Employers Who Monitor Employee Internet and Email Usage Should Monitor Their Policies as Well

In the last 15 years, technology has changed the way all companies conduct business.  Gone are the days of doing business by letter, telex, and fax.  Today, forms of communication such as email, text messages, and the Internet that allow more rapid exchanges are the irreplaceable tools of commerce.  The Internet in particular has changed the way business is done in America.  It permits instant access to an unlimited supply of information, and it allows companies to connect with their clients instantaneously and more efficiently.  It is safe to say that Internet access is now essential in order for most companies to stay competitive.  To answer the question "what is your company's website address?" with "we don't have one" is becoming, if it has not already become, a commercial kiss of death.

For employers, however, there are many disadvantages to Internet access in the workplace.  Employee access to the Internet can cause real problems that are difficult to control and monitor.  While the Internet is full of information that can be beneficial to a company's bottom line, it also has the potential to distract employees and decrease their productivity.  The time an employee spends updating a Facebook® page, shopping for books on Amazon.com®, studying fantasy football rosters, or trading personal emails is time taken away from the job the employee is paid to perform. 

A decrease in productivity, however, is not the only risk associated with Internet use by employees.  Certainly, accessing sexually-oriented websites is inappropriate for the workplace except, perhaps, for a handful of uniquely specialized businesses.  Employees accessing such websites or controversial or politically incorrect websites from the workplace can expose a company to complaints of sexual, racial, or other prohibited harassment.  Furthermore, employees' use of the Internet at work can risk copyright violations, inadvertent disclosure of trade secrets, contamination of the employer's computer system by viruses, and other hazards.

Employers' Monitoring of Employees' Internet and Email Use

In order to protect against these risks, many employers have instituted programs through which they monitor their employees' use of Internet and email.  Although private employers generally are permitted to engage in this practice now, it initially led to a number of lawsuits based on claims of invasion of privacy rights.  Borrowing from case law construing the Fourth Amendment's prohibition against unreasonable searches and seizures by governmental authorities, courts have held that employers can monitor their employees' use of the Internet and email, provided the employees are given notice of such practice.  Once the employees have been put on notice that a monitoring program is in place, the courts have ruled that the employees no longer can claim any reasonable expectation of privacy when using their employers' computer systems.

Employers frequently use their employee handbooks to notify employees of Internet and email restrictions and monitoring policies.  Usually, such handbooks not only explain the extent of the employer's monitoring policy, but also that, as a result, the employee has no reasonable expectation of privacy when using the Internet or email at work.  Generally, courts have found such notices to be sufficient to meet the employers' obligation to inform employees of the policies and the lack of privacy.  For example, in a 2000 decision, the United States Court of Appeals for the Fourth Circuit (which hears all appeals of federal cases arising in North Carolina) upheld a policy that informed employees that the employer would "audit, inspect, and/or monitor" employees' use of the Internet and email.  As a result, the Court dismissed the employees' claims that they had a reasonable expectation that the files they downloaded onto their work computers for personal use would remain private.

Employers' Monitoring of Employees' Use of Personal Email Accounts at Work

Although most employees have access to a company email account, many also maintain their own personal email accounts through an Internet-based provider such as Yahoo® or Gmail®.  In fact, it has been reported that Yahoo® and Gmail®, combined, had at least 121 million users in 2008.  Given this widespread use, it is likely that employees are accessing and using their personal email accounts from the workplace.  Although many employers feel it is their right to monitor such activity, special problems are presented when employers attempt to monitor the content of emails sent and received by employees on their personal email accounts while at work. 

One reason that many employees maintain personal email accounts may be their recognition of the fact that they have no reasonable expectation of privacy with regard to emails sent or received through their employer's email account.  However, these same employees may well have an expectation of privacy in the content of emails transmitted through their personal email accounts, even if these emails are accessed from their employer-owned work computers.  Under a standard Internet use policy, employees should be placed on notice that their use of their personal email from company computers is not private.  This will not improperly limit or discriminate against any right to personal use (because one of the main justifications for having monitoring policies is to minimize employees' personal use of the Internet on company time – a legitimate objective), but should prevent any expectation of privacy from being held by a court to be "reasonable."

Employees' use of personal email accounts at work also implicates many of the other factors that motivated companies to monitor Internet use in the first place.  For example, an employee can disclose a company's trade secrets in an email to a friend through the employee's personal email account just as easily as from the employer's email account.  In fact, arguably, an employee would be more likely to disclose such information inadvertently in a personal email in which a more casual style is used than in a business email using the employer's account where a somewhat more formal style is used and which is written when the employee is more focused on business issues.  Furthermore, an employee may be more apt to use a personal account to send an email containing inappropriate racial, political, or sexual language or images to a co-worker, thereby potentially subjecting the employer to a claim of illegal harassment even though the offensive email was not sent through the employer's account.  Thus, an employer has a strong motivation and understandable reason to monitor its employees' use of personal email accounts from an employer-supplied computer and workplace, not just its employee's use of the employer's email system.

