Expert: Dan Pepper - 11/23/2008

Question
My company's human resources department shares confidential personnel information via email and this is in itself is not an issue, since we are all assigned an individual email password. If we have troubles with our password we contact the IT Manager and he changes our webmail password. I have worked for this company for three year and all of my employee evaluations and raises have been shared via email.

We are a relatively small branch office of a larger company that has little to no policy regarding electronic communications. One of our assistant staffers has taken on IT responsibilities – network back-up, computer updates, and network log-ons – recently this person requested that everyone send them their email passwords. I declined because this person is not human resources and has no real reason to collect this information. If we can't log on we call the branch office for a new password.

I brought this up with my supervisor who stated that our email is company email. I acknowledged this was true, but stated there is a key on the personnel file in the office for a reason, and if we are going to share personnel information from the human resources department, our email passwords should not be available to the staff whose responsibility is to maintain our local hardware. I also pointed out that their email as the director should be the most protected, since all personnel issues, and management issues go through them. My concerns were shrugged off. Are there any legal grounds for my concerns?

Thank you.

Answer
Although many states have laws and regulations about the protection and disclosure of personal information, and certain industries are federally regulated in this regard, I am not aware of any laws regarding purely internal dissemination of this information (although it certainly raises an enormously higher risk of disclosure).  It also doesn't make much sense from a purely business and human resource perspective, but again, I'm not aware of any laws this violates.