EMPLOYEE PRIVACY: Important Information Regarding Monitoring Employee Communications and Computer Usage

Transcription

1 EMPLOYEE PRIVACY: Important Information Regarding Monitoring Employee Communications and Computer Usage Francine Breckenridge Strasburger & Price, LLP

2 Overview Why Employers Monitor Employees The Fourth Amendment & City of Ontario v. Quon Federal Statutes Texas Common Law Privacy & the Attorney-Client Privilege Case Scenarios Social Media Emerging Technology & Privacy Law Takeaways & Recommendations

3 Why Do Employers Monitor Employees?

4 Reasons for Monitoring Employees Supervise and manage employee performance, quality of work, training, and customer service Protection and control of business property and confidential information Reduce misuse of internet and surfing the internet/social networking sites, playing internet games, accessing pornography, sending sexually related messages, gambling, shopping, etc. Limiting exposure to sexual harassment and hostile work environment claims

5 Reasons NOT to Monitor Employees Can lower employee morale May learn personal information you wish you did not know Has potential to create retaliation claims and/or unfair labor practice claims

6 Potential Legal Exposure for Not Monitoring Employees Most Common Sexual Harassment and Hostile Work Environment Vicarious Liability for Supervisor s Conduct Extreme Case of Potential Employer Liability: Doe v. XYC Corp. (N.J. Sup. Ct. App. Div. 2005) Negligence for failing to properly monitor employee after notice of improper behavior Other Cases where customers received threatening s from employees have not resulted in employer liability because such activities were outside the scope of employment or not part of the employee s job duties

7 Potential Legal Exposure for Monitoring Employees Retaliation and/or unfair labor practice claims based on employer knowledge of complaints about: Discrimination Wages Safety issues Accounting irregularities Terms and conditions of employment generally Invasion of privacy

8 Legitimate Business Interest Even if employees have a reasonable expectation of privacy in their work (which they generally do not), an employer s legitimate business interest in protecting its employees from harassment in the workplace would likely trump any privacy interests.

9 The Right to Privacy The Constitution, Statutes, and the Common Law

10 The Right to Privacy in the United States The legal right to privacy derives from three areas: Constitutional Law Statutes Common Law Common Theme: All require an underlying expectation of privacy which can be invaded by an unreasonable intrusion.

11 The Fourth Amendment The right of the people to be secure against unreasonable searches and seizures.

12 The Fourth Amendment Protection from Government Intrusion into Privacy Katz v. United States (1967) The Fourth Amendment protects people, not places. What a person seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected. A person must have an actual, subjective expectation of privacy and that expectation must be one that society is prepared to accept as reasonable.

13 The Fourth Amendment In Leventhal v. Knapek (2d Cir. 2001), an employee alleged that his employer violated the Fourth Amendment after it searched the hard drive on his office computer. The Court concluded the employee had a reasonable expectation of privacy in the contents of his computer because it was (1) in the employee s private office, (2) the computer was not shared with others, (3) and the agency never placed the employee on notice that he should have no expectation of privacy. Nevertheless, the Court found the employers search regarding the employee s misconduct to be justified and of appropriate scope.

14 The Fourth Amendment The Fourth Amendment applies directly only to public-sector employees, but because the Fourth Amendment and common law rights both require an underlying expectation of privacy, the analysis is generally the same in this regard. There is no definitive test to determine what is and is not private. The first question will always be whether the employee, public or private, has a reasonable expectation of privacy. If not, the employer cannot be liable.

15

16 Federal Statutes Electronic Communications Privacy Act of 1986 ( ECPA ) Title I restricts the use of wiretaps but has little impact on an employer s ability to monitor employee telephone calls because of the business use exception. Title II The Stored Communications Act ( SCA ) makes it illegal to access stored electronic communications without authorization but exempts seizures by providers of electronic communications services.

17 Title I of the ECPA Title I prohibits a person from intentionally Intercepting any wire, oral, or electronic communication Using an electronic, mechanical, or other device to intercept an oral communication Disclosing to any other person or using the contents of a wire, oral, or electronic communication that has been obtained in violation of the law Covered Practices: Listening to telephone calls, recording office conversations, intercepting or voic Not Covered: Video surveillance

18 Title I of the ECPA Exceptions Consent (unless the interception is for the purpose of committing any criminal or tortious act) Examples Person intercepting the communication is a party to the communication One of the parties has given prior consent to the interception Types Express Employees sign an agreement Implied Surrounding circumstances indicate that the party knowingly agreed to the surveillance (knowledge alone of the capability of monitoring is not sufficient) Business Use Ordinary Course of Business

19 Title I of the ECPA The employer must be able to justify a legitimate business purpose for continually monitoring employee telephone calls on a constant basis. Monitoring personal calls ordinary course of business? If company policy allows for personal calls, must stop after call determined to be personal.

