I have told my employee clients numerous times, Your computer is like your diary, except a lot less selective. And, like your diary, your
computer can get you into all kinds of trouble if the wrong person goes through it! So, watch what you use it for. Anything you can do on
your computer, you can do on your computer at work. The seeds for various forms of discipline (up to and including termination, of course),
as well as legal action, are planted firmly in your computer's memory.
Examples of activities that the employeeís computer can reveal to the employer include:
Predictably, the advent of these sophisticated communication systems has brought along complicated legal issues. The legal issue about which
employers and employees express a great deal of concern, particularly in the context of investigations, relates to the privacy of internet usage,
e-mail messages, voice mail messages, and telephone conversations that transpire in the business setting - regardless of whether the content of
these messages is business-related. Specifically, they each are wondering who can read, listen to, monitor, and keep copies of their internet
usage and communications.
The baseline issues to resolve are, first, which communications are governed by federal and state wiretap laws; and then, in which communications
may an employee reasonably expect privacy. In answering these questions, the employer must turn to the statutes, court decisions, and company
practices and policies that address and govern these expectations.
1. Electronic Mail, Voice Mail, and Telephone Conversations
a. What Communications Are Protected from Interception?
Under the Electronic Communications Privacy Act of 1986 ("ECPA"), codified at 18 U.S.C.A. 2701, et seq., which amends the Wiretap Act, codified
at 18 U.S.C.A. 2510, et seq., it is unlawful for an individual to intentionally intercept any wire, oral, or electronic communication. 18 U.S.C.A.
2511(1)(a).2 The Wiretap Act and ECPA have since been amended by the Uniting and Strengthening America by Providing Appropriate Tools Required
to Intercept and Obstruct Terrorism Act (USA PATRIOT Act), Pub.L. No. 107- 56, 115 Stat. 272 (HR 3162) (October 26, 2001).
Under the ECPA, "intercept" is defined to mean "the aural or other acquisition of the contents of any wire, electronic or oral communication through
the use of any electronic, mechanical or other device." 18 U.S.C.A. 2510(4).
Under the ECPA, wire communications include telephone conversations and voice mail messages.3 Oral communications include conversations.4 The
legislative history indicates that electronic communications include e-mail messages.5 See 18 U.S.C.A. 2510(12).
There are penalties for disclosing the unlawfully intercepted communication. 18 U.S.C.A. 2511(c) and 2511(d).
2. Three Important Exceptions to the ECPA
Three exceptions to the ECPA's interception prohibition will, against the proper factual background, permit the employer to intercept its employees'
e-mail, voice mail, and telephone conversations.
a. The Consent Exception
Under the consent exception, it is not illegal for a person to intercept an oral or wire communication, as long as the person making the recording
is a party to the communication, or one of the parties to the communication has given prior consent to such interception, unless the communication
is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.
18 U.S.C.A. 2511(2)(d).6
Implied or Express Consent?
Consent to the interception may be implied or actual. Griggs-Ryan v. Smith, 904 F.2d 112 (1st Cir. 1990); Deal v. Spears, 980 F.2d 1153 (8th Cir. 1992);
George v. Carusone, 849 F. Supp. 159 (D. Conn. 1990).
Obtaining actual consent is as easy as having an employee sign a document - at the beginning of his employment that states that he understands that his
telephone conversations, voice mail, internet usage, and electronic mail will be monitored and that he expressly consents to having them monitored. This
will better ensure the legal sufficiency of the employer's position that the employee authorized the interception and will assist the employer in legally
obtaining better evidence of the employeeís conduct. Further, the information gathered pursuant to this grant of permission may constitute after-acquired
evidence that could limit considerably the amount of damages a terminated employee can collect in connection with a claim of unlawful termination.
