Privacy in the E-Workplace: What Employers Need to Know

Today's employers face expanding "e-workforce" issues as e-mailing, texting, blogging and social networking become routine activities in the workplace, according to Karla Grossenbacher, an attorney with Seyfarth Shaw.

Employers have a variety of legitimate reasons to monitor employees' technology use, but they should be aware of the laws that place limits on their ability to access electronically stored communications, she said on Nov. 17 at the National Employment Law Institute Employment Law Conference in Washington, D.C.

Applicable Laws

Monitoring electronic communications in the workplace involves both a statutory and a common-law analysis, Grossenbacher said.

Under the federal Stored Communications Act (SCA), an employer can't—without authorization—intentionally access "a facility through which an electronic communication service is provided," unless the employer supplies the service.

[SHRM members-only toolkit: Managing Workplace Monitoring and Surveillance]

In other words, an employer can review e-mails sent and received through its own server, but it can get into trouble if it accesses an employee's personal e-mail account through a password that's stored on a work-issued device, Grossenbacher explained.

She noted that even if a monitoring activity is permitted under the SCA, an employer could still be liable under a state-law invasion of privacy analysis.

Invasion of privacy laws vary from state to state, she explained, but they generally provide that an employer can't intentionally intrude on the private affairs of an employee if the intrusion would be "highly offensive to a reasonable person."

For this reason, employers should even be cautious about reviewing employees' personal e-mails that are sent through their work accounts.

The employer's policy should expressly state that workers have no expectation of privacy regarding e-mails sent through the company's system and that the employer reserves the right to monitor work accounts.

'Without Authorization'

HR professionals may wonder what it means to access information "without authorization" under the SCA.

There aren't many cases that address employer access to stored electronic communications, Grossenbacher said.

"Even though we've had e-mail in the workplace for a long time, it takes a while for a lawsuit to get through the litigation process," she explained.

The following four federal district court cases considered whether an employer violated the SCA or state privacy laws by accessing electronic communications:

Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC, S.D.N.Y., No. 08 Civ. 4810 (Aug. 22, 2008)

• Two former employees started a business that competed with the plaintiff-employer. While still employed, one of the workers had accessed his Hotmail account from a company computer and stored his username and password. Thereafter, the employer accessed his Hotmail account, read his e-mails, and found additional passwords and usernames to access other accounts.
  
• The court found that the employer violated the SCA because its policy only provided notice that computers could be searched for evidence of personal e-mail use, not that the personal e-mail accounts would actually be accessed.
  
• The court said the employee's carelessness in storing his Hotmail password on the company computer wasn't the same as consent.
  
• "There is no sound basis to argue that [the employee], by inadvertently leaving his Hotmail password accessible, was thereby authorizing access to all of his Hotmail e-mails, no less the e-mails in his two other accounts," the court said. "If he had left a key to his house on the front desk at [his former employer], one could not reasonably argue that he was giving consent to whoever found the key, to use it to enter his house and rummage through his belongings."
  

Lazette v. Kulmatycki, N.D. Ohio, No. 3:12-cv-2416, (June 5, 2013)

• A fired employee turned in her company-issued BlackBerry without deleting her personal Gmail account from it.
  
• The employer read her personal e-mails over an 18-month period before the former employee found out and changed her password.
  
• The employer argued it was authorized to read the e-mails through the employee's "implicit consent" because she didn't delete the information when she turned over the device.
  
• The court sided with the employee and found that the employer violated the SCA. The employee's negligence in failing to delete the information wasn't the same as approving or authorizing access.
  

Sunbelt Rentals, Inc. v. Victor, N.D. Cal., No. 13-4240 (Aug. 28, 2014)

• An employee who left the company turned in an employer-provided iPhone and iPad but forgot to de-link his Apple account, and his text messages continued to show up on the devices.
  
• The court found no violation of the SCA because texts are not "communications in electronic storage" within the meaning of the SCA.
  
• The court also found no invasion of privacy issue because the employee had no expectation of privacy in regarding text messages on a company-issued phone that was no longer in his possession.
  

Grossenbacher noted that the SCA was written in 1986 before today's technology was foreseen or understood.

Maremont v. Susan Fredman Design, N.D. Ill., No. 1:10-cv-07811 (March 3, 2014)

• A marketing director set up social media accounts for her employer through her personal accounts.
  
• The employer found a spreadsheet containing the passwords and accessed her personal and professional accounts while she was absent from work.
  
• The court held that no actual damages were needed for the employee to bring a lawsuit under the SCA and receive attorney fees and punitive damages.
  

Key Takeaways

Grossenbacher said employers should consider the following points from the available case law:

• Consent to access personal information is essential under the SCA and state privacy laws.
  
• Negligence doesn't equal consent.
  
• Texts appear to be less protected than e-mails.
  

Employers should think about who is setting up the business' social media accounts and should have a clear understanding upfront about who is granted access to those accounts and what rights employees have with regard to those accounts, she added.

Was this article useful? SHRM offers thousands of tools, templates and other exclusive member benefits, including compliance updates, sample policies, HR expert advice, education discounts, a growing online member community and much more. Join/Renew Now and let SHRM help you work smarter.