New Technology May Violate Employees' Privacy Rights by Pamela Bean-Ritter

I. INTRODUCTION

Thesis Statement:

While technology has provided new and better ways to for employers to observe their employees while working, many of these new electronic options are proving to violate employees' privacy rights. The right to privacy is one of the basic rights given to us in the U.S. Constitution (Fourth Amendment).
In recent years, technology has moved faster than the social mores and laws in our expanded global world. Specifically, in looking at the individual's rights in the workplace, recent legislation and case law provide some clarification on the rights of employers vs. employees.

The availability of telephones, e-mail, and the Internet in the workplace can lead to employee misuse, which results in decreased productivity and potentially inappropriate communications circulated at the workplace (e.g. derogatory statements, harassment, offensive humor, etc.). Employers have the right to adopt and enforce policies which limit employee use of e-mails, the Internet, etc. Just as the courts have ruled that employers have the right to limit and monitor the use of the telephone and other office resources, the courts have consistently been including new technological communications to be under the same umbrella.

Scope of the Paper

Electronic monitoring by employers has become widespread and includes the monitoring of employees through: electronic key cards, telephone calls, e-mails, computers (including internet), and videotapes.
My focus is to review and analyze recent legislation and court decisions relating directly and indirectly to e-mail surveillance and to provide a direction that the laws appear to be going on this issue.

II. MONITORING EMPLOYEES' E-MAILS

Fourth Amendment

The Fourth Amendment provides the "right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures…"1 This privacy right does not apply to the private sector or to electronic invasions of privacy. Thus, an employee working in the private sector technically cannot claim a constitutional violation of his/her invasion of privacy when it comes to e-mail surveillance. However, the Supreme Court has reviewed this right when it comes to telephone communications.

Federal Law

Title III of the Omnibus Crime Control And Safe Streets Act Of 1968 ("Title III") originally addressed the interception of "wire communications" (i.e., telephone calls). 2 With the growth of computer communications, Congress amended Title III by Title I of the Electronic Communications Privacy Act Of 1986 ("ECPA").3 Title III now defines an "electronic communication" as:

any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photo-electric or photo-optical system that affects interstate . . . commerce, but does not include . . . any wire . . . communication . . . . 4

Title III violation is a felony, punishable by five years' imprisonment. Also, an aggrieved "person" has a private right of action for, inter alia, (i) the greater of actual or statutory damages (which, in turn, are "the greater of $100 . . . for each day of violation or $10,000"), (ii) punitive damages, and (iii) attorneys' fees. Generally read, Title III's definition of "electronic communication" includes e-mail and Internet use.

An electronic communication may be put into electronic storage, but the storage is not itself part of the communication. The statutes therefore distinguish the "interception" of an electronic communication at the time of transmission from the retrieval of such a communication after it has been put into "electronic storage. 5

In Bohach v. City of Reno,6 the city's police department had an "Alphapage" system. A police officer could communicate with another officer by typing on a keyboard connected to a computer.

The police chief had "warned all users" that "every message is logged on the network." However, the chief had not warned officers that messages were automatically stored, and it was "unclear" what officers understood. 7 The court ruled that all messages are recorded and stored not because anyone is "tapping" the system, but simply because that's how the system works. It is an integral part of the technology. . . . E-mail messages are, by definition, stored in a omputer.

An electronic communication may be put into electronic storage, but the storage is not itself part of the communication. The statutes therefore distinguish the "interception" of an electronic communication at the time of transmission from the retrieval of such a communication after it has been put into "electronic storage." 8

Title III does not prohibit access to or use of stored electronic communications which probably minimizes its effect on employees' e-mail. Most standard e-mail programs automatically store all incoming and outgoing e-mail. 9 If the employer obtains e-mail by such storage instead of separate surveillance software, then--per Bohach--no Title III liability is triggered. 10

There are two important exceptions to Title III that are often cited. The first exception is "consent": "a party to the communication" may intercept and may give "prior consent" to intercept, even when the other party is unaware of the interception. 11 This one-party consent may be implied and not explicit. It may be implied from "surrounding circumstances," including knowledge of the interception. 12

The second exception, which is often termed the "ordinary course of business" exception, allows the use of:

any telephone or telegraph instrument, equipment, or facility, or any component thereof, (i) furnished to the . . . user by a provider of wire or electronic communication service in the ordinary course of its business . . . or (ii) being used by a provider of wire or electronic service in the ordinary course of its business. 13

In Deal v. Spears, 704 F.2d 577 (11th Cir. 1983)14 plaintiff Sibbie Deal was employed in a store owned by defendants (Spears). The Spears asked defendant Deal "to cut down on her use of the store phone for personal calls, and the told her they might resort to monitoring calls . . . ." Later, the store was burglarized. "The Spearses believed it was an inside job and suspected Deal . . . ."

