A second approach is to permit personal use of corporate or governmental e-mail systems, with restrictions (no abusive or inappropriate use) and possibly a mandatory notation on personal e-mail ("this is not an official government e-mail.") This is the general approach taken by the U.S. Government. However, depending upon the judgment of individual employees to determine whether an email is "personal" or "official" is inexact at best. Content filtering software may help here, but it is not perfect.

A third approach is to make it clear that corporate or government e-mail is exclusively for corporate or government work, and to enforce such policies (or try to) with white lists, content filtering, spot checks (supervisory monitoring) and actual enforcement, but couple this policy with permission to make limited and non-offensive use of personal e-mail systems (e.g. POP3 mail) with appropriate safeguards (anti-viral, anti-spam, etc.) Now remember, such webmail may effectively bypass some corporate security policies, and may be inappropriate in some regulatory environments – such as broker-dealers who have to monitor all communications to potential investors. And this again relies on the individual user to decide that a particular e-mail is “personal” or “business.”

Issues Related to “Personal” E-Mail on Company Systems

There are many issues that relate to the use of non-business e-mail through business provided – or reimbursed – IT infrastructures. First, may (or must) the employer monitor the contents of such "personal" e-mail systems? May they “intercept” things like the user’s userid and password on a personal system, and if so, what can they do with this information? If an employer reimburses an employee for all or part of their home internet connection (or telephone or cell phone service) does that give them the right to monitor the contents of communications on these systems? The answers here are not clear, and may depend on the intersection between privacy law, federal or state wiretap laws, electronic surveillance laws, and actual and stated policies on monitoring.

Who "owns" such "personal" e-mail? Who makes decisions about retaining it? Deleting it? Producing it? The problem is multiplied when we consider telecommuting, use of personal hardware, access to personal e-mail through personal networks for which the company may reimburse the employee. Further complicating the matter is the fact that companies provide employees with other devices from which they may access their corporate and personal e-mail, and these devices may or may not have the same controls on their use. Smartphones, blackberries and other devices have the ability to access both personal and business communications. Who "owns" these devices, and who has a right to access the communications contained in them or transmitted through them? Will we require our employees to maintain two separate communications networks – a personal cell phone and a business one? Many companies do just that – with the result that staff members’ attire begins to resemble the batman utility belt – PDA, blackberry, cell phone, etc.

The Document Production Problem

The problem of document retention and destruction is complicated by the use of personal communications on corporate or government networks. As a general rule, in response to a subpoena, document demand, court order, preservation request or other legal process or obligation, a company or agency must preserve or produce any "documents" within their "possession, custody or control." But how does this relate to personal e-mails – particularly on those sent outside of the company e-mail system?

The merger of personal and company business creates privacy problems for employees and production problems for employers. If a company is required to preserve or produce, for example all documents related to "the Jones matter" would that include a personal e-mail sent by an employee on a personal e-mail system from a home PC? Probably not, as that document is not in the "possession, custody or control" of the company. But if the employee connected to the corporate VPN when he or she sends the personal e-mail, the situation changes. What would the company’s responsibility be for, for example, an employee’s diary sitting on a company desk? Does this need to be preserved and produced? "Reply hazy, try again later."