Demonstrating implied consent will require a fact specific showing that is inferred i.e. from surrounding circumstances indicating that the (party)
knowingly agreed to the surveillance.' Griggs-Ryan, 904 F.2d at 117 (citations omitted). It can be difficult to prove. Further, implied consent has been
held to be limited to the extent to which the employee knew or should have known of a policy of constantly monitored calls, or to the use of a telephone
line that was reserved for business purposes. Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983) (where employer who had policy of monitoring
calls as part of its training program, gave notice to its employees that it may monitor telephone calls, and reviewed monitored calls with employees in
order to improve their performance, employee deemed to have given consent to that practice; but the employee's mere knowledge that the company had the
capability of monitoring was not, without more, enough to demonstrate implied consent). In Deal v. Spears, 980 F.2d 1153 (8th Cir. 1992), the court
determined that the employee would not have made certain statements if she had known that she was being monitored. Thus, the court rejected the employer's
argument that the employee, because of the employer's warning that it might be forced to monitor her calls to reduce the number of personal calls she made,
had impliedly consented to the monitoring of her personal calls.
There is, however, authority for the proposition that an employee consented to monitoring by her knowledge that her telephone calls could be monitored.
Griffith v. Milwaukee, 11 IER Cas. (BNA) 562 (7th Cir. 1996).
As with other violations of the employee's privacy rights, the costs of retrieving, inspecting, or disclosing an employee's communications without the
employee's permission can be high. In Deal v. Spears, 980 F.2d 1153 (8th Cir. 1992), the employer who automatically tape recorded and listened to all
telephone calls made or received by its employees, without notifying the employees or callers that the calls were being recorded, and who played back
portions of the tape to the employee, which constituted illegal disclosure, had to pay damages in the amount of $40,000.00, plus attorneys' fees.
CAVEAT: The Maryland Wiretap and Electronics Surveillance Act specifically makes it unlawful for a person to tape record or willfully intercept or endeavor
to intercept a wire, oral, or electronic communication unless the person is a party to the communication and all of the parties to the communication have
given prior consent. THINK LINDA TRIPP remember why she got into trouble!! Thus, the employer must be careful not to intercept messages to the employee
from an individual outside of the company, who arguably has not consented to the interception. Under the proper factual circumstances, i.e., where the
employees have manifested consent, the employer may intercept messages exchanged between its employees, and it may intercept messages originated by its
employees. But without demonstrating the consent of all parties, it may not intercept messages that are not generated by its employees.
b. The Service Provider Exception
Second, there is the service provider exception. The service provider exception, codified at 18 U.S.C.A. 2511(2)(a)(1), provides It shall not be unlawful
under this chapter for an operator of a switchboard or an officer, employee, or agent of a provider of wire or electronic communication service, whose
facilities are used in the transmission of a wire or electronic communication, to intercept, disclose, or use that communication in the normal course of
his employment while engaged in any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property
of the provider of that service.
Referring to the above definition, it appears that the employer may be able to intercept, disclose or use telephone calls, voice mail, and e-mail of an
employee if the communications service is provided by the employer. Conversely, if the system is provided and operated by an outside company (such as the
telephone company for voice mail services, or America Online for e-mail services), then the exception would not apply. The law appears to distinguish
between the communications company that provides services and the employer who provides internal services.
Further, to invoke the exception, the employer has to demonstrate that the interception, disclosure or use of the communication was a 'necessary incident
to the rendition of his service or protected the rights or property of the provider.' Arguably, the latter could be demonstrated where the monitoring is
done as part of internal auditing to prevent fraud and loss. See United States v. Mullins, 992 F.2d 1472 (9th Cir. 1992).
The employer is warned, however, that this exception would not permit the employer to look at incoming e-mail from a source outside the company. For example,
if a friend of an employee sends the employee an e-mail message, the employer should not rely on the service provider exception to read the contents of the
friend's e-mail message to the employee.
c. The Business Extension - Ordinary Course of Business
Exception
The third exception is the business extension - ordinary course of business exception. Generally, the ECPA prohibits the interception of a communication
through the use of any electronic, mechanical, or other device. Under 18 U.S.C.A. 2510(5)(a), 'electronic, mechanical or other device' means any device that
can be used to intercept a wire, oral, or electronic communication other than any telephone or telegraph instrument, equipment or facility, or any component
thereof, (i) furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of its business and being
used by the subscriber or user in the ordinary course of its business...'
