Online Behavior - It's Not Very Private

Online Behavior - It's Not Very Private

Judy Olian

(Judy Olian is Dean of Penn State's Smeal College of Business and a leading expert in strategic human resources management.)

In this era of electronic data sharing, privacy isn't what it used to be and it's unclear whether people care to do much about it. Survey results just released by an online consulting company -- Jupiter Media Matrix - suggest inconsistency between individuals' concern for privacy protections and their actual online behaviors. Seventy percent of those surveyed by Jupiter say they're worried about online privacy but only 42% read website privacy statements. At the same time, in return for the chance to win $100, 82% of those surveyed were willing to release substantial personal information to online retailers.

Congress may soon step in to protect online consumers from themselves. Currently, Republicans and Democrats are debating competing Internet privacy protection bills. The Senate bill offered by Senator Hollings (Dem.) would require that consumers provide explicit consent to Internet companies before they can collect sensitive data like social security, medical or financial information. Interestingly, the European Parliament just shifted in the other direction in the wake of September 11, requiring all Internet service providers to retain indefinitely the data files of all users' communication should they ever be needed by law enforcement agencies.

Despite tacit understanding that nothing is truly private, online communication is so ubiquitous that individuals seem incapable of restraining themselves from spilling the beans -- their intimate love life, gossip about their workplace peers and superiors, or personal details about their families and finances. The online medium creates the illusion of privacy (after all, it's just you and your key board), and it loosens lips.

This is also true of online behavior in the workplace. Sixty-five percent of employees now have email at work, and 52% have Internet access (American Management Association, 2001). For these employees, email and the Internet have become the dominant channels of communication and information sharing aside from verbal exchanges. Many use email as a substitute for personal interaction and are lax at self-censoring even if directed to do so by their company's legal department, and reminded through repeated online warnings.

In reality, email communication can be easily penetrated within a company's intranet. The courts have affirmed that online communication on a company's network -- whether from home or work -- is "owned" by employers since it's an extension of the physical workspace. Many employers store email communication for an extended period should these exchanges ever become material in legal proceedings. In fact, according to a 2001 survey of employer monitoring and surveillance practices by the American Management Association, almost half of all employers (46.5%) store and review email messages, compared to just 15% in 1997. That's a three-fold increase in email monitoring in less than 5 years. Almost two thirds (63%) of employers monitor Internet connections. Some software like Tumbleweed can be deployed to alert employers if certain data are transmitted or received. A virus or key words reflecting proprietary information or questionable Internet sites could trigger a red flag.

Why do employers go to the trouble to scrutinize employees' online behavior? The most obvious answer is that it's a form of productivity monitoring. Just as they monitor customer service calls or speed of computer strokes, employers are making sure that employees aren't spending hours a day shopping online or finding their next date. Companies may also bear liability for the illegal behavior of their employees, such as employees who traffic in child pornography or engage in discriminatory behavior including sexual harassment or gender discrimination communicated via email. More pragmatically, some firms monitor emails to protect against leakage of their intellectual property. Employees who reveal trade secrets can be sued, and companies can take preemptive action if emails reveal that employees are being lured away by competitors or headhunter firms.

Since 2000 there's been discussion of federal legislation - The Notice of Electronic Monitoring Act - that would provide employees with significant protection against unwarranted electronic monitoring. The pending legislation would require employers to show substantial potential harm, and provide advance notice, before they could engage in electronic monitoring.

There's no doubt that employees feel violated if they perceive that their employer goes off on routine electronic snooping expeditions for no obvious business purpose. And, no matter how loud the warnings that company networks are a public channel, many employees still act as if their secrets are safe online. Like consumers, employees are leaving indelible records for which they may be vulnerable.

My advice to employers is to monitor electronically only when there's a clear business need, and to provide information to employees that describes the business purpose and scope of monitoring, reminding them frequently of the transparency of their Internet and email behavior. And to employees - don't say or do anything online you wouldn't want ascribed to you in the company newsletter.