Ireland IP & Technology Law Blog : Dublin Lawyers & Attorneys for Intellectual Property, Communications & Information Technology Law in Ireland, U.S. & England

 The recent UK Employment Tribunal case of Gosden v Lifeline Project Ltd provides a warning as to the repercussions an employee may face when their private use of social media has the effect of damaging the reputation of their employer and/or breaching an equal opportunities policy. This case involved Mr Gosden, an employee of Lifeline, bringing a claim for unfair and wrongful dismissal to the Employment Tribunal, after an internal disciplinary hearing found him guilty of gross misconduct and  accordingly, dismissed him.  

Lifeline, a charity that works with drug-users in prisons, had assigned Mr Gosden to Lindholme prison. The gross misconduct at issue was that he forwarded an offensive email from his home computer and outside working hours to the home computer of Mr Yates, a colleague, based in Moorland prison, where Mr Gosden had previously been assigned. The email entitled “The British are Way Ahead of Us” contained material of a racist and sexist nature and was of the chain email variety, headed with the words “It is your duty to pass this on!” Mr Yates forwarded the email to a colleague who worked in Moorland prison and so the email entered the computer system of the Prison Service. Lindholme prison held a formal investigation which concluded with the suspension of Mr Gosden and the compulsory retirement of Mr Yates. Lifeline then commenced its own investigation into Mr Gosden’s conduct which led to a formal disciplinary hearing.   The Lifeline disciplinary panel found Mr Gosden guilty of gross misconduct for having carried out an act which might damage Lifeline’s reputation or integrity and for having breached its equal opportunities policy. Accordingly Mr Gosden was dismissed and he in turn brought a claim to the Employment Tribunal. 

The Employment Tribunal dismissed Mr Gosden’s claims for unfair and wrongful dismissal as the reason for his dismissal was reasonable and the manner in which he was dismissed was fair. What is particularly interesting is that the Employment Tribunal went on to consider what impact, if any, the Human Rights Act had to a private life, holding that the email in question, whilst it was sent from his home computer to another home computer, was not intended to be private due to the fact it was headed “It is your duty to pass this on!” and Mr Gosden was aware that it was likely to be passed on. However, Mr Gosden had no control over whether the email would or would not be passed on. 

This decision suggests that employees, who mindlessly forward chain emails outside work, must first consider whether the email in question may have the effect of bringing their employer’s reputation into disrepute or breach their employer’s equal opportunities policy, therefore putting their employment in jeopardy.  As this area of law is developing and the effect on Irish employment law is uncertain, it may be advisable for employers to address employees’ private use of social media where such use would have a damaging effect on the employer’s reputation. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The E-Privacy Directive (2009/136/EC), which formed part of the EU telecommunications regulation reform package passed in November 2009, makes it mandatory for public communications providers (i.e. ISPs and telcos) to inform national authorities of any data security breaches. Member States have until 25 May 2011 to transpose this Directive. (See our Weekly Knowledge Update - 2 February 2010). 

The European Network and Information Security Agency (ENISA) recently published a Report on ‘Data Breach Notifications in the EU’ which provides a review of the new mandatory notification requirement and also looks at what steps members have already taken independent of this requirement.

The Report highlights that data breach notifications are not yet mandatory in most EU countries, and consequently stakeholders are looking for information and best practices from countries that already have notification procedures either as a mandatory law, or as a code of practice. In Germany for example, there is a legal obligation to issue notifications to both the local Data Protection Authority (DPAs) and data subjects in cases of data breaches. Also, in Spain, there is a legal obligation for data controllers, as part of their security policy, to draw up provisions providing for a procedure of notification, management and response to data security breach incidents. 

Meanwhile, in the UK and in Ireland, there is no legal obligation to notify the local DPA. However, in Ireland, last year, the Office of the Data Protection Commissioner issued a Data Security Breach Code of Practice and a Guidance note, which recommends notification of all security breach incidents to the DPC within two working days of becoming aware of the incident. Organisations should also give immediate consideration to notifying data subjects. Similarly, in the UK, the DPA has issued a guidance note, which recommends that it should be notified of serious breaches.

 The majority of regulatory authorities surveyed by ENISA indicated their support of mandatory data breach notifications for the telecoms sector, but raised concerns about their ability to handle the workload, fearing that the number of breaches would result in a large number of investigations. They agreed that a system to prioritise notifications would be the best approach. The DPAs also raised concerns about the fact that mandatory notifications are not yet extended to other sectors of the economy, which might cause members of the public to single out telecoms operators as being less safe than other companies, since notifications will be coming primarily from service providers

The Report identifies a number of areas that require further support at EU or national level, in order to ensure a smooth transition to mandatory notifications, including:

• Risk Assessment Guidance – so as to avoid issuing notifications for breaches that pose no risk and undermine customers’ confidence in an organisation;
• Notification Threshold Criteria – to enable consistent methodology across Europe;
• Procedures for responding to a breach;
• Evaluation Period – to review how the notification process is working;
• Automation – development of an automated system of data breach notifications through a web-based form; and
• Extension of mandatory notifications to other sectors.

 ENISA Report - Data Breach Notifications in the EU.

• Email This
• Print
• Comments
• Trackbacks
• Share Link