View our similar post: Social Media and Internet Use Policy – Does My Business Need One?
One method of reducing an employer’s liability is to monitor or at least have the right to monitor employee e-mail. There are limitations to the extent an employer may monitor e-mail. Statutes have carved out exceptions to allow a company to monitor employee activity where there is a legitimate business purpose.
Federal Electronic Communications Privacy Act (ECPA)
The Federal Electronic Communications Privacy Act of 1986 (“ECPA”) 18 U.S.C. §§ 2510-2521, 2701-2709, 2711 generally prohibits the interception of electronic communications, including e-mail. However, three major exceptions to the ECPA may allow the interception of employee e-mail. First, an employer can monitor employee e-mail where the employee has consented to monitoring. This consent can either be express, where the employee actually agrees to the monitoring, or implied, where the employee continues to use the employer’s e-mail system after being expressly informed that the employer intends to monitor e-mail. (See Privacy section in Commercial Transactions for discussion of ECPA and related federal privacy laws.)
The ECPA also allows the provider of electronic communication services to monitor communications when the monitoring is a necessary incident of the rendition of services or of the protection of the rights or property of the provider. This exception allows an employer to monitor e-mail transmitted via an employer-provided system. Note that this exception would not apply to situations in which the employer simply provides the employee access to a commercial e-mail service.
Finally, the ECPA provides that the interception of electronic communication is lawful if it is for a legitimate business purpose. Courts have taken two separate approaches to this exception. Under the first approach, an employer may monitor e-mail where the employee has been informed of the monitoring and it is necessary to protect the employer’s business interests. The second approach examines the content of the intercepted communication. Under this approach an employer may intercept business related e-mails but not personal e-mails. An e-mail message is considered business related e-mail if it is a message in which the employer has a legal interest or the interception is necessary to guard against the unauthorized use of the e-mail equipment.
Informing Employees of Internet Monitoring
A company will have a legal interest in an e-mail message when the message is either in pursuit of the employer’s business or is a detriment to the employer’s business. An employer that wishes to leave open the opportunity of monitoring employee e-mail messages would be well advised to inform its employees that it reserves the right to monitor e-mail messages. By informing employees, the employer will be in a stronger position to argue that its employees do not have a “reasonable expectation” of privacy in their e-mail messages and will thus avoid having to rely on the court’s own notion of what privacy expectation is reasonable. (See our post, Social Media and Internet Use Policy – Does My Business Need One?)
Courts dealing with these issues generally protect the company’s interest when it is legitimate. Most courts have found that the interests of the company outweigh an employee’s expectation of a right to privacy. It appears that an employer who wants to monitor employee e-mail can readily do so once that e-mail has been stored.