Thus, to avoid the ECPAís prohibition against interception, the employer first must use a device that falls within the scope of the exception. Conceptually
speaking, this means that the device must either be a feature or part of the communication equipment furnished and used in the ordinary course of business.
This feature may be a sophisticated built-in feature of the equipment. It may be as simple as picking up a different telephone receiver within the office,
pushing a button, and listening to another employeeís conversation.
CAVEAT: business-related versus personal communications
The requirement that the interception be in the ordinary course of business translates into a prohibition against the employer's interception of personal
communications. If a message contains personal communications between employees, or personal communications between an employee and a non-employee, and no
other exception applies, the employer may not intercept the communication.
As a practical matter, the employer needs guidelines for how to determine whether the communication is business or personal. The employer should consider
the parties to the discussion, the topic discussed, and whether the communication took place during the employee's business hours. In Epps v. St. Mary's Hosp.
of Athens, Inc., 802 F.2d 412, 417 (11th Cir. 1986), the court concluded that a call was business-related because it 'occurred during office hours, between
co-employees, over a specialized extension which connected the principal office to a substation, and concerned scurrilous remarks about supervisory employees.
The court deemed the call as occurring in the ordinary course of business because the employer has an inherent interest in all incoming business calls and a
legal interest in preventing the contamination of the workplace with misconduct.
If the employer has provided notice to its employees that calls are limited to legitimate business purposes, that can constitute sufficient to allow the employer
to monitor the telephone calls. James v. Newspaper Agency Corp., 591 F.2d 579 (10th Cir. 1979).
Cases that provide examples of communications that may or may not fall within the ambit of this exception include:
* Schmerling v. Injured Workersí Ins. Fund, 139 Md. App. 470, 776 A.2d 80 (2001) A employer installed Racal recorders to monitor employee telephone calls on
designated phone lines for purposes of quality control; court held that Racal recorders were integrated components of the employerís larger telecommunications
system, even though they were purchased years after the original system was purchased a from a different manufacturer.
* Sanders v. Robert Bosch Corp., 38 F.3d 736 (4th Cir. 1994) -- employer violated ECPA by recording employeesí telephone conversations 24 hours a day, 7 days a
week, through a voice logger, where voice logger was not a device exempted by the statute, and employer did not conduct interceptions in ordinary course of business.
* Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983) - employer, who specifically told employees that personal calls were permitted and would not be
monitored except to extent necessary to determine whether a particular call was personal or business-related, was not entitled to summary judgment on employeeís
claim of wrongful interception of a personal call.
* Briggs v. American Air Filter Co., Inc., 630 F.2d 414 (5th Cir. 1980) - employer did not violate ECPA by surreptitiously monitoring and recording employeeís
telephone conversation, because employer had particularized suspicion that employee was disclosing confidential business information to competitor, and employer
intercepted only that part of the communication that was business-related.
* Pascale v. Carolina Freight Carriers Corp., 10 IER 1804 (D.N.J. 1985) based upon suspicion that employee was using phone lines to arrange for theft of merchandise,
employer hired private investigator to wire three phone lines to be monitored by voice activated tape recorders purchased from Radio Shack. Holding that the voice
activated recorders were the intercepting equipment, and that the equipment was not a 'telephone or telegraph instrument, equipment or facility, or any component
thereof', the business extension exception did not apply.
* Williams v. Poulos, 11 F.3d 271 (1st Cir. 1993) - employer's interception by using alligator clip and microphone wire did not use device contemplated by statute
and therefore violated the ECPA.
