Athabasca University | AU Student/Staff Login | Invited Guest Login
E-mail, monitoring, and the "reasonable expectation of privacy"
Given perennial concerns about e-mail privacy (which resound inside a university and across the greater Internet), I thought I would gather here links to and excerpts from the university's relevant policies.
First, the AU E-mail Policy assures the employee of the legislated "reasonable expectation of privacy" and of a similarly reasonable expectation of limited personal use of AU e-mail; these expectations are detailed in points 4 and 6, and need to be kept in mind when reading point 12:
E-mail messages are only monitored as specified in the Information Technology Electronic Data Policy.
Uh, okay then. So what does this other IT policy say about monitoring, when it comes to e-mail?
AU's Information Technology Electronic Data Security Policy first defines what it means by "monitoring":
Monitoring of electronic networks: Activities that involve the routine recording and subsequent analysis of an electronic data system or electronic network to assess traffic flow and usage patterns in the system or network. Examples include recording and monitoring user accounts, passwords, user activities, the amount of information downloaded, and computing resources used. Such activities do not normally involve monitoring the contents of personal e-mail messages, computer files, or electronic transmissions.
The policy then specifies both the employee's reasonable expectation of privacy and how any monitoring of e-mail must respect that expectation.
Expectation of privacy: The Alberta FOIPP Act legislates that all individuals have a right to a reasonable expectation of privacy; this right extends to the workplace. Thus, all AU staff have expectations of privacy, even when they are working with AU property. This expectation is especially true when AU permits the limited personal use of AU equipment. [...]
AU may freely monitor how its assets and information are used, as long as there is no reasonable expectation of privacy regarding that which is being monitored. However, AU staff will have a reasonable expectation of privacy in cases where the University has informed them that neither personal e-mail messages nor personal documents will be monitored. Should AU decide to begin monitoring the contents of e-mail or other electronic documents, all authorized individuals must be notified of the new monitoring procedures before they are implemented. This notification informs individuals of their reasonable expectation of privacy.
I have excerpted policy statements that refer to the employee's "reasonable expectation of privacy" because this has proven a very robust and legally defensible right. Last fall, the Supreme Court of Canada ruled in favour of an employee's reasonable expectation of privacy in the use of a workplace computer, even one purchased by the employer. The case focused not on e-mail but a more general expectation of privacy in the use of workplace equipment - and in a case wherein the employee was already working under "diminished" expectations of privacy: that is, according to an employer policy that explicitly discouraged the "personal use" of work computers. In contrast, AU policy permits rather than prohibits personal use, albeit "limited." And while nobody would want to go to court over a matter of e-mail privacy, I'm sure, the law now seems well balanced to protect the employee's right to privacy.
- head made of cogs
August 17, 2023 - 11:15am
Jon Dron - Investigating the effects of computer-generated contextual landmarks on short-term recall of...
May 17, 2022 - 7:21pm
Jon Dron - My latest paper, "Learning, Technology, and Technique", now online in the Canadian...
August 10, 2022 - 7:50pm
Jon Dron - My keynote slides for Confluence 2023 - Heads in the clouds: being human in the age of cloud...
January 19, 2023 - 9:34pm
Jon Dron
Mark A. McCutcheon
Tag cloud
Comments
Thanks for this Mark, I appreciate the clarification.
I will then consider my @athabascau.ca emails to be private, unless I am informed otherwise by the university
Terry
A friend of mine has been involved with some great big thing over academic freedom, and one of the ways he's built his case about bullying from the university has been to submit FIPPA (Ontario's FOIP) requests for emails sent from institutional accounts. From what he's explained, he can't just go on fishing expeditions, but he can request emails containing particular information (e.g., emails about a particular topic or making specific statements) and he's been successful in getting them.
(I think Freedom of Information legislation is provincial, but it might be worth finding out whether emails in your institutional account can be accessed through a similar process in AB.)
Hi Mark,
This clarification is much appreciated. And, I agree that we should be afforded a reasonable expectation of privacy.
However, this does not stop email recipients from forwarding messages at whim. I understand that it is a professional courtesy and expectation to honour each others' privacy with regard to email messages--particularly as our AU email messages contain the following warning:
"This communication is intended for the use of the recipient to whom it
is addressed, and may contain confidential, personal, and or privileged
information. Please contact us immediately if you are not the intended
recipient of this communication, and do not copy, distribute, or take
action relying on it. Any communications received in error, or
subsequent reply, should be deleted or destroyed."
However, daily occurrences (i.e., messages being passed along without permission of the originator) suggest that not everyone respects such privacy. Furthermore, as we all know, electronic interactions leave digital fingerprints that are difficult to erradicate.
In a somewhat cynical view, I would like to warn everyone to be careful with what they share and with whom they share it. (Yeah, I know . . . pretty negative.)
Cheers,
Marguerite
With the permission of the fellow who made the request, I've posted an abridged version of a Freedom of Information request for faculty/insitutional emails in Ontario: https://landing.athabascau.ca/file/view/258908/sample-freedom-of-information-request-for-institutionaluniversity-emails
Things in Alberta wouldn't be exactly the same, but it does show how the request is worded and what the process of responding to them looks like, for those who are curious about how their emails might become readable under Freedom of Information legislation. (I notice this post is public, but I'm afraid mine is only accessible to folks at AU. Sorry!)
Meanwhile, ABC reports: Harvard Secretly Searched Deans' Emails
http://abcnews.go.com/US/wireStory/reports-harvard-secretly-searched-deans-emails-18696325
- bill
Well, basically we can assume that there is no privacy. If they the institution feels that there is a compelling reason to look at your emails they can and will.
They won't hapharzadly search or wander through, but everything is recorded, everything is their "property" and it is always open to be searched if they feel that is needed.
Websites you visit are likely the same.
- Anon