Managing Workplace Monitoring and Surveillance

Overview

Employers are increasingly concerned about issues related to violence in the workplace, identity and property theft, lowered productivity, and on-the-job accidents and injuries. Coupled with the ever-increasing costs of litigation, employers must find appropriate ways to minimize these risks. As a result, many employers now monitor employees at work to prevent injuries, misconduct and other types of loss.

While guarding against these risks, companies also must balance the business interests of the company with the reasonable expectations of privacy of its employees. Magnifying this challenge is the availability of technology making it possible for employers to track all employee e-mail, Internet and telephone use without employees even knowing that they are being monitored.

Legal Restrictions on Workplace Monitoring

Workplace monitoring is subject to a variety of federal and state constitutional provisions and laws regarding when employees have a right to privacy and if and when they must be notified that they are being monitored. From a legal perspective, disclosing surveillance is the smartest tactic. Letting employees know that they will be monitored removes employees' reasonable expectation of privacy—the element that often forms the basis for invasion-of-privacy lawsuits arising under common law.

While the basis of the privacy claim differs by jurisdiction, courts that have considered the question usually engage in a fact-specific analysis. They weigh the reasonable expectation of privacy by the employee and whether the employer has a legitimate business interest for conducting the surveillance. The fact that the reasonableness of employees' expectation of privacy usually plays a large part in a court's analysis offers further support for the disclosure of monitoring activities. By informing employees that their communications are not secure or that their activity will be monitored, the employer can lessen employees' privacy expectation and in turn bolster the employer's defense in court, while also lessening the impact on employee morale.

Federal and state laws

The two main restrictions on workplace monitoring are the Electronic Communications Privacy Act of 1986 (ECPA) (18 U.S.C. Section 2511 et seq.) and common-law protections against invasion of privacy. The ECPA is the only federal law that directly governs the monitoring of electronic communications in the workplace. Congress passed it in 1986 as an amendment to the federal Wiretap Act. Whereas the Wiretap Act restricted only the interception and monitoring of oral and wire communications, the ECPA extended those restrictions to electronic communications such as e-mail.

At first glance, the ECPA appears to prohibit an employer from intentionally intercepting its employees' oral, wire and electronic communications. However, the ECPA contains several exceptions to this prohibition, and two of these exceptions are of particular importance to employers. The first is commonly known as the business purpose exception, which permits employers to monitor oral and electronic communications as long as the company can show a legitimate business purpose for doing so. The second is the consent exception, which allows employers to monitor employee communications provided that they have their employees' consent to do so. An important and often overlooked distinction between the two exceptions is that the consent exception is not limited to business communications, and, therefore, a company arguably can monitor personal electronic communications if it can show employee consent. See May an employee secretly record conversations with management and other employees without informing them?

In addition to these two exceptions, the ECPA contains a loophole that may limit employer liability for certain methods of monitoring. The act's definition of "electronic communications" expressly applies to the transmission of such communications and does not include the electronic storage of such communications. Therefore, courts have distinguished between monitoring electronic communications such as e-mail messages while they are being transmitted versus viewing e-mails while they are in storage. Viewing stored e-mail is similar to searching through an employee's papers and files. Several courts confronting this issue have found that monitoring electronic communications after transmission does not run afoul of the ECPA.

The Stored Communications Act (SCA) is part of the ECPA and prohibits an entity providing an electronic communication service to the public from knowingly divulging the contents of an electronic communication. It applies only to communications in which the employee had a reasonable expectation of privacy. When an employer makes it clear that certain communications are not protected, the SCA likely will not apply.

The ECPA merely sets the minimum restrictions on employee monitoring; individual states are free to impose greater limitations, and many have done so. For instance, in Connecticut, employers that monitor must provide employees advance written notice that specifies the specific types or methods of monitoring. In addition, several state constitutions, including those of California, Florida, Louisiana and South Carolina, expressly guarantee citizens a right to privacy. An explicit declaration of privacy in a state constitution may give employees heightened expectations of privacy, and employers in such states are wise to take additional steps to diminish employees' privacy expectations with respect to electronic information and communication in the workplace. See New York Employers Must Soon Provide Notice of Digital Workplace Monitoring.

Common-law claims

In addition to the ECPA and the various state laws governing workplace monitoring, employees also have brought common-law privacy claims to challenge employer monitoring. These claims are not based on statutory rights but on the precedent of prior court rulings. To prevail on a common-law claim of invasion of privacy, the employee must assert a right to privacy with respect to the information being monitored. Managers and supervisors should be reminded not to disclose personal employee information to staff and co-workers, even with the best of intentions.

