The difference between “legal” and “right”

Last week’s column concerned the Councilman decision, in which a US Federal district court seems to say that intercepting email is OK if you’re an Internet service provider. I got a couple of reader emails asking what that meant for private organizations who may or may not want to read employee email. The bottom line, according to my non-lawyerly understanding: the Councilman decision means nothing in that context. Why? Councilman concerned an ISP, not a private company. If your employees have to agree to an acceptable use policy that says you can monitor their email, or if you otherwise put them on notice (e.g. by a statement on your OWA front page), the prevailing legal consensus seems to be that you’re in good legal shape if you do need to monitor email. However, you still need to tread very carefully. If you really want more details, a) ask your legal department or b) buy my book and read Chapter 20, which was written by an actual lawyer with real legal expertise in the field.