Personal Emails Aren't Private on Corporate Devices

​For convenience's sake, it's common for employees to occasionally send and receive personal messages on their work email. Many workers in the private sector access both personal and work email on their personal cellphones.

But even though it's convenient, this commingling can lead to confusion when an employer may need to access messages an employee may have sent privately. For example, the employer may be conducting an investigation about another employee, or a supervisor may want to determine whether a worker violated company policy by lying about being sick. In these cases, what privacy rights do employees have, and what are employers' legal obligations?

Private-sector employees typically have no right to privacy for work email, though different state privacy laws govern whether employers can access a worker's personal email. Some states require employers to give notice before monitoring email or deploying keylogging software that tracks what employees type.

For financial and legal reasons, many businesses monitor employee use of their computers, networks and email servers to protect proprietary information and prevent data breaches. The federal Electronic Communications Privacy Act and Stored Wire Electronic Communications Act generally allow businesses to track what employees do on company-owned devices and networks in the normal course of business. For example, employers can use keylogger software to flag when someone uses certain words that might signal harassment or abusive behavior.

However, employers "can't just willy-nilly go look. They're going to need a legitimate business reason" to review an employee's keystrokes, said Mary Baker, an attorney with BerlikLaw in Reston, Va. "If you are in an industry where there are a lot of trade secrets, you could justify it more."

Other reasons could include finding a business record or investigating a suspected violation of company policy.

In an employee handbook, company intranet or onboarding materials, employers can notify workers that their work emails are not private and can be monitored for legitimate business reasons. However, Baker said companies risk alienating workers and job applicants if they do the same for personal emails.

Workers do have a reasonable expectation of privacy for their personal emails, except when the messages are downloaded onto or stored on a company-owned device, Baker added. "Most of us don't download or store our emails to our phone," she noted.

Government agencies and public universities are subject to different laws. Unlike private companies, public employers "might run into Fourth Amendment issues," Baker said, referring to the U.S. Constitution's protections against unreasonable searches and seizures by the government.

State laws vary as well.

"Unless the employee consented to access and the employer could prove the consent, accessing or monitoring personal email, even on a company-owned IT device, in most cases would be considered an invasion of privacy in California, and there are only rare cases where this should be done without consent," said Mark Spring, an attorney with CDF Labor Law in Sacramento, Calif.

Union Activity Policy May Change

The National Labor Relations Act prohibits employers from monitoring employees' personal emails or social media activity to learn about union organizing. The federal law also gives workers the right to communicate with one another about pay, benefits, working conditions and unionization efforts without interference from their employer. But companies can stop workers from using their company email for such purposes.

In 2014, the National Labor Relations Board (NLRB) ruled in Purple Communications that employers could not prohibit union activity that used company email. However, in 2019, the board reversed that decision. It ruled in Caesars Entertainment that companies can ban workers from using company resources, such as email systems and computer equipment, for union activity.

"However, if employers generally allow other solicitation to take place on their company email and other IT communications, even under current law, it might be difficult to prohibit use for union purposes under Caesars," Spring said.

Furthermore, Caesars "is not likely to be the law for much longer," Spring said, noting that NLRB General Counsel Jennifer Abruzzo has argued that "email has become a primary mode of communication in many workplaces, especially since the pandemic, and it is inappropriate to restrict workers' ability to communicate about organizing through company electronic channels." 

Forbidding union activity on personal email during work hours may be legal if the employer prohibits all access to personal email while at work or on company equipment, Spring said. "Most employers do not have policies that go this far, as most employers generally allow employees to access their personal email on company equipment on break time," he noted.

Remote workers have the same rights as their colleagues at the worksite, but they might be more reliant on email for union activities, if that's the only way they usually communicate with their coworkers.