The Spears began monitoring her calls in the store, "with no indication to the parties using the phone that their conversation was being recorded." They taped twenty-two hours of Deal's calls, including "sexually provocative" conversations with a non-employee. Deal sued. The Spears' defenses included "consent" and "ordinary course of business." At trial, the court rejected the defenses and awarded Deal $40,000 an statutory damages plus attorneys' fees. The Eighth Circuit affirmed.

By not informing Deal that they were actually monitoring the phone, consent was not given. Deal did not expect that her calls would be monitored since they had never done so before. They also indicated that they "hoped to catch her making an admission about the burglar" and thus monitored the calls secretly. 15

As for "ordinary course of business":

The Spearses had a legitimate business reason for listening in: they suspected Deal's involvement in a burglary . . . and hoped she would incriminate herself. . . . Deal was abusing her privileges by using the phone for numerous personal calls . . when there were customers in the store. The Spearses might legitimately have monitored Deal's calls to the extent necessary to determine that the calls were personal and made or received in violation of store policy.

But, the Spearses recorded twenty-two hours of calls, and . . listened to all of them but we do not believe that the Spears' suspicions justified the extent of the intrusion. . .
The scope of the interception in this case takes us well beyond the boundaries of the ordinary course of business.16 The courts indicate that employer ownership of the communications equipment alone is not sufficient to intercept employees' communications.
Second, the "ordinary course of business" exception often requires an employer (as the equipment's owner) to prove (a) it had a particular reason for intercepting particular communications, and (b) it took reasonable steps to intercept nothing more. In other words, this exception does not always allow blanket interception, especially of employees' personal communications. 17
Third, implied consent must be based upon employees' clear, prior knowledge that their communications will be intercepted. 18 Knowledge that communications can be or might be intercepted is likely insufficient.
Another federal law source is the National Labor Relations Act ("NLRA") 19 -- has only limited application to interception of electronic communications.
The NLRA applies in an organized or organizing workplace. For example, a collective bargaining agreement could limit an employer's right to intercept employees' communications (or at least could create a duty to bargain), even if Title III or State law otherwise would permit the interception. The NLRA might limit an employer's right to intercept employees' communications if that interception would hamper "the right to self-organization" or otherwise affect "concerted activities." 20
In Katz v. U.S., 389 U.S. 347 (1967), 21 the Supreme Court created a two-part test which determined whether an individual plaintiff had a reasonable "expectation of privacy." In this case, the court limited prohibitions against searches to public not private employers. Even if there was a reasonable expectation of privacy, the reasonableness of the search needs to be reviewed. The court provided a two prong balancing test: the employee's expectation of privacy and the reasonableness of the search. This test balances the nature of the intrusion against the importance of the government's interest. Using this test on e-mails in the workplace, it is likely that an employee's e-mail would not have an "expectation of privacy" since the system administrator has access to the system. Normally, the systems are backed up periodically and employees are informed and are aware that e-mails should be monitored. It is also advised that employers provide a related policy and communications to track that employees have been advised. It is helpful to have a signed waiver that the employee has no expectation of privacy and may be monitored. In looking at the reasonableness test, the goals of the employee vs. the employer, the employee's right to have personal and private messages may not outweigh the employer's rights.

In Arias v. Mutual Central Alarm Service, 202 F.3d 553 (2nd Cir. 2000) 22 the court held that legitimate business reasons justified the recording of all incoming and outgoing telephone calls. The business reasons justified the recording of telephone conversations to protect company information that was both sensitive and confidential. This practice has become the standard for employers.
In Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983),23 the court found that monitoring telephone conversations allowed the employer to guard against unauthorized use of the telephone or to determine if the phone call is personal or business-related.

The courts have consistently ruled that to monitor the employee telephone communications in the ordinary course of the employer's business is based on a legitimate business purpose, e.g. suspicion of employee wrongdoing is acceptable.

