E-Mail's Impact On Attorney-Client Privilege

(Published June 9, 2008)

Reprinted from PERSONNEL LEGAL ALERT, a widely read employment law newsletter that keeps HR executives up-to-date on the latest court cases, legal trends, government regulations, and federal legislation that affect the policies you write and procedures you administer.  Click here to view a sample issue, get more information, or sign up for a risk-free subscription.

 

Attorney-client privilege is a legal concept that protects communications between a client and his/her attorney by keeping those communications confidential.  If, however, the attorney-client communications are made within the presence of a third party, then, according to precedent, the attorney-client privilege is waived. 

 
What happens to attorney-client privilege when the communications between an attorney and his/her client — your employee — are sent from your company's computer system?  Has the employee waived attorney-client privilege, and can your company introduce those e-mails into evidence? 

 

Expectation Of Privacy In An Electronic Age

The principal issue in cases regarding attorney-client privilege for employee e-mails sent to/from work is whether or not the employee had a reasonable expectation of privacy for his/her personal e-mails and files on the company's computer system.  In a 2005 case, a New York court applied a four-factor test to assess the reasonableness of an employee's expectation of privacy.  (In re Asia Global Crossing, Ltd., Bankr. S.D.NY, 322 B.R. 247, 2005)  Use these four factors as guidance when writing or revising your e-mail policy so you can be sure that employees have no expectation of privacy where company computers are concerned.

 

1. Does the company maintain a policy that bans personal use of its e-mail system?  

 

Don't assume that you are free to monitor an employee's e-mail and use a former employee's personal e-mail against them in litigation.  Absent a policy that expressly prohibits personal use of a company-issued computer, a court may conclude that an employee had a reasonable expectation of privacy regarding personal files and e-mails.

 

The Virginia Supreme Court ruled that an employee's communication to his lawyer that was created on and printed from a work computer was not protected by attorney-client privilege because the employer's handbook stated that there was no expectation of privacy regarding the use of company computers.  (Banks v. Mario Industries of Virginia, Inc., VA Sup. Ct., Nos. 061348, 061355, 2007)

 

2. Does the company monitor the use of the employee's computer or e-mail? 

 

This helps to eliminate employees' expectation of privacy, but having a policy specifically allowing for monitoring carries more weight than whether the employer actually monitors employees' e-mails.

 

3. Do third parties have a right to access the computer or e-mails? 

 

The answer is fairly clear when an employee uses the company's e-mail address; the issue is less clear when an employee uses the company's computer, but a personal, Internet-based account (e.g., Yahoo, AOL, Hotmail).  Thus, your policy should specifically address the use of personal e-mail accounts on company computers.  Warn employees that the company reserves the right to monitor any e-mails transmitted through personal, Internet-based accounts that are stored on an employee's hard drive as temporary Internet files.

 

A company's policy warning employees that they have "no right of personal privacy in any matter stored in, created, received, or sent over the e-mail…and/or other Internet systems" precluded employees from claiming privilege over the contents of e-mails sent to their attorneys through Internet-based e-mail accounts that were password-protected and not on the company's e-mail system.  (Long v. Marubeni America Corp., S.D.NY, No. 05 Civ. 639, 2006)

 

4. Did the company notify the employee or was the employee aware of the use and monitoring policies? 

 

Computer usage and monitoring policies are not worth the paper they are written on if employees are not given adequate notice of them, so make sure that you disseminate the policy to employees, notify them of its enforcement, and get written acknowledgment of receipt.

 

Management employees may be considered to have constructive notice of the policy if they are responsible for disseminating the policy to subordinates.  (Scott v. Beth Israel Medical Center, NY Sup. Ct., WL 3053351, 2007)

 

Personal Pause

The issue of attorney-client privilege is yet one more reason why this advice bears repeating: Write and disseminate a clear policy regarding employees' use of company computers and e-mail systems.

 

Related Topic(s): Privacy Policy Guidelines/E-mail, IM, Web Surfing, And Blogging 

 

More information about this publication/Order a subscription.