Privacy is the ability of an individual or group to keep their lives and

Privacy Versus Security in the Workplace ALAN L. PEPPER AND BETHANIE F. THAU An important challenge facing employers today is balancing the security of the workplace versus the privacy rights of employees. This article explores that balancing act and attempts to provide guidelines for meeting this challenge, specifically with respect to laws governing the monitoring of employee activities. 1 Privacy is the ability of an individual or group to keep their lives and personal affairs out of public view, or to control the flow of information about themselves. While privacy per se is not specifically addressed as a protected right in the U. S. Constitution it is included in some state constitutions. 2 For example, the California Constitution gives each citizen an inalienable right to pursue and obtain privacy. 3 In fact, California created the Office of Privacy Protection whose mission is protecting and promoting the privacy rights of California consumers. 4 Security is the condition of being protected against danger or loss. In recent years an inherent conflict between security and privacy has evolved, accelerated by digital and communications technology. Never Alan L. Pepper is a partner and a member of the business transactions and intellectual property/technology practice groups at Mitchell Silberberg & Knupp LLP. Mr. Pepper specializes in representing companies in the electronic and physical security industry, and representing governments in the procurement of large computer/software systems. Bethanie F. Thau, a member of the firm s labor and employment practice group, represents management in a variety of labor and employment matters, including administrative, single-plaintiff, and class action proceedings. The authors can be reached at alp@msk.com and bft@msk.com, respectively. 92

before have we enjoyed or suffered the ability to so readily gather and use information about individuals or observe their conduct. The increased ability to eavesdrop in video and audio and to track employee movement through satellites and radio frequencies has resulted new legal issues that impact how employers relate to their employees. An employer s efforts to maintain the security of its workplace must be done in a manner that does not violate the privacy rights of its employees. The legal limitations on an employer s right to take action affecting its workers privacy rights come from three different bodies of law: (1) statutory restrictions; (2) constitutional right to privacy (in some states and for public employees); and (3) the common law right to be free from invasion of privacy. Statutory restrictions governing workplace security and employee privacy are found at both the federal and state level. This article primarily addresses federal law and uses various state laws as examples of restrictions at the state level. Generally speaking, an employee can bring a claim against his or her employer for invasion of privacy (based on constitutional or common law privacy rights) only if the employee has a reasonable expectation of privacy. An employee s reasonable expectation of privacy in a workplace communication, location, or other information/circumstances will depend on the particular facts of the case. STATUTORY LIMITATIONS Electronic Communications An employer may wish to monitor its employees electronic communications (such as telephone and e-mail communications) in order to, among other reasons, evaluate customer service, or to ensure the security of trade secrets or other confidential information. Such monitoring generally is permitted with the consent (implied or actual) of the relevant parties. Federal Limitations PRIVACY VERSUS SECURITY IN THE WORKPLACE The Electronic Communications Privacy Act of 1986 ( ECPA ) was adopted initially to govern third-party interceptions of electronic commu- 93

PRIVACY & DATA SECURITY LAW JOURNAL nications, not to govern employers rights to monitor their workers. The ECPA provides civil and criminal penalties for any person who intentionally intercepts, uses, or discloses any wire, oral, or electronic communication. 5 This can include telephone conversations, e-mails, and instant messages. The two prime exceptions to the ECPA afford employers rights to monitor their employees: An employer may monitor employee conversations if the monitoring occurs in the ordinary course of business or with the employees consent. Failure to comply with ECPA can result in significant fines ($10,000 per incident), compensatory damages, attorney s fees, and punitive damages. Business Use Exemption An employer has the right to monitor the business-related e-mails and telephone traffic of employees. The ECPA contains a business exclusion exemption which exempts interceptions which are made by equipment furnished to the subscriber or user by [a communications carrier] in the ordinary course of its business [and being used by the subscriber or user] in the ordinary course of its business. Under this exemption, an employer may monitor phone calls in an employer-supplied telephone system by attaching a device supplied by the employer. In determining whether a specific use meets the exemption, courts generally look to whether a reasonable business justification exists for the monitoring, whether the employee was informed about the employer s right to monitor, and whether the employer acted consistently in connection therewith. Employers should take care to ensure that any such monitoring is limited to the business use, as some courts have held that monitoring employees personal telephone calls exceeds the business use exemption and can be actionable. Consent Exemption Consent to monitoring of electronic communications can be direct or implied. Courts have differed with respect to the circumstances in which consent to monitor telephone calls or e-mail communications may be implied. In some circumstances, consent may be implied based on employer s legal duty to monitor certain activities, such as those in the 94

