PRIVACY RIGHTS IN A HIGH-TECH WORLD: MONITORING EMPLOYEE , VOIC , AND INTERNET USE. June

Transcription

1 PRIVACY RIGHTS IN A HIGH-TECH WORLD: MONITORING EMPLOYEE , VOIC , AND INTERNET USE June Brussels Frankfurt Harrisburg London Los Angeles Miami New York Philadelphia Northern Virginia Pittsburgh Princeton Tokyo Washington

2 Privacy Rights in a High-Tech World: Monitoring Employee , Voic , and Internet Use June 2001 The technological innovations developed over the past several years have revolutionized the workplace. , voic , and Internet access have become an integral part of an employee s workstation and have dramatically increased worker productivity. Although these innovations provide many benefits, they also pose potential pitfalls for the unwary employer. With a few simple keystrokes, your employees may be able to view pornography on the Internet, send offensive s to co-workers or clients, or circulate your latest customer lists and other confidential information to your competitors. Putting aside lost productivity and other business consequences, employers are concerned about the content of their employees electronic files, communications, and Internet use for another reason: companies are increasingly being held accountable in harassment and discrimination lawsuits as a result of evidence derived from electronic or voic communications. Faced with these potential consequences, many employers routinely monitor employee , voic , and Internet use. As employer monitoring becomes more refined and as employee termination cases increase and continue to receive publicity, employees are becoming more concerned about the monitoring of their s and other activities and are questioning the propriety and legality of employer monitoring. Employer monitoring of employee , voic , and Internet use raises a host of issues under both state and federal laws. This paper is not intended to represent a comprehensive survey of the laws implicated by such monitoring. Those laws will vary from state-to-state. Rather, the goal is to alert employers of some of the risks associated with monitoring , voic , and Internet use and to provide some suggestions about how to minimize the risk that such activity will give rise to legal liability. THE EMPLOYER S DILEMMA: PROTECTING ITS LEGITIMATE BUSINESS INTERESTS FROM THE THREATS POSED BY , VOIC , AND INTERNET USE WHILE NOT VIOLATING APPLICABLE LAWS RESTRICTING EMPLOYER MONITORING , voic , and desktop Internet access have opened up numerous additional avenues for sexually-oriented or offensive messages and material to be disbursed throughout the workplace. A hostile work environment may be created through unwelcome and voic messages and inappropriate Internet usage. Courts have also addressed race and age harassment claims based, at least in part, upon offensive s. The extent to which an employer may be held liable for a sexual harassment claim based upon the content of or voic messages or Internet material depends upon the frequency and severity of the messages or material, the employer=s knowledge of it, and the employer=s response. The versatility and simplicity of also undermines the ability of companies to protect their trade secrets and other confidential information from disclosure. A disgruntled employee, for example, could easily disseminate sensitive information to anyone connected to the This White Paper is published to inform clients and friends of Morgan Lewis and should not be construed as providing legal advice on any particular matter Morgan, Lewis & Bockius LLP

3 network, including outside users, competitors, and future employers. Given the potential liability and business consequences inherent in unfettered employee use of the Internet and office electronic and voice communication tools, employers are monitoring their employees activities. Employer action is not only justified, but is arguably mandated by the Supreme Court=s opinions in Faragher v. City of Boca Raton, 524 U.S. 775, 807 (1998) and Burlington Industries, Inc. v. Ellerth, 524 U.S. 742, (1998). In those opinions, the Supreme Court made clear that responding aggressively to harassment complaints is the only way for a company to protect itself from costly claims. The predicament in which employers now find themselves is that, in seeking to avoid harassment liability by taking preventive and/or remedial actions, they run the risk of being sued by the disciplined/terminated employees or their unions. Employers thus face legal risks both from failing to monitor their employees use of , voic , and the Internet, and from monitoring such use. This legal predicament necessitates that employers act pursuant to clearly-defined policies regulating both employee use of the company s systems and the employer s monitoring of such use. PRIVACY RIGHTS IMPLICATED BY EMPLOYER SURVEILLANCE A. State Law Common Law Invasion of Privacy: Unreasonable Intrusion Upon Seclusion An employee's right to /voic /internet use privacy is largely governed by state tort law. There are four distinct torts protecting the right to privacy, but the one that is most relevant to the monitoring of /internet use by employers is unreasonable intrusion upon the seclusion of another. See Restatement (Second) of Torts 652A. The Restatement defines the tort as intentionally intruding, physically or otherwise, into the private affairs of another or upon his/her seclusion. Liability under this tort does not require that the information acquired be publicized or used by the employer. Rather, to establish the tort, the complainant must show that a reasonable person would consider the intrusion highly offensive. Courts generally consider electronic surveillance, such as telephone monitoring, an Aintrusion@ sufficient to establish that element of the tort. In evaluating the offensiveness of the intrusion, courts examine Athe degree of intrusion, the context, conduct and circumstances surrounding the intrusion, as well as the intruder=s motives and objectives, the setting into which he intrudes, and the expectations of those whose privacy is invaded.@ Id. While express or implied consent is one defense to liability, the mere good faith belief that consent has been given is normally not a defense. State courts responding to such tort claims have generally attempted to balance the employee's reasonable expectation of privacy against the employer's business justification for monitoring. Thus, the critical issues examined when determining whether an employer should be held liable in tort for monitoring or intercepting employee messages are: (1) does the plaintiff have a reasonable expectation of privacy and, if so, (2) was there a legitimate business justification for the intrusion sufficient to override that privacy expectation. This White Paper is published to inform clients and friends of Morgan Lewis and should not be construed as providing legal advice on any particular matter Morgan, Lewis & Bockius LLP