California Law

California's Privacy Act is in the Penal Code.24 Under §631, the anti-wiretapping law, anyone who

. . . willfully and without the consent of all parties . . . reads or attempts . . . to learn the contents or meaning of any . . . communication . . . in transit . . . over any wire, line, or cable or is being sent from, or received at any place within this state . . . is punishable by . . . imprisonment . . . 25

Under §632, the broader anti-eavesdropping/anti-recording law,
A "confidential communication," under §632 is one that is "carried on in circumstances as may reasonably indicate that any party to the communication desires that it be confined to the parties thereto . . . ." As with Title III, "consent" may be implied from the parties' prior knowledge of the recording. Sections 631's and 632's texts encompass e mail and Internet use, though no appellate court has yet decided the issue. 26

Any "person" aggrieved by a Privacy Act violation has a right of action for, inter alia, the greater of $5,000 or three times actual damages. In one case, plaintiffs were awarded full statutory damages for each of 44 face-to-face and telephone conversations secretly recorded by one party to the conversations. 27 Also, statutory damages may be awarded even absent any actual injury and absent any disclosure of the recording.

Section 632 has been applied beyond telephone communications. In California v. Gibbons,28 defendant Michael Gibbons invited a woman to his home and then--without the woman's knowledge--videotaped sexual activity between them.

In affirming Gibbons' §632 criminal conviction, the Court of Appeal held that the Privacy Act's purpose is to protect Californians against "new devices and techniques" regarding technology in "the entire privacy area." The Court further held that a "communication" refers ". . . broadly to the exchange of thoughts, messages, or information by any means." Therefore, ". . . a video recorder is an instrument which, if used in the manner proscribed under §632, is a recording device for purposes of the Privacy Act."29

As noted above, no reported cases have directly addressed the Privacy Act's applicability to computer use. Gibbons broadly interpreted §632 and extended it to new technology.

With regard to e-mail sent through an employer's network, though, two out-of-state, federal cases suggest that employees should know that all such e-mails are automatically stored and accessible to the employer. 30 Perhaps under these cases, employees ought not to expect privacy of such e-mail. Without a privacy expectation, e-mail transmitted through the employee's network probably does not qualify as a §632 "confidential communication." Conversely, if an employer fosters a privacy expectation (e.g., allowing personal e-mail to be sent and received), then perhaps an employee's use of a workplace computer could be a "confidential communication."

In Sanders v. ABC, in the workplace, as elsewhere, the reasonableness of a person's expectation of visual and auditory privacy depends not only on who might have been able to observe the subject interaction, but on the identity of the claimed intruder and the means of intrusion. 31

Employees should have lower expectations of workplace privacy, and Sanders does not necessarily apply to employers' intrusions. With Sanders' express refusal to adopt per se rules implies that common law invasion would be reviewed on a case by case basis. The question remains unanswered as to whether California employees have actionable common law rights against their employers for secret monitoring of computer use. Of course, an employee's knowledge that his or her e-mail will be monitored by the employer might show a lack of a reasonable expectation of even limited privacy in workplace e-mail. 32

California's Privacy Act provides employees with certain protections which exceed federal Title III's protections. For example, the Privacy Act:

o prohibits recording of communications unless "all parties" consent; Title III only requires one party's consent. 33
o prohibits recording of communications without reference to an employer's ordinary course of business; Title III expressly accepts such communications from its prohibitions. 34
o excludes evidence gathered in violation of it; Title III does not exclude illegally intercepted electronic communications. 35

Generally, California's greater protections are not pre-empted by Title III. 36

The Ninth Circuit noted that all actionable privacy claims in California depend upon "an expectation of privacy." Plaintiffs' expectation, in turn, required an analysis of the CBA. Accordingly, §301 mandated removal and dismissal of plaintiffs' judicial claims.

III. CONCLUSION

Currently, any secret interception of employees' e-mails might expose the employer to liability under California law and, possibly under Title III. The likelihood of employers' Title III exposure increases with blanket interception of personal communications via special software (i.e., not out of automatic storage).

Most employers (i.e., private, non-unionized, and non-unionizing employers) can reduce litigation by creating related policies, communicating policies, and obtaining employees' consent. Such consent can include:

o clear notice (whether by a surveillance software's warning feature or otherwise) to employees that all e-mail, Internet use, and other computer communications will be intercepted and used, thereby implying consent.
o alternatively, express consent by employees to interception and use (e.g. by adding such consent to the employment manual signed by employees).
o in either event and as an extra precaution, warning all recipients of outgoing e-mail of the employer's monitoring and use (because California Penal Code §632 lacks the one-party consent exception).