Labor relations issues

Unionized companies face additional complications. The National Labor Relations Board has held that the video surveillance of any portion of the workplace is a condition of employment that typically must be the subject of collective bargaining and agreed to by the union prior to implementation. An exception does exist when the use of surveillance cameras has been addressed and waived in the management rights clause or another provision of the collective bargaining agreement. Even in that circumstance, communication and buy-in from the union representative will go a long way toward helping operate such a program.

Covert surveillance without bargaining can cause significant problems for the unionized employer, but even employers that are not unionized may find themselves having to deal with the labor board on this issue if the employer decides to implement a surveillance system in the middle of a union-organizing campaign. Unless the employer can show that property destruction, break-ins or other security issues have increased with the onset of the union-organizing campaign, it will likely be the recipient of an unfair labor practice charge.

Types of Monitoring 

Employers should identify the types of monitoring and surveillance that will be conducted in the workplace and become familiar with the restrictions and disclosures required for each type.

Monitoring Telephone Calls and Voice Mail

The federal Wiretap Act prohibits the interception of stored voice mail messages as well as live telephone calls. However, employers may engage in legal surveillance of oral telephone communications if they do so in the ordinary course of business. This exception is particularly important to employers who maintain telemarketing or customer service operations because of their particular interest in ensuring quality control. Other legitimate business reasons to monitor calls include protection of trade secrets and ensuring compliance with noncompete agreements. In all cases in which the employer feels a compelling business need to monitor calls, the best practice is to obtain the employee's advance written consent.

The ECPA provides that the moment an employer realizes that a telephone conversation is personal in nature, the employer must stop listening. Even employee consent probably will not suffice to protect the employer, unless the employee specifically consents to unlimited monitoring of both business and personal calls. Employers may have more leeway to monitor employee calls from telephones designated for business use only. For example, when an employer informs its employees that the company's main reception line cannot be tied up with personal calls, the employer could use technology known as a pen register to record the telephone numbers and the length of the call but not the contents of specific conversations. Employers should attempt to narrowly tailor any intrusion on employee privacy to the specific objective it seeks to achieve. Use of less intrusive technology can further that goal.

Telephone monitoring is the mode of workplace communication most likely to be affected by the laws of the state where the communications occur. California law, for example, requires parties to a conversation to be informed—either by a recorded message or a beep—that the conversation is being recorded or may be monitored. Several states, including Maryland, New Hampshire and Pennsylvania, require the consent of all parties to the interception of a telephone conversation.

Monitoring E-Mail and Text Communications

The advantages of using electronic communications in the workplace are obvious. Electronic media are often the most efficient method of communication among employees and between a company and its customers. Maintaining an electronic information network allows employers to monitor employee productivity, quality and efficiency; however, employee use of e-mail, voice mail and the Internet has brought with it a multitude of workplace problems.

For example, an employee's personal use of e-mail and the Internet during business hours can affect the employer's productivity and profitability. Even more importantly, however, employee misuse of electronic communication media can place organizations at risk for legal liability and breaches of data security. Employers can face claims of sexual harassment, discrimination, defamation, copyright infringement and other improper conduct arising from employee misuse of computerized communications. Also, employers must be concerned with protecting trade secrets and proprietary information. 

Employers must consider employees' expectations of privacy in the use of electronic media. In the context of litigation relating to any of these issues, organizations must be mindful of the discoverability of electronic communications; however, employees who have sued their employers for invasion of privacy based on e-mail monitoring generally have not enjoyed much success.

Individual states may extend privacy protection to employees' personal use of company e-mail systems, depending on the nature of the communication. In 2009, the New Jersey Supreme Court ruled, in Stengart v. Loving Care Agency Inc., 990 A.2d 650 (2010), that an employee could reasonably expect that e-mail communication with her lawyer through her personal, password-protected, web-based e-mail account would remain private, even though she used a company laptop to send and receive those messages. The court found that the use of the company computer did not remove the protection of the attorney-client privilege and that her employer's legal counsel had violated the rules of professional conduct by reading her e-mails. Further, the court said that no policy concerning the employer's right to retrieve and read personal communications through company computers could overcome the employee's expectation of privacy to defeat the attorney-client privilege.

Monitoring Internet Use

Some observers have argued that the ECPA's electronic monitoring restrictions do not apply to Internet use because viewing websites does not involve a "communication." However, employers should not risk running afoul of that law when the safest route is to establish and implement a clear policy governing appropriate workplace Internet use, expressly reserving the right to monitor such use without further notice. In addition to this separate monitoring policy, companies should incorporate prohibited Internet use into their sexual harassment and equal employment opportunity policies. Beyond that, employers have at their disposal a plethora of filtering and blocking devices designed to restrict access to inappropriate Internet sources.

