Liability Briefing on e-Business

eMAIL

Record keeping policy
Business letters
Forming contracts by email
Contractual notices, certificates and instructions
Confidentiality and security
Encryption
Defamation
Viruses
Email policy and monitoring
Practical steps

Email offers a speedy and informal means of communication. It is important to have a system in place which ensures that the contents of all relevant external email messages are checked and/or authorised. This should be part of the same risk management procedure adopted for outgoing letters, documents and faxes. Particular issues arise however due to the informality with which email is used, the ease with which emails can be disseminated widely, the ability to access and alter communications and the affect on an individual’s rights of the monitoring of emails.

Record keeping policy

Emails are communications just like letters. Cases in court now frequently include evidence of email exchanges. Hard copies should be kept of relevant email, together with records of dates and times of transmission. However, receipt of an ordinary email is only confirmed if the receiving party acknowledges receipt. There is no certainty that the email has been received in the absence of such an acknowledgement. For more information about storage & archiving policies click here.

Business letters

Emails may be regarded as ‘business letters’, in which case certain formalities to identify the business under the Business Names Act will need to be followed as with printed stationery. For more information about the Act click here.

Forming contracts by email

It is advisable to use traditional methods of entering into or varying important contracts unless sophisticated measures are in place for executing contracts electronically (eg the new online Association for Consultancy and Engineering agreements). Email contracts combine some of the problems of oral contracts (eg. they may be open to misinterpretation and there may not be a lasting record)) with some of the problems of an exchange of letters (eg. deciding when no reply can be taken to be acceptance) with some problems of its own (eg. an email message may be transmitted out of the jurisdiction on its way between one party and another). It is therefore important to establish the time a contract was made, ie. when the email accepting the offer took effect. Because email can take days to arrive, and/or recipients’ computers are not always programmed to acknowledge receipt, check that any offer or acceptance was received and read by the recipient.

To avoid/reduce problems about where the contract was made and which law applies, a clause could be included in the email expressly stating what law and jurisdiction applies. Pay particular attention when contracting with consumers – often the law of their home address will apply and specific laws (eg. distance selling laws) may give them further protection. For more information about e-contract formation click here.

Contractual notices, certificates and instructions

Is email an effective means of sending official communications? Communications via email may not comply with contractual requirements which relate to how notices, certificates and instructions should be communicated. If possible, before entering into contracts, ensure this point is agreed between the parties and, where necessary, a clause inserted into the contract which allows/prohibits notices, certificates and instructions to be sent by email, whichever is preferred. This should refer to the email being acknowledged, and only the acknowledged email constituting effective notification.

Confidentiality and security

Messages sent via email can be intercepted and read and can also be easily sent in error to the wrong recipient by one click. Just as faxes now habitually include a confidentiality notice to warn someone who is not the recipient, emails should do so too. Sensitive emails should also have security measures attached which are agreed between sender and recipient, eg. by means of passwords or encryption.

Encryption

Encryption of information has the effect of protecting data so as to make it inaccessible for all parties other than the intended recipient. Encryption can be used to:

• restrict access to information content;
• confirm the authenticity of the sender;
• prevent undetected modifications of the message;
• prevent unauthorised use.

The type of encryption commonly used:

• use of secure communication sessions or secure servers;
• encryption of specific communications such as e-mails;
• digital signature (for information click here).
• certain software – such as pdf writers

Defamation

An email bearing the firm’s name could be published worldwide. Defamation would occur if a comment was published containing an untrue imputation against the reputation of another. A person can also be liable if he publishes or republishes defamatory comments. This is easily done by forwarding an email. It is also possible that, while something may not be libellous or otherwise actionable in the UK, it could be so under the laws of the recipient’s country. To avoid such claims, staff should be encouraged not to put anything in an email that they would not say in a letter. Email disclaimers (eg which say that the email should not be taken as being a communication from the sender’s employer if the content of the email does not relate to the employer’s business) are now more frequently seen on emails in the light of well publicised and embarrassing incidents of email misuse by some companies’ employees.

Viruses

Where emails are used to attach files, it is possible to easily receive and pass on viruses by email. Where such viruses cause damage there is potential for the sender to be liable in negligence if the email was sent carelessly. Most businesses however are expected to have up to date virus protection software to prevent viruses being received. A sender of a computer virus may need to show that he has taken reasonable care to avoid sending/passing it on. Emails also frequently include a disclaimer of liability for viruses inadvertently sent out. This will only be effective where reasonable steps have been taken to avoid doing so. The same issue applies where disclaimers are included in any contractual relationship and where delivering disks, CD-ROMs or software via other media to a client as part of or in conjunction with the services performed by the consultant.

Email policy and monitoring

Employers should have an email policy so that the importance of these issues are communicated and understood by employees and that employees have a clear set of rules which they can follow. A breach of such policy may give rise to a disciplinary offence in respect of which the employer may want to take action, including dismissal of the offending employee in serious cases. The email policy should be adopted by or incorporated into contracts of employment and also the terms of engagement of others who may use the business’s facilities (eg. agency, sub-contract or seconded staff).

Employers should be clear with their staff what is unauthorised use of email. If you have not imposed restrictions in an email policy then it would be hard to justify monitoring on the basis that you were checking for unauthorised use. Your email/Internet policy therefore needs to state whether employees are allowed to use email for personal use. All emails can be a "double-edged sword". It can be useful in respect of providing evidence in a litigation claim brought against or by a consultant. Equally, it can be detrimental in relation to an employee claim or a Data Protection request for information, where the business may be obliged to provide all the information it has available on emails relating to the employee; for example, these may include discussions of the reasons for the employee’s dismissal or any other comments which may not be helpful. Taken out of context such communications can give an adverse impression, of an issue for which there may otherwise not be any evidence, which those seeking to prove a claim can exploit. (Incidentally, as regards your staff the same principle applies to monitoring of Internet usage). For details of relevant legislation click here.

Practical steps

Having an email policy may not be enough. The policy should be enforced and the business should take reasonable measures to ensure that certain email abuses are not being carried out:

• Have an email and Internet usage policy.
• Consider placing a footer on your emails to warn outsiders that you may monitor emails.
• Consider placing contractual terms in your agreements with sub-contractors to obtain their compliance with your monitoring policies.
• Warn staff (and sub-contractors) that monitoring will be conducted and why.
• Consider what is a proportionate response to the risk that you as an employer feel you are susceptible to in letting your staff use emails. Decide on your level of monitoring accordingly.

Index | Previous | Next