The Regulation of Investigatory Powers act 2000 ("RIPA") gives employers wide rights to monitor employees e-mails and telephone calls to ensure that they relate to work. It has been condemned as a "snoopers charter" and as a gross invasion of privacy. On the other side, the Data Protection Commisioner has issued a draft code of conduct that sets out strict rules on monitoring, suggesting that use of, e.g. CCTV or taping can be justified only in "very limited circumstances" - such as when a criminal offence is suspected


The forerunner to the RIPA - The Interception of Communications Act 1985 ("OIC") did not render tapping on private networks unlawful. This was challenged by Alison Halford, former Assistant Chief Constable of Merseyside, who went to the European Court of Human Rights. Ms Halford's case, concerning the tapping of her work telephone by her police force won a ruling that employees have a "legitimate expectation of privacy" for telephone calls made from the work place. The RIPA replaced the OIC and is wider in scope, aimed at ensuring confidentiality in communications on all networks, including e-mail systems. To intercept without consent is a criminal offence and possibly a civil wrong;

RIPA has therefore caused huge unrest among employers who routinely monitor staff as a part of staff assessment or performance. Regulations under the Act known as the Lawful Business Practice therefore took effect in October 2000. "Lawful Business Practice"allows bosses to intercept or monitor work communications without consent in cases such as checking for computer viruses, inappropriate e-mails or overlong private phone calls. Of course, the RIPA conflicts with the Human Rights Act 1998 and its inherent right to privacy - employee monitoring will in most cases raise privacy issues. Employers may also fall foul of the Data Protection Act. The key to the whole issue perhaps lies in proportionality - ensuring that interception and monitoring is carried out in appropriate circumstances and with justifiable reason.

A clear policy that informs staff of intended monitoring should perhaps be in place, and any action should be for legitimate business reasons. RIPA and associated legislation is a confusing minefield of potential litigation and one with which we can help and advise.