The popular internet search engine Google is proposing to introduce a new free e-mail service dubbed 'Gmail' to compete with its major rivals, Yahoo! and MSN's Hotmail. Gmail is currently in the testing stage, with its formal introduction planned for some time in the near future. However, Gmail has already created much media interest – some of it controversial.

The controversy stems from Google's plan to programme its computers to scan the subject matter of both incoming and outgoing e-mails. Google will use this information to deliver text-based adverts to customers relating to the subjects discussed in their e-mails. For example, an e-mail from one friend to another discussing a football match might prompt Google to advertise a link to a sports website or other sports product. These new proposals have inevitably raised a number of important legal issues.

Google's scanning of e-mails with the aim of targeted advertising could be considered "processing of personal data" and would, therefore, be covered in the UK by the Data Protection Act (DPA) 1998. Google is an American company and so, arguably, is not regulated by the DPA unless it carries out these activities in the UK. However, UK users of the service are likely to expect their data to be protected in line with the DPA and other relevant local laws, or at least be informed if this is not the case.

The first principle of the DPA states that 'any personal data shall be processed fairly and lawfully'. Google is likely to satisfy this requirement by obtaining its customers' consent through Gmail's terms and conditions. These conditions will state that customers agree that "Google may monitor, edit or disclose [their] personal information, including the content of [their] e-mails". The terms further state that, as a consideration for using Gmail, the customer agrees Google will "display ads and other information adjacent to and related to the content of [the customer's] e-mail".

Google does not, however, obtain the consent of any third party sending e-mails to a Gmail account, the contents of which are also scanned. Such scanning is likely to be a prima facie breach of the DPA and could be one reason why Google may not set up a sister UK-based web-mail service. This is particularly the case when scanning "sensitive personal data". Examples of this might include any information relating to the racial or ethnic origin, political opinion or religious belief of the sender or recipient of any e-mail. If Google scanned or processed e-mails containing any "sensitive personal data" under the DPA, it would be required to satisfy stringent conditions such as obtaining the data subject's consent before the data is processed.

Google does limit any potential liability to some degree by only targeting the Gmail user with advertising. Despite having their e-mail scanned, no impact of the scanning is experienced by a third party. However, the potential in the future for Google to target-advertise third parties, such as senders, is an important issue that should be considered.

Google also limits its exposure by not sharing information that personally identifies a user with any other third party or advertiser. The system is designed so that the ads are sent from Google's own automated system.

Google's other potential defence is that it is merely using a process similar to that adopted by other popular web-mail services when scanning messages to filter spam and detect viruses. Google is also very keen to make it known that no humans read the e-mails to target the ads, and that the matching of the ads to content is a completely automated process performed by computers owned and operated by Google. Whether this is a defence to the DPA, however, is questionable.

Google could also potentially be in breach of the DPA in its retention of e-mails. The DPA states that any personal data must not be kept for longer than is necessary, and Google's retention of e-mails even after its customer has deleted his/her e-mails or has terminated his/her agreement with Google could be considered a breach of this requirement.

Further issues could arise with regards to the Regulation of Investigatory Powers Act 2000 (RIPA). Under s1(2) RIPA, it is "an offence for a person to intentionally and without lawful authority intercept, at any place in the UK, any communication in the course of its transmission by a private telecommunication system". A person intercepts a communication in the course of its transmission if he "monitors transmissions made by means of the system, so as to make some or all of the contents of the communication available to a person other than the sender or intended recipient of the communication".

Although Google's behaviour is likely to be considered "monitoring transmissions made by means of the system", it is likely to fall outside the scope of the RIPA because Google has the right to control the operation or use of the system. Google could also rely on the fact that interception is not made by "a person" but rather only by its automated computers. However, the computer will ultimately be controlled by a person working on behalf of Google, so whether this is a defence is questionable. Google also states that it is not making the contents of the e-mails available to any other advertiser or third party. However, monitoring of content even by automated means seems to contradict the spirit and intention of the legislation, even if there is room for argument in the way the legislation is drafted.

Google may also manage to avoid recent European legislation concerning electronic marketing and unsolicited e-mail or spam. Under the Electronic Marketing Regulations, Google is required to gain the customers' consent to e-mail or electronic marketing, and does so via its terms and conditions. In any case Gmail's advertising will not be in e-mail form (although it does not expressly exclude this), nor will it allow for pop-ups or banner ads. Instead Google will allow space at the right side of the page for relevant text ads and sponsored links, which will be clearly be identified as advertisements. This approach might actually be a more useful and less annoying way of receiving ads, and some consumers who want this service may be willing to sacrifice their various rights in signing on.

In signing on, however, Gmail users may also effectively be regarded as signing away the data protection rights of their friends or third parties who send e-mails to their account. Whether they will also be happy with this remains to be seen.

Alex Williamson is a lawyer in the commercial, outsourcing and IT group at Stephenson Harwood.