20 City of Ontario v. Quon Case Background Police department officials obtained transcripts of text messages between 2 police officers and another government employee while investigating billing and whether department-issued pagers were being used for non-work purposes. The information was obtained without the employees specific consent and revealed personal text messages, many of which were sexually explicit. The City s policy did not directly address text messaging but covered computers and all associated equipment. A police official had informally told employees that no one would review their text messages so long as the employees personally paid for charges above a monthly allowance.

21 City of Ontario v. Quon Employees Claims & The Ninth Circuit s Opinion The employees sued the City, the wireless communications company, the police department, and others for alleged violations of the Fourth Amendment as well as the Stored Communications Act. The Ninth Circuit held that the City s review of the messages without the employees consent was excessively intrusive, given the department s informal policy that it would not audit the employees texts.

22 City of Ontario v. Quon U.S. Supreme Court Reverses On June 17, 2010, the U.S. Supreme Court held that the City s review was reasonable and did not violate the Fourth Amendment. The Court noted that the search was justified at its inception because it was necessary to determine whether the City s communications contract was sufficient to meet the City s needs. The reason for the search was legitimate and work-related as the City had an interest in ensuring that employees were not being forced to pay for work-related expenses out of their own pockets or that the City was not paying for extensive personal communications.

23 City of Ontario v. Quon U.S. Supreme Court Reverses The search was also not excessively intrusive because the department only reviewed transcripts for two months and all messages sent while the officers were off duty were redacted. The Court concluded that simply because the search revealed intimate details of the employees lives, the search was not unreasonable because under the circumstances, a reasonable employer would not expect that such a review would intrude on such highly private details.

24 City of Ontario v. Quon Impact on Employers and the Future that the employer had a legitimate reason for the search, and that the search was not excessively intrusive in light of the justification the Court also concludes that the search would be regarded as reasonable and normal in the private-employer context. The case was decided on narrow grounds to avoid the risk of error by elaborating too fully on the Fourth Amendment implications of emerging technology before its role in society has become clear.

25 Video Surveillance Open Work Areas There is no expectation of privacy. Nelson v. Salem State College (Mass. 2006) College employee is videotaped by a hidden camera while changing clothes and applying medication in a locked office. A number of employees retained a key to the office. Although the door was locked and the camera was hidden (to monitor after-hours thefts), there was no guarantee of privacy in her work space during office hours.

26 Video Surveillance Areas set aside for personal activities or items are given greater protection. When a locker and break room s purpose was designated for certain employees to safeguard their personal belongings, a court found that the employees had a reasonable expectation of privacy. Rosario v. United States (D. Puerto Rico 2008). Monitoring employees while in the bathroom or dressing room will probably constitute a highly offensive intrusion on an employee s right to privacy. See Cramer v. Consol. Freightways, Inc. (2001); Doe v. B.P.S. Guard Servs., Inc. (8th Cir. 1991).

27

28 Texas Common Law Texas recognizes a tort for invasion of privacy when there is an intrusion upon the plaintiff s seclusion or solitude or into his private affairs. The claim consists of Two Elements: (1) an intentional intrusion, physically or otherwise, upon another s solitude, seclusion, or private affairs or concerns, which (2) would be highly offensive to a reasonable person. When considering the offensive nature of the invasion, courts require the intrusion to be unreasonable, unjustified, or unwarranted.

29 Texas Common Law Two opinions in Texas are often relied on by other Courts. Employee Locker Case K-Mart Corp. v. Trotti (Tex. App. Houston [1st Dist.] 1984, writ ref d) Personal Folders McLaren v. Microsoft Corp. (Tex. App. Dallas, 1999, no pet.) (unpublished opinion)

30 K-Mart Corp. v. Trotti The Court concluded that an employee could reasonably believe personal items stored in a company provided locker would be free from intrusion and interference because the employee was allowed to use his own lock on the locker. The Court left it to the jury to decide if the employer s search of the employee s personal belongings was a highly offensive invasion of privacy. The Court noted that privacy would not be an issue if the employer conducted a legitimate, reasonable search of the company locker where the locker was left unlocked or when the lock was provided by the employer and a master key was retained.

31 McLaren v. Microsoft Corp. Employee saved on Employer s network in a folder that was password protected with the employee s personal password that he created. Employer accessed the folder and the employee sued for invasion of privacy. The Court distinguished the locker in Trotti from the personal folders because the locker was provided to the employee for the specific purpose of storing personal belongings, whereas the plaintiff s computer and the application were provided to him for the purposes of his employment. The storage system involved messages that were transmitted to the server-based inbox and stored there until the plaintiff moved them to his personal folders. The employee had no reasonable expectation of privacy in the contents of the messages such that the employer was precluded from reviewing the messages.