Nevertheless, many employees believe that their access to, and use of, personal email accounts at work should not be monitored, regardless of whether their employer has a monitoring policy.  In a recent well-publicized and important ruling from the New Jersey Supreme Court, employees found some support for their argument that their personal email account usage should maintain its privacy, although the case was complicated somewhat because the employee's attorney-client privilege was implicated.

In the New Jersey case,* an employee sued her former employer for allegedly violating New Jersey's law prohibiting discrimination in the workplace.  During the course of the litigation, the employer searched the hard drive of a laptop computer it had issued to the employee during her employment.  The search disclosed that the employee had used her company laptop to access her personal and password-protected Yahoo® email account in order to send messages to, and receive messages from, her attorney.  The employer was able to retrieve and read those emails.  The employee argued that these emails were protected from disclosure.

The employer, however, claimed that it had a right to access these personal emails due to its Internet monitoring policy of which the employee had been made aware.  The policy stated that the employer "reserve[d] and will exercise the right to review, audit, intercept, access, and disclose all matters on the company's media systems and services at any time, with or without notice."  Furthermore, the policy clearly stated that use of email and the Internet by employees was "considered part of the company's business and client records [and that these] communications [were] not to be considered private or personal to any individual employee."  Finally, the policy clearly stated that, although "[o]ccasional personal use" of email was permitted, "[t]he principal purpose of electronic mail (e-mail) is for company business communications."

Under the facts presented, the New Jersey Supreme Court found that the employee had a reasonable expectation of privacy in the content of her emails to and from her attorney through her personal email account even though she accessed it from her company-issued laptop.  The Court found that the employee's expectation of privacy was reasonable because a personal and password-protected account was used; the communications took place with her attorney; and the employer's Internet and email policies acknowledged that occasional personal use of email was permitted. 

Nevertheless, the Court recognized that employers could monitor their employees' personal email usage from employer-owned computers under some circumstances.  In order to allow an employer to do so, however, the Court stated that a much less ambiguous email policy explicitly prohibiting all personal use of the Internet would be necessary.  Such a policy would have to stress in clear terms that the employer would monitor the content of personal emails accessed by the employees from a work computer regardless of whether they were transmitted through a personal email account.  The Court also observed that employers could discipline their employees for excessive personal use of the Internet even when they allowed limited, reasonable personal use.  For example, if an employer's monitoring discloses that a certain employee spends an excessive amount of working time accessing a personal email account, the employer could discipline (or even terminate) the employee for the excessive usage.

In the context in which it was ruling – that is, emails to and from an attorney, the latter of which were clearly marked as confidential and protected by the attorney-client privilege – the New Jersey Supreme Court held that the employer could discover any violation of its usage policy without any need to access the content of the employee's personal emails.  Therefore, the Court held that the employer had violated the employee's subjective and reasonable expectation of privacy by reading and attempting to use the privileged content of the emails in the pending litigation. 

Outside of the unique context of the New Jersey case, it is certainly arguable that an employer with an appropriate policy would be able to read the content of personal emails, as that would be necessary in order to accomplish the goal of preventing or punishing the transmittal or receipt of trade secrets, harassing messages, or other improper information.

Summary

To date, North Carolina courts have not ruled on an employer's right to access the personal Internet usage or emails of an employee.  Although the New Jersey Supreme Court's ruling in the case discussed above is not binding on North Carolina courts, its groundbreaking holding is likely to be very persuasive when these issues inevitably present themselves.  Proactive employers should revise their Internet and email monitoring policies with the following points in mind: 

1. If the employer wants the right to monitor both the amount and content of any Internet or email use by employees from the employer's Internet and email accounts, its policies should state so clearly in order to undermine any argument that its employees retain a reasonable expectation of privacy in their Internet use and emails. 
2. If the employer does not want to allow any use of, or access to, personal email accounts at work, it needs to state this explicitly in its policies.
3. If the employer is willing to bow to reality and, at the same time, not negatively affect employee morale, the employer might adopt a policy allowing "reasonable" personal use of the Internet and access to personal email accounts.

No matter which approach is chosen, each employer should consider carefully whether to monitor the actual content of emails transmitted through a personal email account since there arguably is no need to access the content to accomplish at least the goal of punishing excessive personal use.  However, if an employer decides to monitor content in order to accomplish other legitimate objectives, its policy should so state in no uncertain terms. 

In any event, because this is an emerging area of the law, employers should review their policies often to ensure that they are up to date and in compliance with the most recent statutes, rules, regulations, and court decisions.

© 2010, Ward and Smith, P.A.

For further information regarding the issues described above, please contact Jeremy R. Sayre or Kyle R. Still.

--
This article is not intended to give, and should not be relied upon for, legal advice in any particular circumstance or fact situation. No action should be taken in reliance upon the information contained in this article without obtaining the advice of an attorney.