Monitoring Personal E-Mail May Be Invasion Of Privacy

Published April 15, 2008

 

Reprinted from MANAGER'S LEGAL BULLETIN, a widely read employment law newsletter that communicates legal guidelines to managers through scenarios based on real-life cases. Click here to view a sample issue, get more information, or sign up for a risk-free subscription.

 

An employee checks her personal e-mail account at work.  The fact that she uses her work computer trumps the fact that the e-mail account is personal in nature and, thus, makes those e-mails fair game for her manager's monitoring eyes.  Or does it?

 

FOR EMPLOYEES' EYES ONLY

Instead of going out for her 30-minute lunch break, Mandy Lewis always ate at her desk.  It was her time to check her personal AOL e-mail account.

Her manager, company owner Rodney Bauer, had made it very clear that work e-mail accounts were subject to random monitoring.  Wanting to keep her private thoughts, well, private, Lewis never used her work account for anything other than business.  Her AOL account was a different story.  No topic was off-limits.

Lewis didn't realize that, by storing her AOL user name and password on her computer, not only did it allow her to access the account without having to constantly retype the information, but it also allowed anyone using her computer to access the account.

One day, while working on Lewis's computer in her absence, Bauer saw AOL's URL in her web browser.  Curious, he clicked on it and gained access to her personal account.  He was shocked to see e-mails criticizing his management style and detailing projects she was working on.

Bauer continued to secretly monitor Lewis's AOL account for nearly a year.  He copied and pasted any mention of work from her AOL account into a Word file, and he forwarded some passages to another manager.

When Lewis voluntarily resigned, the company sued her for breach of contract, conspiracy, and misappropriation of trade secrets based on the AOL e-mails.  Lewis fired back with her own lawsuit.  She claimed Bauer violated the Electronic Communications Privacy Act by accessing her private e-mail account and copying and forwarding private information without her authorization.  A jury agreed and ordered Bauer to personally pay $150,000 in statutory damages and $75,000 in punitive damages.  The company was on the hook for $50,000 in statutory and punitive damages.

 

FOR MANAGERS' EYES, TOO!

Generally speaking, under the Electronic Communications Privacy Act, messages sent on public e-mail systems are afforded greater privacy protections than those that are sent on completely "internal" company e-mail systems.  That doesn't mean you should shy away from enforcing a company policy that reserves the right to monitor personal e-mail accounts accessed via company equipment.  It means that you must drive home the point that employees should have no expectation of privacy when it comes to private e-mail accounts accessed at work.

1. Fully communicate the company's e-monitoring policy to employees.  Bauer stressed that work e-mail accounts were subject to random monitoring, but he failed to make it clear that the company also reserved the right to monitor personal accounts accessed using the company's equipment.  Explicitly warn employees that the company reserves the right to monitor any e-mails transmitted through personal, Internet-based accounts that are stored on an employee's hard drive as temporary Internet files.

2. Periodically remind employees that they should have absolutely no expectation of e-mail privacy, even if they are using personal accounts during non-working time (e.g., meal or rest periods, before the start of their shift).

3. Audit your motivations for monitoring a particular employee's personal e-mail activity.  Monitoring done in the ordinary course of business or as part of a workplace investigation will place you on the strongest legal ground.  Never monitor out of curiosity, like Bauer initially did, or to build a case against an employee who rubs you the wrong way.

4. Stop reading e-mail once you've determined that the subject matter is personal.  Bauer read most of Lewis's AOL e-mails from start to finish, even after it was clear that they weren't business-related.

5. Run your plan past higher-ups or corporate counsel before monitoring an employee's private e-mail account.  The fact that Bauer was able to access Lewis's AOL account doesn't mean that doing so was advisable.

 

More information about this publication/Order a subscription.