Accessing Student Emails

[DPrince]

Does anyone have a definitive answer to this one?

 

I have been asked to access a student's email account to provide evidence for a complaint. I don't know the nature of the complaint, but it's probably an investigation of bullying or general 'larking about'.

 

I refused to give access to the account without the student's consent, on the grounds that this would breach their Human Right to Privacy. TBH I don't really give a monkey's about their Human Rights, before you all start accusing me of being a left-wing pansy, but this was the advice I was given some years ago at a seminar given by a legal firm. Their advice was essentially that a student doesn't give up any of their rights to privacy or under the DPA just because they happen to be students.

 

On the flip-side, our Head is arguing (possibly quite reasonably) that the email is on our system, they're students, and he'll insist that they give consent, but he doesn't see why he should have to.

 

Anyone know the answer? Even more pertinently, can someone point me towards some published advice on this?

 

Thanks.

Edited February 1, 2011 by john
Please watch your language

[joe90bass]

What does your AUP say? Ours says that all activity is monitored, however I generally get permission from our head if emails need monitoring, and it's only ever been by me, I haven't given anyone else access

[dwhyte85]

The school owns the e-mail and they'd (students) presumably sign something saying within the AUP that allows for this access?

 

Honestly, I'd do it because:

 

a) A boss has said to do it, they're accountable - you're just following instructions

b) It may save someone getting a kick-in?

c) It's not worth arguing with a senior member of staff regarding it, you're not going to win!

 

If it was his Hotmail account and you sniffed the PW/logged it... different story!

Edited February 1, 2011 by dwhyte85

[DPrince]

It says we can monitor emails within the scope of RIPA. That means I can track emails etc, but not necessarily view the contents. Human Rights becomes an issue, I think...

[nadeem]

Our regulations state quite clearly under what conditions we would access a student's (or a member of staff) email. What does yours say?

[DPrince]

The school owns the e-mail and they'd (students) presumably sign something saying within the AUP that allows for this access?

 

Honestly, I'd do it because:

 

a) A boss has said, they're accountable - you're just following instructions

b) It may save someone getting a kick-in?

c) It's not worth arguing with a senior member of staff regarding it, you're not going to win!

 

If it was his Hotmail account and you sniffed the PW/logged it... different story!

 

Well, you couldn't use that argument for staff emails though... reading staff emails just because a member of SLT asked you to would put you (and them) on a sticky wicket. Students don't have any less rights that staff in that regard (as I understand it).

In truth, I'm encouraged to argue with SLT whenever necessary - as a holder of specialist expertise, I'm supposed to advise them. That said, if they insist I shall make a note of it and carry out the action anyway. We're usually pretty hot on this sort of thing - because I've flagged it as an issue, the lawyers will be contacted for advice, etc. I'm just wondering if anyone else has dealt with it before.

[dwhyte85]

Well, you couldn't use that argument for staff emails though... reading staff emails just because a member of SLT asked you to would put you (and them) on a sticky wicket. Students don't have any less rights that staff in that regard (as I understand it).

In truth, I'm encouraged to argue with SLT whenever necessary - as a holder of specialist expertise, I'm supposed to advise them. That said, if they insist I shall make a note of it and carry out the action anyway. We're usually pretty hot on this sort of thing - because I've flagged it as an issue, the lawyers will be contacted for advice, etc. I'm just wondering if anyone else has dealt with it before.

 

It depends what they signed up to DPrince.

 

You can sign an AUP that says we're allowed to read your e-mail if we feel it's necessary, that is the terms of you getting an e-mail account... it means they can read your e-mail. If the pupils (or staff) haven't signed anything that implicitly states this... you have a case to argue it. I'd imagine both staff and pupils have, somewhere along the lines...

[DPrince]

Our regulations state quite clearly under what conditions we would access a student's (or a member of staff) email. What does yours say?

 

They're not 'regulations', which is rather my point. Our AUP and email disclaimer says that we can monitor emails to the extent of RIPA, but that only covers monitoring emails. Once you start reading emails or accessing email accounts without consent, you're into Human Rights territory, which starts to conflict with RIPA.

 

Are you suggesting that your AUP (or RIPA) gives you the legal right to access someone's account without their consent in order to access their emails?

[dwhyte85]

http://www.ucisa.ac.uk/sitecore/media%20library/Files/publications/bestpractice/ExploitingtheNetworkGuide%20pdf - page 11

[DPrince]

http://www.ucisa.ac.uk/sitecore/media%20library/Files/publications/bestpractice/ExploitingtheNetworkGuide%20pdf - page 11

 

Thanks - that's useful, although I note the use of phrases such as "subject to applicable legislation" and "without purporting to take away any of the end-users rights". Later, it specifically says: "However, computer and network operators are also required to respect the privacy of users."

 

So not totally clear cut. I think I'll have to get to grips with the detail of RIPA.

