Personal information contained in corporate email accounts is often a contentious issue because it provides a setting for the legitimate legal interests of employers and employees to conflict. While employers have an interest in ensuring that corporate email is not misused, employees arguably have an equally justifiable interest in protecting their privacy and personal information.
These circumstances raise interesting questions: Who owns the personal information contained in an employer-provided email account? How far can an employer go in monitoring those accounts, while still respecting the rights of their employees? What steps, if any, should employers be able to take to maximise their flexibility?
Reasonable minds may differ on how to resolve these conflicts. Consequently, law and policy on email monitoring can vary considerably across Asian jurisdictions, and Japan too has developed its own unique response. This article examines some facets of this issue in a Japanese legal context.
Legal Restrictions and Requirements
In Japan, statutory law has not yet developed to provide a nuanced approach to email monitoring. Rather, the question of ownership is resolved simply in favour of employers. So long as email accounts are provided by the employer, the email address and the emails received and stored in such an account would be considered the property of the employer.
Email however, often contains personal information. ‘Personal information’, is defined as: information about a living individual which can identify the specific individual by name, date of birth or other description contained in such information (including such information as will allow easy reference to other information and will thereby enable the identification of the specific individual)’.
Under this definition ‘personal information’ can cover a wide variety of information, and most employers will be subject to considerable restriction on disclosure of such information. Therefore, irrespective of who may own the email account, disclosure becomes a very relevant issue where personal information is concerned.
To the extent that the monitoring of email accounts can be restricted to an entirely internal process, there are few significant issues that arise under present regulation. However, employers would be well advised to avoid measures that involve the sharing of personal information contained in employee email with persons or entities outside of the organisation.
Depending upon the planned degree of monitoring and the mechanisms used, these restrictions on disclosure can serve as a significant impediment to achieving the desired ends. Moreover, as explained further below, the statutory framework is only part of the overall regulation of this type of activity.
Although there are no concrete steps yet required under Japanese law in order to implement a strictly internal email monitoring system, the Ministry of Health Labour and Welfare and the Ministry of Economy, Trade and Industry have worked together to jointly issue a ministerial communication advising on the monitoring of employees using recent technology (this includes monitoring of employees’ online activity).
To the extent that this subject has already received Ministerial attention, it is not unlikely that in the near to mid-term, the ministerial guidance that presently constitutes only nonbinding suggestions could become part of the statutory framework.
It is therefore not unreasonable to prepare for such a change at this stage, as a part of any employer’s comprehensive policy on personal information handling.
Under the present to this ministerial notification, employers are encouraged to:
An examination of past cases in Japan is also suggestive that taking an early and proactive approach towards email policy may be the most prudent approach.
Legal reasoning favourable to employees is often predicated on the fact that employers frequently fail to make any express prohibition on using employer-provided email accounts for private purposes, or otherwise fail to provide rules governing the use of employer-provided email accounts.
For each of the above reasons, it is clear that developing internal rules regarding personal information handling (with a focus, at least in part, on email monitoring) can go a long way towards preventing the kinds of issues that can lead to expensive litigation.
Further, to the extent that monitoring activity may involve individuals or organisations outside of the local employing entity (for example, where the monitoring activity involves the transfer or sharing of employee personal information with an outside contractor who provides monitoring services – which is often the case, in practice), additional measures to ensure the appropriate use of personal information may also need to be implemented to ensure proper compliance with personal information protection laws.
As law and public opinion on this subject evolve, early adoption of such rules and policies can represent a prudent step for employers in Japan. Developing a reasonable policy towards email monitoring and personal information handling not only creates flexibility and prevents conflicts; it also accustoms employees now to the types of routines and policies that may become obligatory in the future.