Any monitoring of systems, even if it is minimal, must be done only after consent has been sought from the persons who are subject to monitoring. This is mostly done by institutions through their Acceptable Use Policy (AUP) or interception and monitoring policy document. With regard to in-depth monitoring of content, the institution will require specific consent to do so. It is thus essential that the individuals who are subject to monitoring be informed what the institution is doing and why.
With regard to gathering evidence where there is an allegation of improper conduct; it is to be ensured that this is done in compliance with the Data Protection Act 1998, the Regulation of Investigatory Powers Act 2000 and the Human Rights Act 1998.
It is essential that staff understand their responsibilities and the limits of their authority.
The UK Information Commissioner has issued a Code of Practice on Employment Practices which includes a section on monitoring in the workplace (Code of Practice Part 3) and this is essential reading for those involved in decisions concerning the monitoring of personal information.
With regard to interception where there is suspicion of criminal conduct or use of illicit material, the JISC Legal webcast on Interception and Monitoring Law provides detailed guidance.
If the administrator comes across mail that appears to relate to criminal behaviour, the police should be made aware, and be left to conduct a lawful responsible investigation rather than conduct the investigation oneself. Guidance on an appropriate procedure is available at the JANET website, at http://www.ja.net/development/legal-and-regulatory/regulated-activities/soaguidelines.html.
For further information on interception and monitoring generally, visit http://www.jisclegal.ac.uk/LegalAreas/InterceptionandMonitoring.aspx, and for further information on data protection, visit http://www.jisclegal.ac.uk/LegalAreas/DataProtection.aspx.