The Merrill Lynch (Dublin) story

Employees of the Thundering Herd have become ex-employees this week, reportedly because they transmitted pornography using their employer's computers. As time goes by, we may learn that the truth is less clear-cut - that's been my experience of following this kind of story, anyway. 

In the wake of the story, some nonsense is being spewed on the broadcast media by people calling themselves experts.

Despite what they say,

* you do not lose your privacy and data protection rights just because you are an employee;

* any limitation of the employee’s right to privacy should be proportionate to the likely damage to the employer’s legitimate interests;

* employees should be notified of the nature, extent and purposes of the monitoring specified in the policy;

* employees may be assumed to have a reasonable expectation of privacy in the workplace;

* the legitimate interests of the employer - to process personal data that is necessary for the normal development of the employment relationship and the   business operation - justify certain limitations to the privacy of individuals at the workplace. However, these interests cannot take precedence over the  principles of data protection, including the requirement for transparency, fair and lawful processing of data and the need to ensure that any encroachment on an employee’s privacy is fair and proportionate; 

* monitoring, including employees’ email or internet usage, surveillance by camera, video cameras or location data must comply with the transparency requirements of data protection law;

* Staff must be informed of the existence of the surveillance, and also the purposes for which personal data are to be processed;

*  Only  in exceptional circumstances associated with a criminal investigation, and in consultation with the police,  should resort be made to covert surveillance;

* Monitoring and surveillance whether in terms of email use, internet use, video cameras or location data are subject to data protection requirements;

* At a very minimum, staff should be aware of what the employer is collecting on them (directly or from other sources). Staff have a right of access to their data under section 4 of the Data Protection Acts;

*Any personal data processed in the course of monitoring must be adequate, relevant and not excessive and not retained for longer than necessary for the   purpose for which the monitoring is justified.

The above statements do not all have the formal force of law, but they represent the legal position in Ireland, in my view.

Also in my view, the tendency of employers to believe otherwise and of employees to accept it, is a threat to civilised standards of behaviour, and a more egregious threat than that posed by a young man while at his place of work passing on by e-mail a "blue" joke to another young man .