Most employers have a legitimate need to monitor their employees' usage of email and their computer, particularly the internet, while the employee is at work. Employers must protect their assets, monitor employee productivity, and ensure that employees do not engage in conduct - - such as harassing, offensive or violent conduct - - which may expose the employer to liability. But monitoring an employee's use of the email system and the internet must be done carefully to avoid infringing an employee's privacy rights. Although privacy case law has tended to arise from he common law of the states, two federal statutes also affect an employer's ability to monitor its employees email and computer usage.
The National Labor Relations Act ("NLRA") prohibits an employer from restraining or interfering with employees' right to engage in union activity or other protected concerted activity conducted for mutual aid or protection, even if the facility or company is a non-union work-site. Monitoring employees' on-line usage may chill them from organizing or engaging in union activity, and will violate the NLRA if only some, but not other, non-business uses of the computer are permitted or monitored. If the employer is already a unionized facility, it should bargain with the union over the installation and use of monitoring devices. But regardless of whether the employer is a unionized facility or not, it must have an objectionably reasonable basis and standard for monitoring email and computer usage.
The Electronic Communications Privacy Act of 1968 ("ECPA"), commonly known as the Federal Wiretapping Act, governs the interception or acquisition of the contents of electronic communications, such as telephone calls or emails. But despite the general prohibitions of the ECPA, employers may generally monitor email and internet usage if the employee has consented to the monitoring. Consent is usually obtained by having the employee execute an acknowledgment of a computer and internet usage policy which makes clear that searches may occur, and that the employee has no reasonable expectation of privacy in the data stored on the office computer, or in any other communication medium. The policy should also make it clear that computers are to be used only for business purposes, and it should strictly prohibit unauthorized use of email or the internet for any other purpose, including but not limited to, downloading pornographic, offensive, or harassing communications, copyrighted or trade secretinformation, or any other non-business related information. The policy should also prohibit any attempt to appropriate the employer's trade secrets or copyrighted information, or to disable or compromise the security of information contained in the company's computers. The employer should also make it clear that passwords are intended simply to prevent outsiders from obtaining access to information on the employer's system, but are not an indication that the employee has any privacy rights in the contents on the computer. Requiring employees to disclose their passwords to management will further make that clear.
To make sure the policy is taken seriously, it should also note that any violation can result in disciplinary action up to and including termination, and the employer must ensure that it is in fact enforcing the policy consistently. A sample computer and internet usage policy is attached as Exhibit A to this article.
New Jersey has an analogous statute to the ECPA. The New Jersey Wire Tapping and Electronic Control Act, prohibits third parties from gaining unauthorized access to, or disclosure of, emails. However, there are two exceptions to the statute that morph the employee protections contained in the statute with regard to the employment context. The first exception allows for unauthorized access if the inspection was done in the normal course of business for business purposes or if the inspection was done to protect the employer’s rights or property. The second exception applies to monitoring that is consented to by one of the parties to the communication.
In the State of New Jersey, the Supreme Court addressed the right to privacy surrounding email and internet use and discussed what notice the employer shouldprovide to the employee. Advance notice to employees that emails and internet use must be limited to business purposes goes in favor of employer intrusiveness. Advance notice to employees that the internet use and/or emails may be monitored and reviewed and lead to disciplinary action also negatively affects an employee’s right to contest the employer accessing such information. These notices were construed by the court as affecting theemployees’ legitimate expectations of privacy.
In Pennsylvania, an employee claimed that he was told that his emails were confidential and privileged. He further claimed that he did not know the employer was reviewing his emails. Nonetheless, the Court ruled that the employer could terminate the individual for transmitting inappropriate and unprofessional comments over the employer’s internal email system.