32 Privacy and the Attorney-Client Privilege

33 Privacy and the Attorney-Client Privilege Work Attorney-Client privilege likely waived Four Factor Test Is there a company policy banning personal use of s? Does the company monitor the use of its ? Does the company have access to all s? Did the company notify the employee about these policies? Alamar Ranch, LLC v. County of Boise (D. Idaho 2009) Employee did not attempt to protect the confidentiality of the messages by using a web-based password-protected account. The employer put all employees on notice that their s would (1) become the company s property, (2) be monitored, stored, accessed, and disclosed, and (3) s should not be assumed to be confidential.

34 Privacy and the Attorney-Client Privilege The Court noted that [i]t is unreasonable for any employee in this technological age and particularly an employee receiving the notice [the employee] received to believe that her s, sent directly from her company s address over its computers, would not be stored by the company and made available for retrieval. The Court found that the privilege was waived for both s from the employee to her attorney and the s from her attorney to the employee.

35 Privacy and the Attorney-Client Privilege Personal, Web-Based Attorney-Client privilege may survive Curto v. Medical World (E.D.N.Y. 2006) Company had similar policy as Alamar Ranch (above). Employer accessed s that an employee had sent via her work computer using a personal web-based account, and the employee worked at home where the employer could not carry out the regular monitoring policy it applied to on-site use. The Court found the attorney-client privilege had not been waived. Stengart v. Loving Care Agency (N.J. 2010) Employee used a company-issued laptop computer to access a web-based personal account and exchanged communications with her attorney. The employee anticipated filing a claim against her employer prior to her resignation from the company. Shortly after her departure, she filed an employment discrimination claim and her employer hired a forensics expert to record all files contained on the laptop she had been using. The company found numerous between the employee and her attorney and used it in preparation of its defense.

36 Privacy and the Attorney-Client Privilege In Stengart, the Court focused on the fact that the employee and her attorney clearly did not intend to waive the privilege (attorney-client privilege notices were posted on each ), and the employer s policy did not directly address use of third party accounts in any way. Thus, the Court found the privilege had not been waived. But the Court seemed to suggest that but for the attorney-client privilege issue, an employee might not have a reasonable expectation of privacy in a non-work-related personal account since the employer s computer was used to access the account over the internet.

37 Case Examples

38 Personal Computer at Work Employee uses his personal computer in a public work area and connects to his employer s computer network. The employee did not have any of his files on his computer password protected. In attempting to resolve a problem on the network, the employer searched his computer and found child pornography. Holding: While the employee may have had a subjective expectation of privacy, his failure to take affirmative measures to limit other employees access makes that expectation unreasonable. U.S. v. Barrows, 481 F.3d 1246, 1249 (10th Cir. 2007).

39 Secretly Recorded Oral Communications Between Employees in an Open Work Area Four employees were secretly recorded criticizing their supervisor in the corner of an open work area. Holding: The Court concluded that the employees had a subjective expectation of privacy because the employees intended to have a private conversation. Second, the Court found that the employees expectation of privacy was objectively reasonable because, although the work space was open, the employees took great care to keep the conversation private. Dorris v. Absher, 179 F.3d 420, (6th Cir. 1999).

40 Employee Uses Company Computer at Home Employee was fired after using a computer furnished by his employer for home business use to visit pornographic websites. Company had a written policy that the computer was company s property, was for business use only, and the employer retained the right to inspect the computer. Employee claimed there was an unofficial company policy that permitted home computers to be used for personal use. Holding: The Court rejected the employee s argument on the grounds that the employee could have no reasonable expectation of privacy given the company s written policies. TBG Insurance Services Corp. v. Superior Court (Cal. 2002)

41 Employer Has No Company Policy Employer used its supervisory password to read employee mail sent and received using an office system. Employees were not told that Employer had access using supervisory password and that the was saved in back-up files. Holding: The Court denied summary judgment against an invasion of privacy claim and found that there was a fact issue as to whether the plaintiffs had a reasonable expectation of privacy in their messages and whether the employer s reading of the messages constituted a substantial interference. Restuccia v. Burk Tech. (Mass Super Ct. 1996).

42 Employer Accesses Employee s Personal Web-Based Account Employer accessed employee s personal hotmail account as part of an investigation into whether employee used the employer s internet access for sexual conversations. The employer accessed the account by guessing the employee s password. The employer did not have an internet usage policy. Holding: The Court denied the employer s motion for summary judgment on the invasion of privacy claim. A fact issue existed as to whether accessing plaintiff s e- mail account is highly offensive to a reasonable person and whether plaintiff s account is a place that a reasonable person would consider private. Fischer v. Mt. Olive Lutheran Church (W.D. Wis. 2002).