security industry. Additionally, some courts have been willing to find implied consent based merely on employee use of employer equipment to engage in the communications. Other courts seem to require some type of prior notice regarding the employer s policy or practice of monitoring employee communications. State Limitations California Example and Comparison Most states have adopted some legal restrictions regarding electronic monitoring or wiretapping. California law prohibits, with exceptions, electronic eavesdropping on or recording of private communications by telephone, radio telephone, cellular radio telephone, cable, or any other device or in any other manner. 6 Violation can result in penalties of up to $10,000 and imprisonment in county jail or state prison for up to one year. Unlike the federal limitation on monitoring electronic communications, California does not provide for a business use exemption. California does, however, permit monitoring based on consent. Notably, some jurisdictions require consent only of one participant, but many states, such as California, require consent of all parties to the communication. Recently, the California Supreme Court determined that this restriction on electronic eavesdropping applied to a Georgia company that recorded telephone conversations between its Georgia employees and California customers. 7 Federal law requires only the consent of one party to the communication. Video and Audio Surveillance An employer may have many reasons to use audio and/or video surveillance systems to monitor its employees. For example, an employer may be concerned about employee safety, or controlling company assets (including equipment and/or time theft). There are generally fewer statutory restrictions on video (non-audio) surveillance than audio surveillance. Federal Limitations PRIVACY VERSUS SECURITY IN THE WORKPLACE There currently are no specific federal laws governing video-only 95

PRIVACY & DATA SECURITY LAW JOURNAL monitoring; however, there have been cases brought by employees under the general right of privacy. 8 One of the key conditions to prosecuting an action for invasion of privacy is whether or not the person has a reasonable expectation of privacy. Courts across the country are finding with more and more frequency that no reasonable expectation of privacy exists with patent video surveillance or with hidden surveillance if the physical space surveyed is a public and open space. However, when the video surveillance is hidden, or records areas generally considered private, such as rest rooms or dressing rooms, the courts have been divided on whether an invasion of privacy has occurred. In January 1998, the Sheraton Boston Hotel and Tower agreed to pay over $200,000 to settle a lawsuit brought by the Hotel Employees and Restaurant Employees Union, Local 26. The local alleged that the hotel violated Massachusetts privacy law when it videotaped workers (without their knowledge) in its employee locker room, seven years earlier. State Limitations Connecticut Example and Comparison Several states have adopted limitations on employee video and/or audio monitoring, particularly in private areas, such as locker rooms.9 Other states, such as Connecticut, have adopted statutes requiring notice of electronic monitoring of employees. 10 The Connecticut statute broadly applies to any electronic monitoring including that by telephone, wire, radio, computer, and camera. 11 The drafters of the Connecticut statute appear to have attempted to balance employers interests in workplace security with employees privacy rights, as this statute does not require notice of electronic monitoring in workplace areas held out for use to the public and provides for an exception to the notice requirement where the employer has reasonable grounds for believing that an employee is engaged in illegal conduct. Tracking Devices New technology, and new uses for existing technology, has provided employers with additional ways to monitor their employees. This includes use of global positioning systems ( GPS ) and radio frequency identification ( RFID ). Most commonly, employers use these devices to 96

track employee location or, in the case of some RFIDs, to grant access to restricted workplace areas. Federal Limitations PRIVACY VERSUS SECURITY IN THE WORKPLACE Currently, there is no overarching federal statutory restriction regarding the use of RFID or GPS devices to monitor employees in the workplace. Accordingly, (and in the absence of applicable state law restrictions) use of such devices would be limited only to the extent that they invade an employee s reasonable expectation of privacy. Case law directly on this issue has not yet developed. The U.S. Supreme Court has recognized that, in a Fourth Amendment context, a person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another, suggesting that an employee similarly may have no reasonable expectation of privacy in his or her location on public roads. 12 State Limitations Recently, in a highly publicized news story, an Ohio surveillance company reported that it had implanted RFIDs under the skin of at least two employees (a practice called tagging or chipping ). 13 The company did so as a security measure in order to control access to highly sensitive surveillance footage. According to the company, employees needing access to that storage facility were given the option of having a subcutaneous RFID implanted or carrying the RFID on a badge. Recently, California has adopted law regarding use of subcutaneous RFIDs in the workplace. 14 This law provides that a person shall not require, coerce, or compel another individual to undergo the subcutaneous implanting of an identification device, which includes radio frequency technology that is actively or passively capable of transmitting personal information such as name, address, telephone number, e-mail address, date of birth, driver s license number, and other personal or unique information. This law also specifically prohibits conditioning employment upon an agreement to a subcutaneous implant. Additionally, laws restricting the use of electronic monitoring generally, like the Connecticut statute discussed above, may be broad 97

