Company e-mails are increasingly turning up in court as evidence in litigation cases. To help employers protect themselves, HR must ensure that company e-mail policies are watertight.
Garry Mathiason, senior shareholder at Littler Mendelson, one of the largest employment law firms in the US, pauses for a second before answering a question about the relevance of e-mail management to HR: “I’m surprised the question is even asked,” he says. “They absolutely, positively, unequivocally have to be intimately involved in this.”
Mathiason, recognised by the US’s National Law Journal as one of the 100 most influential attorneys in the US, sees e-mail evidence emerge in almost every employment litigation battle that comes to court. Speaking from his San Francisco office, he says that if companies haven’t handled their e-mail properly, it can cost hundreds of thousands of dollars just to retrieve and piece together the evidence required by a court.
“The first thing people have to learn is what e-mails are,” says Mathiason. “In litigation, the ‘e’ stands for evidence.”
Until recently, that perception has rarely been at the forefront of managers’ minds, HR or otherwise. E-mail management has mostly been seen as an operational problem for the IT department – fending off viruses and spam or tackling the ever-increasing volume of e-mail traffic that clogs up everyone’s systems and causes overall performance to drop. If the HR department gets involved at all it tends to be in terms of individual misconduct – stepping in where offensive images have been distributed or dealing with inappropriate written content.
Increasingly, however, two other factors are coming into play. First, in the post-Enron era of corporate accountability, e-mails are becoming an important part of regulatory compliance, and form part of the audit trail for heavily-regulated industries such as financial services and pharmaceuticals.
Second, while the UK may not yet match the litigation-happy business climate of California, there’s no disputing the fact that e-mails represent a risk to employers. They can be the source of litigation in their own right, when managers or employees use them to harass, intimidate or discriminate against colleagues, and they can provide the evidence that will make or break an employer’s case.
The problem with this evidence is that if you do end up in front of a tribunal or court, getting your hands on the relevant records can be a problem.
“It is hugely expensive and hugely inconvenient when you’re forced to search through your e-mail stores to find one needle in a haystack,” says Randolph Kahn, an expert in information management and policy and author of E-mail Rules.
“It has become a fulcrum that pushes a court case one way or another. The need to produce e-mails has become the reason that cases get settled and why companies pay lots of money to make problems go away,” he says.
Retention deficit disorder
The problem most organisations face is that they tend to manage e-mail retention haphazardly. Some companies have a policy of storing e-mails for a limited period of, say, three to six months – beyond that, it’s down to individuals to save whatever they need on their own systems. Others delete on the basis of mailbox space constraints. Only a minority delete messages according to the relevance of the content.
As a result, finding information relevant to an employment dispute can get messy. It’s not unusual to encounter a situation where copies of some relevant e-mails have been stored on individual managers’ laptops, while other associated correspondence has been deleted.
Solving this problem requires a combination of education, policies and, in some cases, the adoption of new technology.
To begin with, employees need to have greater awareness of the implications of what they write.
“You need to take care of the words you use, and assume it’s a form of information that could be discovered,” says Mathiason. “What I see is a tendency for people not to mean evil, but they don’t think it through. You have to assume your correspondence is going to be reviewed.”
One way to focus the mind, he says, is to imagine your e-mail being reported on the six o’ clock news as part of the evidence in a high-profile business trial.
Next, organisations need to define what information should be retained. “Employees need to understand when an e-mail rises to the level of being a company record,” says Kahn. “Some of it is administrative and doesn’t need to be retained long term. There need to be standard rules about what to retain, where to retain it and how to retain it.” He adds that the definition should be simple, short and easy to understand – if you make it cumbersome no-one will do it.
In some instances, organisations will prefer to save everything and selectively delete afterwards. Either way, the retained messages will ideally be stored in a central system. In the past, organisations have relied on traditional back-up and storage techniques to handle this kind of information, but e-mail management is increasingly being seen as a component of a much wider records and document management strategy. Many IT departments are starting to look at the way they manage all their digital records – from invoices to images and web content – and HR’s requirements will need to be thrown into that mix.
