of qualifications to determine if it applies, says Briel.

However, she stresses that the employer may not spy on the personal life of the employee, except to prove that the employee spends too much time on personal matters during working hours. Employees should be aware that they do not have a legitimate expectation of privacy when using the employer’s email system to communicate with friends and family, and should be continuously notified of this fact.

Briel notes that, although an employer can usually only discipline an employee for misconduct during working hours, there have been exceptions through the years, also depending on the employee’s type of job and the circumstances of the misconduct.

The general guideline to consider, she says, is whether the misconduct led to irreparable damage to the continued working relationship. If that trust relationship has been broken, either during or after working hours, the misconduct can become the basis of disciplinary action. However, she adds, the employer must show a link between the employee’s conduct and the employer’s business interests. Bad-mouthing an employer or disclosing confidential information on a social network may cause damage to the employer’s reputation and, in turn, lead to loss of business.

When an employee posts personal information on a publicly available blog or social network, the employee gives up the right to privacy. Anyone, including an existing or potential employer may view and act on that information. This is a common law principle that is now incorporated in the Protection of Personal Information Bill (B9-200), published in August 2009.

Briel explains that the Bill broadly defines the processing of personal information to include the collection and storage of the information. Section 10 gives the individual the right to object to the processing at any time in the prescribed manner. Since the individual has the right to inspect his/her personnel file, he/she may request on reasonable grounds that the employer delete certain information, which has become redundant.

“From the current wording, it is unclear if the employer will be forced to destroy the information just because an employee requests it. It seems that there will be a process where the employer has discretion to weigh up its rights against those of the employee. When this Bill is enacted, the Legislature will draft the regulations, which will set out the prescribed manner in which an individual may object to the processing of personal information,” she adds.

Briel advises clients to always obtain consent from their employees to monitor communications. However, for disci- plinary action to be taken, clear policies and procedures must be in place, says Briel.