43 Saving on Company Network and Internet Use Employee was terminated due to excessive internet use and because sexually inappropriate s were found in his folder on the network drive. Company had a policy restricting personal use of office computers and provided notice that activity could be monitored. Holding: The employee s invasion of privacy claim failed because he had no reasonable expectation of privacy in s saved on the network or in the websites he visited at work. Thygeson v. U.S. Bancorp (D. Oregon 2004).

44

45 Facebook s founder Mark Zuckerberg has claimed that the default is social. That means Facebook starts from the assumption that your personal information will be distributed far and wide without your consent.

46 Generation Standby Clearswift s Web 2.0 in the Workplace Report Most employees value trust, and the permission to use the Internet at work whenever they please, over compensation 79% of respondents said over and above job role and pay, the most important thing to them in a job included being trusted to manage their own time, and being trusted to use the Internet as they wish 62% of employees feel they should be able to access Web/social networking content from their work computer for personal reasons (compared to 51% of managers) in order to complete personal tasks "Generation Standby are so attuned to this way of working that even in these economically challenging times, one fifth (21%) would turn down a job that did not allow them to access social networking sites or personal during work time,

47 Issues now grow on Vines Product of Twitter and a new social networking site where people can share looping six second videos Like Facebook, people are using Vine to take videos of their workplace, tagging their videos with the hashtags such as #work, #hatework, #worksucks, or #f**kwork

48 Social Media 54% of CIOs ban the use of social networking sites such as Facebook, YouTube and Twitter at the workplace, but... 77% of workers are on Facebook 61% access Facebook during work hours They average 15 min./day on Facebook 87% don t have a business reason for using it 6% never access Facebook anywhere else 63% of the CIOs have a Facebook account Average company loses 1.5% of productivity per day to Facebook Twitter = 42 I hate my job tweets per hour on a Monday Social media has overtaken pornography as the #1 web activity

49 Houston s in New Jersey Two servers at Houston s sued after they were fired for violating company rules that demand professionalism, teamwork and a positive mental attitude. Servers had created a private MySpace page for their co-workers to air grievances against Houston s. The MySpace page was password protected and access was by invitation only. A co-worker showed the page to a manager. Another manager demanded her login information, and used that to access the postings, showing the website to company executives. Jury found that Houston's managers had violated the Stored Communications Act and the New Jersey Wire Tapping & Electronic Surveillance Act by intentionally accessing the MySpace page without authorization. The jury found in favor of the Defendants on the invasion of privacy claims finding that there was no reasonable expectation of privacy in the MySpace group.

50 Emerging Technology

51 Emerging Technology Global Positioning System (GPS) technology allows employers to track an employee s movements Watches, cars, PDAs, laptops and phones In 2005, 5% of employers used GPS to track employees with cell phones and 8% used it in vehicles. Employees have lost a number of the initial privacy cases related to GPS technology. Radio-frequency identification (RFID) would provide the ability for employers to constantly monitor the whereabouts of their employees. A few states have already banned mandatory implants. Arguments: Loss of privacy, dehumanization, demoralization, employee activism, overstepping Benefits: Employee safety, property protection, and efficiency

52 Emerging Trend? No personal access at work? King & Spalding, LLP took extreme step to combat hackers and banned employee access to all personal s (e.g. Yahoo, Gmail) Approach came as a result of advice from its internal security experts and outside consultants who say continued access to external systems creates a significant security risk. Beginning May 1, the firm will enable software on its internal network that blocks employees' access to popular -hosting sites and prohibit workers from logging into other personal accounts that are not included in the filter or can be accessed from other networks.

53 Takeaways & Recommendations

54 Takeaways While some courts hold that the employer must institute a policy of active monitoring and auditing to eliminate any expectation of privacy, employers legitimate business interests will generally outweigh an employee s expectation of privacy, if any. Even when an employee has a subjective reasonable expectation of privacy, it is protected against only an offensive invasion (or unreasonable search). Employee expectations of privacy will likely diminish even further as monitoring technologies become more generally available. The Supreme Court in Kyllo v. United States ruled that the use of thermal imaging technology to measure the heat emanating from a suspect s home required a search warrant because the technology used was not in general public use. In dissent, Justice Stevens noted that according to the majority, privacy protection dissipates as technology develops and enters general public use. Thus, the threat to privacy grows as more advanced monitoring equipment becomes more readily available.

55 Recommendations An employer should reexamine its policies to make sure they are sufficiently broad enough to include all types of communications used by employees and that they are actually followed by the company Adopt a social media policy Permissible/Prohibited Uses Consent broad as possible, blanket consent for hidden surveillance, limitations or exceptions for personal use Personal use/responsibility for content Identify if authorized or opinion of individual/company, position on anonymous posts Employer Access Emphasize respect and professionalism, the code of conduct applies Privacy and confidentiality Strengthen your confidentiality, non-disclosure, and non-solicitation policies Be vigilant

56