[dwhyte85]

It's just to bolster any argument - not aimed to resolve this debate ;-)

[elsiegee40]

This link may or may not be helpful: ICO - The Employment Practices Code - Supplementary Guidelines

 

It refers heavily to employees and students are not employees.

The requirement of the LBP Regulations is to make reasonable efforts to inform users of the system that an interception may take place.

 

It seems your AUP may need further work to make sure that students and staff are aware that email content may be monitored where part of an investigation and will only be done under the written direction of the Headteacher/SLT.

 

If you interpret the clause you have too literally, the school is powerless to fulfill its legal responsibilities under Safeguarding... i.e. it has to be able to investigate Safeguarding issues.

[DPrince]

No, students are not employees. Equally, you could argue that the majority of schools are not businesses. Which makes the paper irrelevant. Unless you assume that by "employees" they mean "users"? Besides which, that document a) only covers interception of emails during the course of transmission (and not accessing someone's email account) and b) only appears to allow it for reasons that don't apply to a school.

 

A common thread here seems to be the suggestion that you can get away with pretty much anything if your AUP says you can, but this isn't true. If your AUP asserts something that is not allowable by law, it doesn't suddenly become allowable. It just means your AUP is not applicable. The fact that I enter a clause into my AUP stating that I can read student (or staff) emails without consent doesn't necessarily make it so, even with regard to safeguarding. The ability to investigate safeguarding issues doesn't mean that you can do whatever you like... I couldn't break into someone's house to investigate a potential safeguarding issue. My question is: can I break into someone's email account. The suggestion that "Yes you can if it's in your AUP" isn't good enough, because that doesn't cover you for illegal breaches.

 

I'm just awaiting a response from our lawyers - I'll let you know what they say.

[dwhyte85]

So, you're suggesting if teacher X is assumed to be having a relationship with pupil Y and they've been communicating over e-mails... that the school should simply wait for permission from either pupil Y or teacher X to go ahead and check e-mails?

 

If they don't consent, what then? Wait for the police?

 

EDIT:

 

You mention 'breaking in', as I see it the school has rented the pupil an e-mail account to use based on a set of terms. It's not breaking in as such, it's checking up that was agreed to prior to the account being setup.

 

If you have a landlord and they've got a clause that states 'If we think you're doing something naughty, we can enter without warning' and it's signed.... they can pretty much do that.

Edited February 1, 2011 by dwhyte85

[DPrince]

So, you're suggesting if teacher X is assumed to be having a relationship with pupil Y and has been sending e-mails... that the school should simply wait for permission from either pupil Y or teacher X to go ahead and check e-mails?

 

If they didn't consent, what then?

 

I'm not suggesting anything - I'm merely stating the law as I understand it. Unfortunately, they tend not to create legislation on the basis of individual "oh, but what if this happened" scenarios, because I entirely take your point.

 

If I was suggesting anything, I would suggest that if Teacher X was 'assumed' to be having a relationship with Pupil Y then this wouldn't necessarily be enough for you to just access their email accounts. I don't know that for a fact, which is why I asked the question originally, but my understanding of various regulations would certainly suggest this.

 

RIPA wouldn't help you, because it covers communication interception at the time of transmission.

Your AUP wouldn't help you because it would be in breach of the privacy obligation of the Human Rights Act (and possibly the Computer Misuse Act).

I would suggest that you would investigate it the same way as any other disciplinary or legal issue, which would be to interview both parties, ask for permission to access their emails (in the same way that you might ask for permission to view their mobile phone SMS details) and then pass the issue onto the police.

 

Are you suggesting that the suspicion that someone might be in that situation means that you can just do what you want? You would need permission to search them, look in their bags, enter their house. The fact that the School owns the telephone system, network, or even mail server does not automatically give them the right to access the private information contained within those systems (as I understand it).

I have to say again though that it isn't particularly clear-cut. I can't find anything that is conclusive on this.

[LosOjos]

I couldn't break into someone's house to investigate a potential safeguarding issue. My question is: can I break into someone's email account

 

The difference is, you're not breaking in to anybody's email account, you're simply opening the mailbox stored on your email server that you own. If you have previously stated that you are providing an email service under the condition that should a reasonable cause for concern require you to access the student's mailbox (i.e. in your AUP) and they have signed that agreement, then I believe you're covered.

 

Let us know what your lawyers say anyway - I'm not really sure why you asked the question here when clearly you never intended to take advice from members here anyway.

[Earthling]

The way I see it, and this is definitely not school policy just my own view, is that the network belongs to the school, the school (meaning I) will get done for any copyright/inappropriate/offensive material........so privacy is something they get at home.

 

Obviously Hotmail/Gmail etc are strictly out of bounds.

 

Having said that, I'm gonna have to raise it now, because I don't think our AUP covers that.........I haven't read it for ages.