Some states have imposed an obligation on employers requiring information technology workers to report the discovery of child pornography on company computers to law enforcement officials. In a 2005 New Jersey case, the state appellate court held that an employer on notice that an employee was using a company computer to access child pornography had a duty to investigate the employee's activities and take "prompt and effective action to stop the unauthorized activity." The employer had a duty to report to law enforcement the viewing of websites that possibly contained child pornography, the court said, and an employer could be held liable to the victims for the failure to do so.

Video Monitoring/Surveillance

Video surveillance is a common technique employers use to monitor employee activities in the workplace. Many employers use video surveillance to minimize employee misconduct. Video monitoring can also provide evidence of a crime if one were to occur at the worksite. Employers must consider the state laws for the state in which the surveillance occurs, whether the surveillance area is a public or private area, whether sound is captured in addition to the visual monitoring, and whether the camera is in open view or hidden. Employers should not use video surveillance in areas where employees have an expectation of privacy. See Cameras in the Workplace Policy.

Some suggestions to avoid legal challenges in employee monitoring from Employer's Guide to Workplace Privacy (Aspen Publishing, 2004) by Amy L. Greenspan include:

• Use video surveillance only when justified by a legitimate business purpose (e.g., preventing theft or workplace violence, investigating illegal or improper conduct, monitoring employee performance).
• Limit video surveillance to the least intrusive time, place and method that will serve the business purpose.
• Use only visible cameras or inform employees in writing that hidden cameras may be used.
• Obtain written employee consent to video surveillance for legitimate business purposes.
• Do not use video surveillance in areas where employees have a reasonable expectation of privacy (e.g., bathrooms, locker rooms, dressing rooms, lounges, employees' homes, or other places outside the workplace where employees are not in public view).
• Do not use video surveillance devices that capture or record sound without complying with federal and state wiretap and recording laws.
• If the workplace is unionized, comply with any provisions in the collective bargaining agreement concerning video surveillance; if there are no such provisions, negotiate with the union before implementing video surveillance.
• Do not use video surveillance in connection with union activities (or other "concerted activity" by employees concerning terms or conditions of employment).
• Do not select employees for video surveillance in a manner that might be considered discriminatory under federal or state discrimination laws (e.g., do not videotape only women or only Muslims or only people with disabilities).
• Do not select employees for video surveillance in retaliation for exercising rights under any law.
• Understand and comply with state or local laws dealing with video surveillance.
• Train supervisors in the legal issues involved in video surveillance.
• Treat information obtained through video surveillance as confidential, and limit access to video recordings to security personnel or management personnel with a need to know.
• Adopt procedural safeguards to avoid unintended or improper use of work-related video recordings.

Monitoring Location of Employees

Location monitoring involves employers checking the location and movements of employees using the Global Positioning System (GPS), which was originally designed by the military. The system uses satellites to transmit signals to GPS receivers on the ground that can pinpoint location. Employee locations can be determined within company buildings and along city streets and highways. The speed with which employees move in their cars and trucks can also be determined. Employers can use these technologies to help increase productivity and provide a more secure and safe workplace.

While the ECPA excludes "any communication from a tracking device" and won't likely apply to GPS tracking, state right-to-privacy laws need to be considered. As in most privacy issues, a notice to employees that a GPS device may monitor them while working greatly reduces an employee's ability to claim that he or she had a reasonable expectation of privacy and to prevail in a claim.

Additionally, using GPS in an employee-owned vehicle runs the risk of common-law action for trespass and violating state restrictions with monitoring off-duty employee conduct. Using location tracking in employer-owned vehicles would reduce that risk, especially when policies address how monitoring will be handled for work breaks, and if the employee regularly takes the vehicle home, how any nonworking hours will be monitored, if at all.

Monitoring Remote Workers

As more employees are working from home, some employers are keeping an eye on them through use of remote monitoring technologies. These tools perform multiple tasks, such as tracking keystrokes and measuring employees' active and idle time in key applications and websites.

But tracking tools aren't without risks. Workplace monitoring is subject to a variety of federal and state laws regarding when employees have a right to privacy and if and when they must be notified that they're being monitored. From a legal perspective, disclosing surveillance is the smartest tactic. Letting employees know that they will be monitored removes their reasonable expectation of privacy—the element that often forms the basis for invasion-of-privacy lawsuits arising under common law. Being transparent about the use of such monitoring tools is essential to building trust in the workforce around privacy issues. Research shows that employees feel that introducing technologies to monitor the workplace damages trust between employees and their employers.

See:

Is Use of Employee Monitoring Contributing to the Great Resignation?

Employee Monitoring Tools Gain Traction

Should Employers Use Software to Monitor Remote Workers?