PRIVACY & DATA SECURITY LAW JOURNAL enough to cover employer use of these tracking devices to monitor employee locations. REASONABLE EXPECTATION OF PRIVACY Even in the absence of any statute or law prohibiting the specific type of employer monitoring or surveillance system at issue, an employee still may bring a claim for invasion of privacy. An employee proving an unlawful invasion of privacy may recover tort damages, including compensatory and punitive damages. In order to succeed in a claim for invasion of privacy, the employee must prove that he or she had a reasonable expectation of privacy in the workplace communication or circumstances at issue. In evaluating such claims, courts typically take into account whether the employer has a known policy or practice regarding the monitoring, whether the employee was otherwise notified of employer monitoring, and whether the employee consented to the monitoring. Courts also will evaluate whether the monitoring was limited to the use delineated in the policy and/or that consented to. Other factors can include where the monitoring takes place (i.e., did the monitoring take place in a private workplace, a shared workspace, or an area open to the public?), whether the surveillance was in connection with a business purpose, and whether the surveillance was tied to the employee s use of company equipment (such as employee use of employer s telephone or e-mail system). Employer policies, and compliance with those policies, can be a key factor in a court s determination of whether or not an employee had a reasonable expectation of privacy. A recent Ohio case, Dukes v. ADS Alliance Data Systems, Inc., is illustrative. 15 In Dukes, the plaintiff employee spent approximately 60 percent of her time engaged in telephone calls on behalf of the company. As an employee, she received a copy of the company handbook that provided that the company periodically monitor[s] and tape[s] phone calls for customer service purposes. The handbook also promised to provide employees with access to alternative telephones for private conversations. On two separate occasions, company telephone monitors listened to the 98

employee s private telephone calls with her husband. On the first occasion, a monitor continued to listen to the employee s telephone conversation with her husband for 30 minutes after recognizing that the call was of a purely personal nature. On the second instance, a telephone monitor passed the employee s desk and noticed that she was on a private call. The monitor then returned to her desk and broke in to the call to chastise the employee. The employee filed suit for, among other things, invasion of privacy and violation of the ECPA and its state law equivalent. The employer claimed that the employee consented to the monitoring by virtue of her signed acknowledgment to receipt of the company handbook. The court found that because the handbook policy provided only for periodic monitoring of calls with customers, the signed acknowledgment did not constitute consent to listen to personal calls. Accordingly, the court ruled that the employer did not fall within the consent exemption to the ECPA and state law wiretapping claims and also that the employee s tort law claim for invasion of privacy was viable. CONCLUSION Protecting the security of the workplace is important and recognizing an employer s obligations to protect the privacy of its employees is equally important. Security and privacy policies should be clearly spelled out in an employee manual or similar document. It is incumbent upon employers to stay current on federal and state privacy laws as they react to changes in society and technology. NOTES PRIVACY VERSUS SECURITY IN THE WORKPLACE 1 There are many other areas of the employer/employee relationship that raise issues of employee privacy. Those privacy issues and laws are beyond the scope of this article. 2 Courts have recognized that the Constitution provides privacy rights to public employees under the First, Third, Fourth, Fifth, Ninth and Fourteenth Amendments. 3 California Constitution, Art. 1, 1. 99

PRIVACY & DATA SECURITY LAW JOURNAL 4 California is the first state to have an agency dedicated to promoting and protecting the privacy rights of consumers. Now located in the California Office of Information Security and Privacy Protection, the Office of Privacy Protection was created by legislation in 2000 and opened in 2001. Its mission is to identify consumer problems in the privacy area and encourage the development of fair information practices. http://www.oispp.ca.gov/ consumer_privacy/. 5 18 U.S.C. 2510 et seq. 6 California Penal Code 630-638. 7 Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95, 128 (2006). 8 In February 2008, a bill proposing the Employee Changing Room Privacy Act was introduced in the House of Representatives. See H.R. 582 [109th]: Employee Changing Room Privacy Act. This law would prohibit all video and audio monitoring in areas where it would be reasonable to expect employees to change clothing. Several similar bills have been proposed in the past, but so far none have been adopted as law. 9 See, e.g., California Labor Code 435 (prohibiting audio and video recording of employees in the rest room, locker room or changing room) and Michigan Comp. Laws 750.539 (prohibiting any device for observing, photographing or eavesdropping in any private place). 10 See Connecticut General Statutes 31-48d. 11 The Connecticut statute provides that electronic monitoring means the collection of information on an employer s premises concerning employees activities or communications by any means other than direct observation, including the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic or photo-optical system. 12 United States v. Knotts, 460 U.S. 276, 281 (1983). 13 See http://www.cnn.com/2007/tech/science/08/01/chips.humans.ap/ index.html. Last visited on February 13, 2008. 14 California Civil Code 52.7. 15 Dukes v. ADS Alliance Data Systems, Inc., 2006 U.S. Dist. LEXIS 84311 (S.D. Ohio 2006). 100