4 State Statutes and Constitutions Several states have statutes protecting against the interception of electronic communications. See, e.g., New Jersey Wiretapping and Electronic Surveillance Control Act, N.J.S.A. 2A:156A-1 et seq.; Pennsylvania Wiretapping and Electronic Surveillance Act, 18 Pa. Cons. Stat. Ann et seq. In 1998, Connecticut enacted legislation, which requires employers to give previous written notice of electronic monitoring to all employees who may be affected by that monitoring. Ct. St. Ann d. The statute, however, carves out exceptions to the notice requirement to protect companies and their employees from criminal activity and from hostile work environments. This statute, and those like it in other states, is largely patterned after the federal Electronic Communications Privacy Act, discussed below. Proposed legislation in Indiana would require employers, who do not monitor s and Internet use on a continuous basis, to notify workers of surveillance with a flashing light or beeping tone. See Weaver, G., Indiana Bill Calls For Workplace Surveillance Guidelines, The Indianapolis Star (Jan. 23, 2001). Some state constitutions, like California s, include a right to privacy that is applicable to private entities. The propriety of employer monitoring of , voic , and Internet use under such constitutions likely will hinge on factors similar to those analyzed under the Fourth Amendment to the United States Constitution. The Fourth Amendment considerations are discussed below. B. Federal Law The Electronic Communications Privacy Act The Electronic Communications Privacy Act of 1986 ("ECPA"), 18 U.S.C et seq., prohibits the unlawful intentional interception of wire, oral and electronic communications, including . Although the ECPA seemingly prohibits the monitoring of employee s, the statute contains numerous exceptions that allow employers to avoid its application. For instance, the prohibition against intercepting communications does not apply where the monitoring is conducted by an service provider in its usual course of business or where one of the parties to the communication consents to the monitoring or interception. See 18 U.S.C. 2511(2)(d); 18 U.S.C. 2511(2)(a)(i). a. Ordinary Course of Business There is an exception to the ECPA for the monitoring of electronic communications by employers in the ordinary course of business. In applying this exception, courts have focused on whether the business reasons set forth by the employer justify the monitoring. In performing this analysis, courts have applied either a context approach or a content approach. Courts applying the context approach focus on the following two factors: (i) did the employer provide notice to the employee of the monitoring? and (ii) was the level of monitoring justified? Under this analysis, employers generally may not engage in unlimited monitoring. Thus, employers should be aware that courts will explore the reasons for employer monitoring and will limit the scope of monitoring. In contrast, the content approach examines the employer=s business interest by evaluating Morgan, Lewis & Bockius LLP 2

5 whether the communication at issue was business or personal. Courts usually find that employer monitoring of business communications is justified, but employer monitoring of personal communications is unjustified. b. Consent Consent is another exception to the ECPA. Consent may be implied or actual. Implied consent may be found where employees know, or should know, that the employer is monitoring communications on its systems. Courts will not find implied consent where an employee is merely aware that communications may be monitored, as opposed to being aware that they are being monitored. c. Other considerations Electronic under the Act are limited to those affecting interstate commerce. Thus, arguably, messages that are not intercepted in the course of interstate transmission or those transmitted on an employer=s completely internal system would not be considered an Aelectronic within the meaning of the ECPA. See, e.g., Andersen Consulting LLP v. UOP and Bickel & Brewer, 991 F. Supp. 2d 1041, 1042 (N.D. Ill. 1998) (determining that a partnership that maintained an internal system was not a Aprovider@ of electronic communication that could be held liable under the ECPA). Finally, there is authority that retrieving messages from storage after they have been transmitted does not constitute an interception under the ECPA. See, e.g., Fraser v. Nationwide Mutual Ins. Co., No. 98-CV-6726, 2001 WL , at *9 (E.D. Pa. Mar. 27, 2001) (The court granted summary judgment in favor of the employer on this claim, explaining that [r]etrieval of a message from storage while it is in the course of transmission is interception under the Wiretap Act; retrieval of a message from storage after transmission is complete is not interception under the Act. ). Public Employers Potential Constitutional Implications In contrast to private employers, public employers are constrained by the United States Constitution when monitoring employee communications. Monitoring and restricting of employee and Internet use may implicate both the Fourth Amendment, which protects individuals from unreasonable searches and seizures by state actors, and the First Amendment, which protects against restrictions on speech by state actors. In making decisions about monitoring and restricting employee and Internet use, public employers must balance their own interests in invading employee privacy and/or restricting employee speech against their employees' constitutional rights and reasonable expectations of privacy. The Supreme Court explained this principle in O'Connor v. Ortega, 480 U.S. 709 (1987), in which it held that public-sector workplace searches are constitutional if they are narrowly tailored to the government's interest in the efficient and proper operation of the job site. The Court found that Fourth Amendment rights are violated only if public employees have an expectation of privacy that society is prepared to recognize as reasonable. The Court noted that this privacy expectation may be reduced by virtue of actual office practices and procedure, or by legitimate regulation. Id. at 717. First Amendment issues raised by the restriction of Internet use were addressed by the Fourth Circuit in Urofsky v. Gilmore, 216 F.3d 402 (4th Cir. 2000), cert. denied, 121 S. Ct. 759 (2001). Morgan, Lewis & Bockius LLP 3

