In a recent case the Court of Appeal dismissed an appeal by an ex-employee who was trying to claim against her former employer for misuse of private information and breach of confidence in relation to a personal emails that she sent from a business email account during her employment. The email account was used to receive enquiries about the employer's services, and was an email@example.com type of address.
The court emphasised that the success of privacy and confidentiality claims depended on the specific facts, and considered that the judge at the original court hearing had been correct to make the decision he did. In particular, the court said that it was significant that the ex-employee had themselves, in fact, shared access to the relevant email account with two colleagues, and that her employer had set up personal accounts in the names of each of the employees at the same time as it created the business account. As such, clearly the ex-employee had every opportunity to send any personal emails from her own personal email account. Whilst it may very well have been reasonable to have expected privacy and confidentiality with regard to this personal account, it was not with regard to the business account. Even if there had been a reasonable expectation of privacy or confidentiality, disclosure of the emails by the employer for the purpose of obtaining professional advice would not have breached that privacy or confidence and furthermore, even if it had, any monetary damages payable would have been limited.
The court was of the view that although the ex-employee knew the password for the account, it belonged to the employer. The purpose for the password was to protect the employer’s secrets, not the ex-employee’s. She held the password, not in a personal capacity, but as an employee of the company.
This judgment provides some guidance regarding when an employer will have full access to emails sent via a business account. In particular, it demonstrates that it would be advisable for any business to create individual email accounts for each employee who operate from the central business email address and to require them to limit private emails to the account set up in their name. Clearly individual employees need to be wary of what they send or receive using their employer’s business email account.