While, these steps may produce employee complaints, they also may prevent much e-mail and Internet abuse.

In California, the Supreme Court has found the employees have very little right to privacy in their employer's computer system. Employers may monitor websites visited by their employees and may block their employees from visiting certain websites. They can also limit their Internet usage to only business-related websites. If the employer has a policy that its computer systems are to be used only for work-related activities, it may reprimand or punish an employee who used its equipment for personal purposes. E-mails are considered to be company property if sent using company equipment, and many employers read or archive all e-mails sent through its system, both incoming and outgoing.

Endnotes

1] U.S. Constitution, Fourth Amendment

2] 18 U.S.C. §§ 2510-22.; S. Rep. No. 1097, reprinted in U.S. Code Cong. & Admin. News 1968, 90th Cong., 2d Sess., at 2154.

3] 18 U.S.C. § 2510(12). "Interstate commerce" under Title III is so broadly construed that using a telephone for a local call "is indisputably an instrumentality of interstate . . . commerce."

4] 18 U.S.C. § 2520(b), (c)(2)

5] 18 U.S.C. §§ 2511(4)(a), 2512(1).

6] Bohach v. The City of Reno, 932 F.Supp. 1232 (D.Nev. 1996)

7] Id. 932 F.Supp. at 1234 & n.2, 1235

8] Id. at 1234, 1235-36. United States v. Reyes, 922 F.Supp. 818, 837 (S.D.N.Y. 1996) (retrieving telephone numbers from pagers' memories is not a Title III violation).

9] Id. at 1236

10] Id. at 1237

11] 18 U.S.C. § 2511(2)(d)

12] United States v. Amen, 831 F.2d 373, 378 (2d Cir. 1987) cert. denied, 485 U.S. 1021, 108 S.Ct. 1573, 99 L.Ed.2d 889 (1988)

13] .U.S.C. § 2510(5)(a); 18 U.S.C. § 2511(2)(a)(i)

14] Deal v. Spears, 704 F.2d 577 (11th Cir. 1983)

15] Id. at 579

16] Id. at 580-81

17] Two courts have gone so far as to hold that, as a matter of law, "secretly" recording a telephone conversation is not "in the ordinary course of business." United States v. Harpel, 493 F.2d 346, 351 (10th Cir. 1974); George v. Carusone, 849 F.Supp. 159, 164 (D. Conn. 1994).

18] Supra, Deal v. Spears, 581

19] 29 U.S.C. §§ 151-69.

20] Hudgens v. National Labor Relations Board, 424 U.S. 507, 513, 96 S.Ct. 1029, 47 L.Ed.2d (1976)

21] Katz v. U.S., 389 U.S. 347 (1967)

22] Arias v. Mutual Central Alarm Service, 202 F.3d 553 (2nd Cir. 2000)

23] Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983

24] California's Privacy Act is in the Penal Code, §§630-637

25] CPC, §631

26] CPC, §632; Coulter v. Bank of America, 28 Cal.App.4th 923, 929, 33 Cal.Rptr.2d 766 (1994).

27] CPC, §§631-632;

28] California v. Gibbons, 215 Cal. App. 3d 1204 (1989)

29] Id., §631; Gibbons 1207

30] Smyth v. Pillsbury Co, 914 F.Supp. at 101 ("Once plaintiff who was an employee communicated . . . over an e-mail system which was apparently utilized by the entire company, any reasonable expectation of privacy was lost."); Bohach v. City of Reno, supra at 1234.

31] Sanders v. American Broadcasting Cos., 20 Cal. 4th 907 (1999)

32] Id., Sanders, 912-14

31] Id., Sanders, 923

32] CPC §632(a); 18 U.S.C. § 2511(2)(d)

33] CPC §§ 631, 632 with 18 U.S.C. §§ 2510(5)(a), 2511(2)(a)(i).

34] CPC §§ 631(c), 632(d)

35] People v. Conklin, 12 Cal.3d 259, 271-72, 114 Cal.Rptr. 241, 522 P.2d 1049 (1974); Roberts v. Americable International, Inc., 883 F.Supp. 499, 503 n.6 (E.D. Cal. 1995).

36] 29 U.S.C. § 185

 Create your own educational wiki!HelpPublic, not yet premium Privacy Policy RSS