[dwhyte85]

The difference is, you're not breaking in to anybody's email account, you're simply opening the mailbox stored on your email server that you own. If you have previously stated that you are providing an email service under the condition that should a reasonable cause for concern require you to access the student's mailbox (i.e. in your AUP) and they have signed that agreement, then I believe you're covered.

 

Let us know what your lawyers say anyway - I'm not really sure why you asked the question here when clearly you never intended to take advice from members here anyway.

 

It's a discussion, I think he/she is taking it on board but wants clarity and references

[LosOjos]

It's a discussion, I think he/she is taking it on board but wants clarity and references

 

Fair enough.

 

Apologies DPrince - I'm in an arsey mood today.

[elsiegee40]

Are you suggesting that the suspicion that someone might be in that situation means that you can just do what you want? You would need permission to search them, look in their bags, enter their house. The fact that the School owns the telephone system, network, or even mail server does not automatically give them the right to access the private information contained within those systems (as I understand it).

I have to say again though that it isn't particularly clear-cut. I can't find anything that is conclusive on this.

 

No we're not suggesting that we can do what we want, but if Safeguarding is an issue then we are expected to use whatever means available to investigate. This means that checking home drives and email accounts is never done without written authorisation from the personal responsible for Safeguarding/Child Protection in your school (usually, but not always, the HT)

 

That person will be following their own training and guidelines and procedures set out for such an investigation.

 

Young people in schools are minors (except for the oldest Year 13s) and the school has a duty to protect them. If your errant student is causing problems with either staff or other students at the school and it is suspected that a school email account is involved, the HT is within their rights to investigate. Details of the investigation are of course confidential; you are merely a means to an end, the way of getting to the information needed. The only time the HT would back off and get the police involved immediately is if it is suspected that illegal images may be involved.

 

Where's Grumbledook when you need him? He'd be able to give you chapter and verse.

[bossman]

@DPrince:

 

Could it be interpreted like the drink driving laws in this country whereupon if you are asked to give a specimen be it breath or blood and you don't give your consent you are prosecuted under the failure to give consent rule therefore meaning you are guilty of the said offence.

 

If you have signed the schools AUP and the user is aware that their e-mails are monitored for inappropriate material then surely by this they are giving consent to the school by way of the HT to access their e-mail?

 

You are just the tool (no offence intended) with which the HT uses to maintain the e-mail system.

 

Could this not be your argument?

[DPrince]

Let us know what your lawyers say anyway - I'm not really sure why you asked the question here when clearly you never intended to take advice from members here anyway.

 

Hi - I wasn't asking for advice. I was asking if anyone had a definitive answer. What I'm getting is a lot of opinions, which are interesting in their own right, but not particularly useful when I'm potentially breaking the law.

 

I assumed (apparently incorrectly) that this would have been something that would have arisen in the past, and that someone might have checked it out to ensure they were covered. I know from attending seminars and my previous job in industry that there is a heavy but misguided reliance on the AUP as being the "well, it's in there and you signed it, so tough" document.

[GrumbleDook]

Human Rights say that you cannot force someone to do something against their will ... yet millions of kids go to school each day grumbling about it.

 

There are many conflicting laws, acts, regulations out there that will be argued over time and time again.

 

The main one here is taking action to prevent harm to a child, which designated people within the school can do as they are In Loco Parentis under The Children's Act 1989. This may involve making reasonable and justifiable checks on the safety of children but keeping in mind other acts. The thing I would say is that if there is thought to be a real and present danger then the police or child protection should be involved.

 

Consent of an understanding individual is always a handy thing to have (ie agreement via AUP) but this should always be backed up by a clear and acceptable process which holds people accountable. If such a search is going to happen it has to be authorised by a designated person, recorded in a specific log, monitored by a second person and then any information is only retained for the period of time needed to deal with the original request. To be honest, it is very much like CCTV and there is plenty of advice out there for this.

 

I will dig out further information when at home later.

[GrumbleDook]

Hi - I wasn't asking for advice. I was asking if anyone had a definitive answer. What I'm getting is a lot of opinions, which are interesting in their own right, but not particularly useful when I'm potentially breaking the law.

 

I assumed (apparently incorrectly) that this would have been something that would have arisen in the past, and that someone might have checked it out to ensure they were covered. I know from attending seminars and my previous job in industry that there is a heavy but misguided reliance on the AUP as being the "well, it's in there and you signed it, so tough" document.

 

It has arisen a number of times, but people have fudge things or blustered their way through.

 

You could always ask becta about this ... erm ... oops!

 

To be honest, what you need is an Academy to ask this question of DoE. If a state schools asks they will be told to speak to their LA so any Academies willing to ask the question?

[dwhyte85]

@DPrince... I've discussed this in-depth with members of our SLT when we had our safeguarding training Sept 09, the general opinion was shut up, do your job and let the big boys decide what happens. I'd imagine alot of us hit that same brick wall hence nobody having a definitive answer.

 

What do your lawyers say?