Inappropriate monitoring of employees' e-mail accounts

I investigated several complaints from individuals questioning managers' authority to search Government e-mail accounts during the course of administrative investigations.

In one instance, two employees at the Immigration and Refugee Board (IRB) alleged that local management improperly retrieved copies of confidential e-mail messages they had written each other regarding a Privacy Act complaint to this Office by one of the employees.

By way of background, one of the employees had discovered performance evaluations about several of her co-workers on the local computer network and immediately notified her union's representative, another IRB employee. The representative obtained copies of the evaluations to support his complaint to this Office about the improper disclosure of personal information.

My investigation of that complaint determined that the IRB had not taken adequate steps to restrict access to the information and I concluded that the complaint was well-founded.

Management of the IRB fixed the computer glitch that had created the problem as soon as it was notified of the substance of this complaint. Management also initiated an inquiry into the incident to establish whether any disciplinary action should be taken against the employee for disclosing the evaluations to the union representative. On instruction, the local information technology manager searched and retrieved some e-mail communications concerning the incident between the employee and the union representative.

The IRB did not have a formal policy on the use of electronic networks at the time of this incident. In the absence of a policy, it is guided by Treasury Board policies dealing with employees' expectation of privacy and the statement of authorized uses. The IRB stated that it supports the principle that access to an employee's e-mail without consent is justified only in extreme situations, for example in situations involving a criminal or security infraction, and only after proper authorization from senior management.

However, in the case in question, prior to conducting the search of the electronic system, the IRB was already well aware of the employee's actions and her contact with the union representative. Its decision to retrieve their e-mail messages was not based on any concern that they were improperly using the system. Rather, the primary purpose was to conduct an internal disciplinary inquiry.

My view was that it was unnecessary for the IRB to retrieve the e-mail exchanges to determine if disciplinary action against the employee was warranted and therefore its actions could not be justified under the Privacy Act. I recommended that the IRB proceed quickly to complete its disciplinary review and that it publish a policy, similar to Treasury Board's, governing the use of its electronic networks.

In another case, a Human Resources Development Canada (HRDC) employee complained that her supervisor retrieved personal e-mails she sent from her home to a co-worker and improperly used them in the course of an internal investigation into allegations that had been made against her by her union local.

I established that HRDC's local management was investigating an allegation that the employee interfered with a grievance process. During the investigation HRDC searched its Internet network database for any e-mail exchanges she might have had with a particular co-worker about the grievance. HRDC made no effort to obtain the consent of either individual before searching the co-worker's office e-mail account. One personal message from the complainant to the co-worker contained a reference to the grievor by name but nothing else related to the grievance. The message was otherwise predominantly personal in nature. Yet the department subsequently used it during its investigation process.

I accept that there may be occasions that would justify an employer's decision to review an employee's Internet network account and then use that information in a disciplinary process. However, this was not such an occasion. There was no evidence to suspect that the co-worker was in any way implicated in the internal investigation that would lead HRDC to search her account. By collecting the complainant's personal e-mail exchanges with the co-worker without consent, and subsequently using it to investigate the complainant, HRDC violated her Privacy Act rights.