* James v. Newspaper Agency Corp., 591 F.2d 579 (10th Cir. 1979) - where employees had notice that their calls were limited to legitimate business purposes, and
monitoring system was installed by telephone company as part of the general telephone service, employerís interception of employeeís sales calls for training
purposes was protected by business extension exception.
If and when the employer determines that the call is personal, the employer should immediately cease the interception.
3. A Special Word About E-Mail
E-mail messages often provide critical evidence that can play an important role in a workplace investigation. The employer conducting a thorough investigation will
want to obtain e-mail messages. Keeping in mind the wiretap statutes and the common law right to privacy, to what extent, and under what conditions, is this
permissible?
a. E-Mail and the "Stored Electronic Communication" Exception
The ECPA prohibits unauthorized access to stored wire and electronic communications, but it excepts the person or entity providing a wire or electronic communications
service from this prohibition. 18 U.S.C.A. 2701(c)(1). Because of the way in which storage is defined, an e-mail message is most likely 'stored' both when it is
temporarily stored on a computer prior to being read and when it is stored on the computer after receipt.7 E-mail messages are, by definition, 'stored in a routing
computer.' Bohach v. City of Reno, 932 F. Supp. 1232, 1234, 1236-37 (D. Nev. 1996) (stating, "An 'electronic communication,' by definition, cannot be 'intercepted'
when it is in 'electronic storage,' because only 'communications' can be 'intercepted,' and, as the Fifth Circuit held in Steve Jackson Games, the 'electronic storage'
of an 'electronic communication' is by definition not part of the communication.");. Thus, the employer who provides an e-mail system seemingly has unrestricted
access to stored messages on that system. The same theory applies to stored voice-mail messages.
Prior to October 2001, in analyzing which exception applies and therefore what action is permissible, the employer had to distinguish between interception during
the transmission phase and retrieval of a message while in storage. Steve Jackson Games, Inc. v. United States Secret Service, 36 F.3d 457 (5th Cir. 1994)
exemplified this distinction. In that case, the court held that no 'interception' occurred when the Secret Service read and deleted 162 unread e-mail messages
stored on a computer of a commercial e-mail service, because the messages had not been acquired while in transit; rather, they had been acquired while in storage.
The court reasoned that a 'stored' electronic communication could not be 'intercepted.' The word "intercept" could not describe the exact same conduct with respect
to wire and electronic communications, because wire and electronic communications were defined differently in the statute. Specifically, the term "wire communication"
was defined to include storage of the communication, while "electronic communication" was not. The court concluded that this textual difference evidenced Congress'
understanding that, although one could "intercept" a wire communication in storage, one could not "intercept" an electronic communication in storage.
The passage of the USA PATRIOT Act in October 2001 eliminated this distinction by making the definition of a wire communication consistent with the definition of
an electronic communication; basically, Section 209 of the USA PATRIOT Act amended 25 U.S.C.A. 2510(1) by eliminating the phrase, 'and such term includes any
electronic storage of such communication' from the definition of wire communication.
The extension of this rationale would suggest that a voice mail or e-mail message may be intercepted only at the moment it is transmitted from the sender to the
communications service. After the instant of transmission, the message would be considered to be stored, and the employer thus would have more latitude to retrieve
the stored communication.
Other cases that have required that, to violate the law, the interception must occur contemporaneously with the transmission. Focusing on the fact that Congress
defined "electronic communication" to be the "transfer of signs, signals, writing," etc., the court in Eagle Investment Systems Corp. v. Tamm, 146 F.Supp.2d 105,
112 (D.Mass. 2001) stated, 'If Congress intended electronic communication to include both transfer and storage, it easily could have included the word "storage" in
the definition.' See also United States v. Moriarty, 962 F.Supp. 217 (D.Mass.1997); Fraser v. Nationwide Mut. Ins. Co., 135 F.Supp.2d 623, 634-35 (E.D.Pa.2001)
(explaining that '[a]cquisition must occur "before arrival". Thus, interception of a communication occurs when transmission is interrupted, or in other words
when the message is acquired after it has been sent by the sender, but before it is received by the recipient. The point in time when the message is acquired is
the determining factor for whether or not interception has occurred. The Wiretap Act provides protection for private communication only during the course of
transmission.'); Wesley College v. Pitts, 974 F.Supp. 375, 384 (D.Del.1997) (looking at e-mail messages on computer screen is not interception as contemplated
by the ECPA); United States v. Meriwether, 917 F.2d 955, 960 (6th Cir.1990); Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002), cert. denied,123 S.Ct.