Know the Risks When Monitoring Remote Workers

Monitoring Off-Duty Conduct of Employees

Issues also abound when considering the employer's right to investigate or take adverse employment action in response to an employee's off-duty conduct. Does the GPS in the employee's personal vehicle show that he or she goes to a bar each night and stays late? Or that he or she is moonlighting with another employer? Will such knowledge adversely affect the employee, causing him or her to sue under privacy laws?

As with other forms of monitoring, whether such monitoring is appropriate depends on whether the employer can demonstrate good faith and a legitimate business reason for taking such action.

Employee Searches

Workplace-based searches raise a variety of questions and have numerous implications. What is to be searched on a person or property? Whose property and why? Who will conduct the search? Is it a private or public employer? The answers to these questions, along with additional considerations, determine the best way to proceed in any given situation.

Public-sector employees

The Fourth Amendment to the U.S. Constitution guarantees that "the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, shall not be violated," thereby protecting the privacy rights of U.S. citizens, including federal government employees. Those provisions are extended to state and local governments through the Fourteenth Amendment. The constitutional right to privacy derived from the Fourth and Fourteenth amendments does not apply to employees in the private sector.

While public employees can still be subjected to workplace searches, the scope of the search will be narrower than what would be allowed in the private sector. Searches tend to be limited in scope and purpose, often arise from evidence of misconduct, or are conducted in areas of diminished privacy expectations, such as searching a private office where records are accessed frequently by others.   

Private-sector employees

Private employers have more leeway in conducting searches of employees, although workplace privacy rights do exist under both common and state law.

Several states have passed legislation granting specific privacy rights to employees and placing obligations on employers, especially with regard to electronic monitoring. So, when may a private employer properly conduct a workplace search? Answering this question is tied closely to whether the employee had a reasonable expectation of privacy for the item (e.g., locker, purse) that was searched and whether the employer had a legitimate business reason for conducting the search. Consider, for example, an employee who is provided with a locker at work, is permitted to use his or her own lock and is not required to provide the combination to that lock to his or her employer. There is no company policy regarding searches. Does the employer violate the employee's privacy when it breaks the lock and searches the employee's locker without his or her consent? One Texas jury answered "yes" to the tune of a $100,000 award to the employee.

Establishing a Companywide Policy

For their best protection, employers should establish and disseminate to employees a clear written policy that employee e-mails, Internet use, telephone calls and company-owned vehicles are subject to monitoring, without any further warning.

Policy specifications

Even with a monitoring policy in place, an employer should expressly state that it is not obligated to monitor employee communications. Otherwise, employees may claim that the organization failed to protect them if harmful or offensive conduct occurs and the employer fails to catch it through monitoring.

Employers should consider the following key provisions when developing a companywide monitoring policy:

• Specify what is governed by the monitoring policy (e.g., electronic communications, telephones, company property and premises, etc.) and inform employees that monitoring and searches can occur at any time, for any reason, with or without any further notice.
• Establish that the organization's computer and telephone systems and other equipment are the property of the employer, and employees should not maintain any expectation of privacy while using them or personal property to conduct company business.
• Specify that the organization's computers, telephones and other equipment generally are intended for business-related use with a limited amount of personal use being acceptable.
• Prohibit the transmittal or downloading of material that is offensive, pornographic, obscene, profane, discriminatory, harassing, insulting, derogatory or otherwise unlawful.
• Prohibit the transmittal or dissemination of the company's confidential information or trade secrets to any outside source.
• Explain to employees that all communications and files are subject to employer monitoring and that the employer has access to all such files, even those files that the employee has deleted from the system.
• Inform employees that any unauthorized use of the company's information systems can result in discipline, up to and including termination.
• Implement any disciplinary action taken pursuant to this policy fairly and consistently to avoid claims of discrimination.
• Require all new hires to sign a written acknowledgment that they have read and understand the policy and they agree to abide by its terms as a condition of employment with the company. In addition, it is a good idea to require employees to reaffirm their understanding of the policy at regular intervals.

Global Issues

For multinational organizations, employee privacy can be highly regulated, making employee monitoring much more difficult to conduct legally. For example, e-mails are electronic communications that contain employee data and, therefore, are subject to a host of international laws depending on the location of the workers involved. It is therefore recommended to seek legal counsel before implementing any employee monitoring when communications cross international lines.

See:

Western Europe: The Law on Hidden Video Surveillance of Workers

Ontario: Employers to Disclose Electronic Monitoring to Workers

Israel: Government Statement on Monitoring Employee Location Published

UK: Can an Employer Monitor Its Remote Employees Under GDPR?

Additional Resources

Search, Inspection & Investigation Policy

Electronic Communication Policy Acknowledgement

Workplace Monitoring and Surveillance Policy Acknowledgement

Expectations of Privacy Policy

Telephone Monitoring Policy

Use and Monitoring of Company Property Policy