‘You’ve Got E-mail!’… And I’ve Got the Right to Read It

Warren the Worker hunches over his desk, positioning his body to block any view of his computer screen. Whenever you or other managers are near, he quickly minimizes the image, leaving only a pristine view of a work-related document. Then, when you’re gone, he’s back to whatever he was doing. “What is he looking at on that computer?” you ask yourself. And, just as importantly these days, “Do I, his employer, have a right to know or to control it?”

Answers to that second question recently came from attorneys Anthony J. Oncidi and Christopher Wolf, partners in the national law firm of Proskauer Rose, LLP, as they addressed a recent SHRM conference on the subject of workplace privacy. A large part of their presentation involved the issues raised by new technologies and communications sent through those offspring of the computer age: e-mails, instant messaging and blogging.

The attorneys started off with the fact that there is no generalized right to privacy in the United States. What there is, they said, is “an incomplete and often confusing patchwork” of laws, both federal and state. But it was possible to draw some generalizations.

First, telephone calls (including voice mail) and e-mails are generally protected from monitoring by the Electronic Communications Privacy Act of 1986 (ECPA). However, employers can listen in or check e-mails if:

—The employer is the supplier of the system being monitored, e.g. an internal e-mail system, but not e-mail which comes from an outside carrier, e.g., AOL or Yahoo.

—The employer has permission from one party to the communication. (Some states, including California and Florida, require all parties involved to allow it.) You can have employees give permisson to be monitored as part of their initial employment paperwork.

—The monitoring happens in the course of normal business—one example, that now-famous phrase, “monitoring for employee training or quality assurance purposes.”

—Monitoring stops as soon as the employer realizes that it is a personal, not a business, communication. (The time spent on the interchange may still be logged.)

—The employer has given workers advance notice that their calls or e-mails may be monitored, usually through a policy published in the workplace.

This last is key because privacy protections traditionally depend on whether a person has a “reasonable expectation of privacy” as they carry out the communication. Using the boss’s equipment, on the boss’s time, and notified in advance that monitoring may happen, it’s pretty hard for workers to later maintain that such an expectation existed.

Surprisingly, the attorneys declared that, in some cases, employers are obligated to monitor employee communications. In a dramatically named 2005 New Jersey case called “Doe vs XYC Corporation,” a worker used the office computer to engage in criminal activity. The court ruled that it was the employer’s job to stop that use if they knew it would harm a third party, and that the employer could be liable for damages if they didn’t.

IMs and Blogging

The boundaries of privacy are fairly well established for phone and e-mail. Not so for more recent communications technologies, said Oncidi and Wolf. One example is instant messaging (IMs). “The courts are still trying to decide if IMs are more like phone or e-mail,” they said. Another is blogging—the keeping of a personal diary out on the Internet where anyone can access it.

The harm to employers comes when bloggers, often writing anonymously but with their company’s identity revealed through the blog’s URL, disseminate confidential business information, libel company leadership or personnel, or write comments that can ruin a company’s public image.

The answer, said the attorneys, is to make a policy now regarding blogging. These elements should be part of it:

—Writers must identify themselves.
—A disclaimer that they are not speaking for the company must be included.
—Harassing, discriminatory or derogatory comments about anyone must be banned.