1292 (2003) (holding that electronic communications that are in storage cannot even be intercepted, and thus cannot be unlawfully 'intercepted': '[U]nlike the
definition of "wire communication," the definition of "electronic communication" does not include electronic storage of such communications.... Congress' use of
the word "transfer" in the definition of "electronic communication," and its omission in that definition of the phrase "any electronic storage of such
communication" ... reflects that Congress did not intend for "intercept" to apply to "electronic communications" when those communications are in "electronic
storage.").
Regarding voice mail, in U.S. v. Smith, 155 F.3d 1051 (9th Cir. 1998), cert. denied, 525 U.S. 1071 (1999), the court held that wire communications in storage can
be 'intercepted.'
If properly obtained, intercepted and retrieved communications are admissible in court proceedings. 18 U.S.C.A. 2517(3) states:
Any person who has received, by any means authorized by this chapter, any information concerning a wire, oral, or electronic communication, or evidence derived
therefrom intercepted in accordance with the provisions of this chapter may disclose the contents of that communication or such derivative evidence while giving
testimony under oath or affirmation in any proceeding held under the authority of the United States or of any State or political subdivision thereof.
b. E-Mail and the Common Law Right to Privacy
Employees have attempted to assert a right to privacy in their e-mail communications under the common law, and, at least in the reported decisions, have not been
successful in their attempts.
* In TBG Ins. Servs. Corp. v. Zieminski, 117 Cal.Rptr.2d 155, 18 IER Cases 545 (2002), the employer provided two computers for the employee to use: one for the
office and the other for home. The employee had signed the employer's 'electronic and telephone equipment policy statement' and agreed in writing that his
computers could be monitored by his employer. He was terminated for misuse of his office computer and sued for wrongful termination. In the course of discovery,
the employer demanded production of the home computer, which the employee refused to produce. The trial court denied the motion to compel. The appellate court
reversed, holding that the employee had given consent to the employer's monitoring of both computers and thus had no reasonable expectation of privacy when he
used the home computer for personal matters. However, the court did allow the employee to identify with particularity the personal information (such as financial
information that had no bearing on the case) that he claimed ought to be excluded from the inspection and copying process.
* In Garrity v. John Hancock Mut. Life Ins. Co., 2002 WL 974676 (D. Mass. May 7, 2002), the court found that the employees had no reasonable expectation of
privacy in their e-mail messages, where employees admitted that they assumed that the recipients of their messages might forward them to others, and that some
of the e-mails 'would eventually be sent to third parties.' Even though the company policy stated that management reserved the right to access all e-mail files,
that business or legal situations may necessitate company review of e-mail message and other documents, and that all information stored, transmitted, received or
contained in the companyís e-mail systems is company property, the company policy also stated that it was not company policy to intentionally inspect e-mail usage.
The employees asserted that the company led them to believe that their personal e-mails could be kept private with the use or personal passwords and e-mail folders.
Further, even if the employees had a reasonable expectation of privacy in their work e-mail, the employerís legitimate business interest in protecting its employees
from harassment in the workplace would 'likely trump' the employee's privacy interests.
* In McLaren v. Microsoft Corp., 1999 WL 339015 (Tx. Ct. App. 5th Dist., May 28, 1999), even though the employee created a personal password and stored his e-mail
messages in 'personal folders', the employee had no reasonable expectation of privacy in e-mail messages transmitted over the company network that 'were at some
point accessible by a third party. And, even if the employee had established some reasonable expectation of privacy, the companyís interest in preventing
inappropriate and unprofessional comments, or even illegal activity, over its e-mail system would outweigh the employeeís claim privacy interest in those
communications.