6 The plaintiffs in that case were professors at public universities and colleges who brought suit challenging the constitutionality of a Virginia statute restricting state employees from accessing sexually explicit materials on computers owned or leased by the state. The court upheld the statute, finding that the state=s interest in preventing a sexually hostile working environment outweighed the state employees= interest in free speech. Although the above Fourth and First Amendment considerations apply primarily to public employers, private employers who act at the direction of government regulations or officials may be found to be state actors. Additionally, constitutional provisions may apply to private employers that act as governmental bodies or substantially undertake governmental functions. Thus, in certain situations, private employers may need be to be sensitive to their employees= rights under the Fourth and First Amendments. /VOIC /INTERNET USE POLICIES The cases discussed above demonstrate the importance of reducing employees expectations of privacy in the workplace. One effective way to do so is to create and publish an /voic /internet use policy. The benefits of a written policy are manifold. First, it sets the boundaries for employee use of and the Internet. Second, it puts an employee on notice that the employer will monitor the use of its computer equipment and electronic services. This diminishes any expectation of privacy an employee may have regarding and Internet use. Although policies must be crafted based on the specific needs of a company, all policies should, at a minimum: $ Notify employees that company communication systems are primarily for business use and that the company reserves the right to review, audit, and disclose all matters disseminated or stored on its systems; $ Include , voic , and computer files stored on the employer=s computer systems; $ Inform employees that all computer files, , and communications stored on company computer systems are company property; $ Inform employees that the mere deletion of a message or file does not eliminate the employer=s ability to receive and review it; $ State that the employer reserves the right to review computer files, , and communications stored on the company=s computer system at any time for any reason; $ State that the company policy prohibits discriminatory messages and prohibits obscene, derogatory, defamatory, or other inappropriate messages, including any sexually explicit material, ethnic or racial slurs, or anything that could be interpreted as disparaging of others based on race, national origin, gender, sexual orientation, age, disability, or religion; $ Explain that any password protection provided to the employee with respect to e- mail or voic does not provide a special right of privacy to the employee. Password protection is given only to prevent other employees from accessing the employee=s communications, and does not protect the employee from access by the employer; Morgan, Lewis & Bockius LLP 4

7 $ Make clear what use is acceptable and what use is unacceptable, and explain the consequences for violating the policy (for example verbal warnings, written warnings, dismissal, or other disciplinary action), while leaving the employer room to impose the appropriate discipline on a case-by-case basis. With regard to implementation, if the employer is instituting a new policy or changing the policy, it must alert all employees via company-wide s or meetings, update its handbook with the policy, and include the policy in the information packet provided to new hires. In addition to the written notification in the handbook or other materials, ongoing notice to employees can be provided by programming a message that would appear on employee computer monitors each time the employee accesses the computer system. Any policy that is implemented should be accompanied by a form that employees should be required to sign acknowledging the employer s absolute right to access the system s information. Requiring employees to sign the form will further diminish any expectation of privacy in the information transmitted and may be used to combat a claim that the employee was unaware of the policy. Finally, employers must be prepared to enforce the policy if it is violated, and must be as consistent as possible in their enforcement efforts. In addition to any policy that is implemented to prevent against discrimination or harassment claims, a policy that prohibits the unauthorized disclosure of confidential information to third parties via electronic media may be implemented. In such a policy, employees should be encouraged to report immediately any such incidents to the appropriate corporate personnel, and the company's overall written confidentiality policy should reflect these concerns. Employees should also be reminded periodically not to leave messages on their screens when they leave their computers and to change their passwords frequently to avoid unauthorized access by hackers. Morgan, Lewis & Bockius LLP 5

8 Morgan Lewis Labor and Employment Law Practice Group has extensive experience in the drafting and implementing /voic /internet use policies, in addition to defending claims of sexual harassment, discrimination, and invasion of privacy. If you have any questions about the risks of employer monitoring of , voic , or Internet use, feel free to contact one of the following attorneys: Philadelphia Steven R. Wall Princeton Thomas A. Linthorst Pittsburgh Christopher K. Ramsey Washington Nancy R. Kuhn New York Amber L. Kagan Los Angeles Jane Howard-Martin Miami Anne Marie Estevez Morgan, Lewis & Bockius LLP 6