Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following:

This email and any files transmitted with it are confidential and contain privileged or copyright information. If you are not the intended recipient you must not copy, distribute or use this email ...

Legally, how enforcable are these disclaimers, could a company force me not to forward an email, etc. Or would it be that I was informed about the email information nature and henceforth willingly exposed its content (and thus am liable)?

share|improve this question
That depends on the country. – Hendrik Brummermann Aug 12 '12 at 11:07
@HendrikBrummermann One answer per country could be interesting. – Polynomial Aug 12 '12 at 11:13
up vote 5 down vote accepted

I can only comment on UK law, but I'd also like to give the usual IANAL disclaimer.

There are two types of contract. One is an implicit contract, the other is an explicit contract.

An implicit contract is one provided by existing legal legislation, whereby an action binds you to the terms of that contract, without any specific signing of a contract document. An example of this is a business selling you an item online, in which they automatically become bound to a provider-consumer contract as part of The Consumer Protection (Distance Selling) Regulations 2000. Breaches of this contract can be enforced by law.

An explicit contract is agreed upon by the involved parties, and usually signed. Most explicit contracts have limitations in law, e.g. they cannot be signed by a minor. An example of this is a non-disclosure agreement (NDA), which is bound by civil law.

The disclaimer at the bottom of an email is an implicit contract, but it is an informal contract. Since the contract is sent without the receiver having any ex post facto way to reject it, a legally binding contract cannot be applied here. An informal contract essentially says "we would like you to do this", but you are free to violate it.

However, there are some important things to think about here:

  1. If you explicitly agree, through statement in a response, to the terms in the contract, you are forming an explicit contract with the same right to legal enforcement as an NDA.
  2. If you explicitly disagree, the implicit contract is void. You may still be liable to civil proceedings if you distribute corporate secrets covered by a separate law contained in the email.
  3. If you do neither, but still share the email, you may be liable to civil proceedings due to breach of informal contract. However, the company would have to prove bad faith on your part, which is difficult.

In general, they're not enforcable as part of law unless you explicitly agree to them, and they're mostly for informative purposes. If you're in a situation where this might be a problem, contact a lawyer.

share|improve this answer
"due to breach of informal contract" Doesn't a contract always need to be accepted by both parties? If never accepted, how can one breach it? – m1ke Aug 13 '12 at 10:07
@m1ke An informal contract is implied, not explicit. If it's explicitly accepted by both parties, it becomes a formal explicit contract. This falls under "good faith", whereby if you don't reject the contract the other user assumes that you are operating in good faith and are not violating the informal contract. It's a legal grey area, but if the sender can convince a judge that you didn't operate in good faith then you may be liable for civil penalties. – Polynomial Aug 13 '12 at 10:15
How can you "explicitly disagree"? By a reply to the email? Is there a formal way? – curiousguy Aug 13 '12 at 23:44
Just reply to the email and state that you do not agree to the terms in their informal agreement, and that actions in contrary to those terms should not be considered a breach of good faith in any further emails. – Polynomial Aug 14 '12 at 5:45
Would it be enough to have your own disclaimer explicitly stating that you do not implicitly agree to the any other parties disclaimer? – Carlos Bribiescas Oct 22 '14 at 17:54

Disclaimer: IANAL. This is not legal advice. I do not even know in which jurisdiction you live.

This email and any files transmitted with it are confidential and contain privileged or copyright information. If you are not the intended recipient you must not copy, distribute or use this email ...

This is pseudo-legal "salad":

  • a privileged relation is a very special relation (client-doctor, client-attorney) and protects only specific matters, but these footers are added liberally to every email;
  • the footer does not even know if it is "privileged", "copyright information"(sic)... the "or" is telling!
  • an email is copied several time before it can reach the recipient inbox;
  • it is usually automatically retrieved and saved to disk, possibly in different places;
  • how can the receiver know if he is the "intended recipient"? (What about "Cc" and "Bcc"?)

For this to have any value:

  • "confidential information" should only be added to emails that really contain confidential information;
  • "privileged information" should only be added to emails that really contain privileged information;
  • the intended recipient(s) should be named.

Otherwise, it provides no information at all to the recipient!

Really, if your lawyer think that indiscriminately adding "confidential" on every document you send is proper behaviour, change lawyer. If your lawyer is a "just in case" kind of guy, ask him if "just in case" was ever useful: is there any case where an email footer mentioning "confidential" or "privileged information", automatically added to every email sent (even the most trivial messages) was successfully used in a court?

But why do people do that? you may ask. Because other people do that. Adults tell children to not be influenced by others, to not take drugs just because other children do, etc. but adults, esp. businessmen, usually try to do exactly what others do, including every possible mistake. (That's why we see investment "bubbles" and other economic aberrations.)

share|improve this answer

The short answer is: those disclaimers are not enforceable. They are not legally binding.

So why do lawyers include them? Because they can. Because someone somewhere figured "why not?". Someone somewhere figured, "hey, it can't hurt".

Or, maybe for CYA reasons: someone somewhere wanted to show they were "doing everything possible" about the risk of misdirected email. If a situation ever goes to court due to a screw-up by the lawyer, and the lawyer needs some defense (no matter how straight), the lawyer can argue with a straight face how he added these disclaimers and it shows effort to protect confidentiality of client information and blah blah blah.

Or, because each lawyer sees all the other lawyers doing it, and figures maybe he'd better too (such is how "best practice" gets established, no matter how silly it may be).

It's all a bit of silliness.

Disclaimer: I am not a lawyer, you are not my client, and this is not legal advice. This answer is only intended to be read by the public. If you are not the intended recipient of this answer, the author requests that you share this answer with all of your friends. You are hereby notified that sharing of this communication is prohibited, except on days ending in a y. Do not fold, spindle, or mutilate without proper authorization. Do not run with scissors on a full stomach near a pool.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.