Email privacy breach costs worker 17-year career

Accessing colleague's communications without authorisation leads to termination

Email privacy breach costs worker 17-year career

The Western Australian Industrial Relations Commission (WAIRC) recently dealt with a Public Service Appeal Board case about a school network support officer who was dismissed for accessing a colleague's departmental emails without authorisation.

The worker challenged her dismissal on several grounds: she disputed being at work when the alleged email forwarding occurred, questioned the reliability of CCTV evidence, and argued her 17 years of service warranted consideration of a less severe disciplinary measure.

The case originated at a senior high school where the worker held a Level 3 school-based network support officer position. On 27 November 2023, she was dismissed for accessing her subordinate's departmental emails without authorisation on 22 May 2023 and forwarding a confidential email to her own email address.

Worker accessed colleague’s private email

According to records, the accessed email contained her subordinate's resignation notice that had been sent only to the manager of corporate services.

The subordinate was working at another school on the day of the incident and had left their work mobile phone in the IT storeroom, following workplace protocols.

This incident led to two formal complaints against the worker: unauthorised access of the subordinate's departmental emails, and forwarding a confidential email without permission.

Breach of privacy assessment at work

The Board examined CCTV footage that showed the worker entering the relevant area at 3:28pm and exiting at 3:37pm.

The manager of corporate services testified that after reviewing footage of both internal and external entry points, they were satisfied no one else was in the area when the email was forwarded at 3:34pm.

When initially questioned, the worker denied being at school, providing a timesheet to support her claim. The Board noted: "On 16 August 2023, when [the worker] telephoned [the investigator], she would have had access to her timesheet for 22 May 2023 saved on the S drive, as well as a separate copy of her timesheet which she had claimed was to track her TOIL."

The worker later acknowledged being present but maintained she did not access the phone or forward the email.

Workplace device management standards

Evidence showed specific protocols for work mobile phones. The subordinate testified they were instructed not to password-protect the work phone or take it home, as stated in the decision: "[The worker] told her she could not put any passwords on the work-phone, she could not take it home, and she needed to store it in Room 1."

The manager confirmed this arrangement, testifying: "[The worker] was very particular that [the subordinate] should leave hers at work at all time and unlocked and in a certain place... because it was deemed the IT helpdesk phone."

These procedures ensured the phone remained accessible for IT support purposes.

Evidence supporting the privacy breach

The Board ultimately found the allegations proven, stating: "The Board finds that [the worker] accessed [the subordinate's] work-phone on 22 May 2023 and sent the Email."

Regarding the worker's credibility, they concluded: "The Board finds... that the more probable explanation of all the evidence is that [the worker] 'did not seek to correct the discrepancy within the timesheets nor why she initially believed she may have been absent on the afternoon of 22 May 2023' until the CSA Letter."

The Board upheld the dismissal, determining: "After considering [the worker's] misconduct in the context of her 17 years of service and employment history, the Board finds that there are no sufficient mitigating factors to justify adjusting the dismissal in light of all the circumstances."