One of the key issues is how easily information can be retrieved. Grego Kosinski, director of product marketing at content management supplier Documentum, argues that traditional storage techniques, such as tape, are not easily indexed.
“It’s costly and time-consuming to go to a back-up tape if the courts say you must produce e-mails on this topic,” says Kosinski.
Content management systems provide a means to classify e-mails, allowing companies to search by the names of senders and recipients as well as by subject headers. More sophisticated applications can also intelligently search through the main text of the e-mail.
It’s important, however, to be aware of both the limitations of the technology and the actual level of risk. Take an example where an employee, ‘John Smith’, sues for unfair dismissal and the employer has to find all the e-mails relevant to his case. It’s easy enough to identify the relevant managers whose e-mail may be relevant, and also relatively easy to search their e-mails for mention of Smith’s name. What isn’t so easy is when the managers have taken to referring to Smith as ‘that idiot in the accounts department’.
Measuring the risk
In those instances, pragmatism will save the day. Steve Naylor, vice-president of European marketing at document management vendor Tower Technology, points out that companies can search on themes – for example, if alcohol was a factor, that could be a key word to search for. Alison Wetherfield, chair of the Employment Lawyers Association legislative and policy committee, says that the courts will only be asking companies to make a “reasonable search”. Even in California, it’s normally sufficient to search on the basis of the ‘sent by’ and ‘received by’ categories.
Also, the central e-mail system will not be the only place where messages are stored. Copies may exist on users’ laptops and in some instances e-mails will have been printed out. In addition, the IT department itself may have backed the data up in another way. All of this needs to be checked to avoid potential embarrassment at a later date.
Ultimately, the perceived risk of litigation has to be measured against the cost of any IT investment. While there are applications for smaller companies, many systems on the market have traditionally been aimed at larger organisations and can be expensive both to purchase and install. Often it makes sense to treat e-mail management as one component of a broader IT project designed to better manage all forms of content.
Finally, it’s important to bear in mind the upside – better data recovery may help organisations win a legal battle. Mathiason recounts a case where an employer had dismissed a member of staff and then found itself on the end of a multi-million dollar lawsuit. The case was dropped when the employer examined the plaintiff’s laptop. Despite the fact that she’d deleted her e-mails, she hadn’t wiped the hard drive clean and forensic experts were able to recover compromising e-mails from deep within the system that supported the employer’s case. “This is not just a half-empty glass, it’s also half full,” he says. “I’ve won more cases than I’ve lost by recovering electronic information.”
Prudence v privacy
Monitoring e-mail content throws forward a host of delicate issues for HR directors as they seek to balance their statutory and corporate obligations with their employees’ rights to privacy.
Alison Wetherfield, chair of the Employment Lawyers Association legislative and policy committee, points out that just as employers have an old-fashioned right to expect employees to carry out their work responsibilities, employees also have an old-fashioned right not to be treated in a way that destroys their trust and confidence in the employment relationship. It’s a challenge to marry that traditional concept with new technology that allows organisations to police communications more effectively.
Wetherfield says that while the Data Protection Act does not prevent employers from monitoring e-mails, it should be done in adherence with the DPA common sense principles. It’s also important to be consistent.
“It’s perfectly appropriate for an employer to put in place an e-mail policy that says ‘use it in this way and if you don’t, we will discipline you’,” says Wetherfield. “But the problem arises when you have a policy and do not use it in practice.” If a policy hasn’t been consistently applied, but is later used to justify a crackdown, that may well be deemed to be unfair.
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
In addition, there’s an expectation of reasonable behaviour on the part of the employer.
“If you tell people they can have no expectation of privacy at all, that will be a consideration later. But in this day and age, an employer could still expect to be treated unsympathetically by a tribunal if a manager read an e-mail message from an employee’s girlfriend or boyfriend,” says Wetherfield.