* In Smyth v. The Pillsbury Co., 914 F. Supp. 97 (E.D. Pa. 1996), the court held that employees had no reasonable expectation of privacy in e-mail communications
made over a company e-mail system, even though the employer had repeatedly assured its employees that their e-mail was confidential and would not be intercepted or
used as grounds for discipline. Pillsbury terminated an at-will manager after he sent e-mail messages threatening to kill his supervisors, referring to them as
'back-stabbing bastards,' and referring to the company's holiday party as the 'Jim Jones Kool-Aid affair.' The employee was not required to disclose any personal
information about himself (for example, through urinalysis or a personal property search), and the company did not invade the employee's person or his personal
effects. Although the court found no reasonable expectation of privacy in e-mail communications made over a company e-mail system, it stated that even if such
an expectation existed, intercepting the employeeís e-mail messages was not 'a substantial and highly offensive invasion of his privacy', and 'the company's interest
in preventing inappropriate and unprofessional comments or even illegal activity over its e-mail system outweighs any privacy interest the employee may have.'
* In Shoars v. Epson America, Inc., No. BO73234 (Ca. Ct. App., Apr. 14, 1994), review denied, No. SO40065, 1994 Cal. LEXIS 3670 (1994), an employee sued upon
learning that her employer had made printouts of all e-mail messages sent to or from a certain facility of the employer in 1989. The court, in an unpublished
opinion, held that the California state constitution protects personal, but not business-related, communications.
* In Bourke v. Nissan Motor Corp., No. BO68705 (Cal. Ct. App. July 26, 1993), the court acknowledged that the need for employees to utilize passwords to access
e-mail accounts did not increase an employeeís expectation of privacy to the point where the employer could not intercept e-mail messages. In that case, the
employees had signed a waiver restricting the use of e-mail for business purposes, and they had knowledge that others could access and read their e-mail messages.
C. POLICY CONSIDERATIONS
In formulating its telephone call, voice mail, internet usage, and e-mail monitoring policy, the employer must focus on several issues:
Any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection
between the point of origin and the point of reception (including the use of such connection in a switching station) furnished or operated by any person engaged in
providing or operating such facilities for the transmission of interstate or foreign communications or communications affecting interstate or foreign commerce.
18 U.S.C.A. 2510(1). Until the Act was amended in October 2001 by the USA PATRIOT Act, the phrase, 'and such term includes any electronic storage of such
communication.' immediately followed the words, 'foreign commerce.'
Any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such
expectations, but such term does not include any electronic communication. 18 U.S.C.A. 2510(2)
5 See S. Rep. No. 541, 99th Cong., 2d Sess. 14 (1986): 'Communications consisting solely of data, for example, and all communications transmitted only by radio
are electronic communications. This term also includes electronic mail, digitized transmissions, and video teleconferences.'
6 One permissible type of interception of a wire or oral communication under the D.C. statute is where the intercepting party is a party to the communication, or
where one of the parties to the communication has given prior consent to such interception, unless such communication is intercepted for the purpose of committing a
criminal or tortious act in violation of the Constitution or laws of the United States, any State, or the District of Columbia, or for the purpose of committing any
other injurious act.
D.C. Code Ann. 23-556 (2001) specifically states that that provision shall be construed to supplement, and not to supersede or otherwise limit, the provisions of the
parallel federal statute. 18 U.S.C.A. 2511 in general, and 2511(2)(d) in particular, reveal that the parallel federal statute which is actually broader in that
it permits the interception of electronic communications, as well as wire and oral communications permits the same type of activity under the same circumstances as
does the D.C. statute.
7 An employer should remember that even if an employee has deleted an e-mail message from his computer, there is likely a backup copy on the networkís file server
and backup system.
