© 2010 Mudd Law Offices Privacy in the Workplace: Electronic Surveillance Under State and Federal Law Charles Lee Mudd Jr. – Mudd Law Offices

© 2010 Mudd Law Offices

Privacy in the Workplace: Electronic

Surveillance Under State and Federal Law

Charles Lee Mudd Jr. – Mudd Law Offices


OverviewTrends in Workplace Surveillance

Highlights of Applicable Law

More Common Surveillance Issues

Arbitration - Lessons Learned

Policy Guidelines

Novel Circumstances


Trends in Workplace Surveillance

1997

13.7% of employers monitored computer files

14.9% of employers monitored e-mail

Data obtained from the American Management Association


Trends in Workplace Surveillance (cont’d)

2007

43% of employers monitored computer files

43% of employers monitored e-mail

Data obtained from the American Management Association



ADDITIONAL STATISTICS

66% of employers monitor Internet connections

12% of employers monitor blogs for comments on company

10% monitor social networking sites

8% use GPS to track company vehicles

American Management Association DATA



The Privacy Foundation reports that

of those employees "who regularly use e-mail or Internet access at work,"

fourteen million "are under 'continuous' surveillance ... for their Internet access or e-mail usage."



For a myriad of reasons…

the monitoring of employee activity and conduct by employers through

electronic surveillance in the workplace

…will continue to increase.


Protecting Employers … and Employees

With increasing prevalence of workplace surveillance

Employers Must Be Advised Properly…

… in Advance of Implementation


Highlights of Applicable Law

United States Supreme Court

Federal Statutes

State Statutes

Common Law


O'Connor v. Ortega

480 U.S. 709, 107 S. Ct. 1492 (1987)

While investigating alleged impropriety, public employers broke into employee’s office, desk, and file cabinet

Court determined neither party entitled to summary judgment and affirmed in part and reversed in part

….HOWEVER….

United States Supreme Court


Supreme Court (cont’d)

Ortega helped establish:

Analytical Process in Workplace Privacy:

Expectation of privacy?

Reasonableness of search at inception?

Reasonableness of search in scope?



For legitimate work-related, non-investigatory intrusions as well as investigations of work-related misconduct, a standard of reasonableness is used.



City of Ontario v. Quon

177 L. Ed. 2d 216 (U.S. 2010)

The review of transcripts of employee text messages held to be reasonable given that legitimate non-investigatory reasons prompted the review.

(to determine whether the character limit on the city's contract was sufficient to meet the city's needs)



Principles arising from and reaffirmed in Quon:

1. special needs of workplace is an exception to Fourth Amendment warrant requirement

2. “the extent of an expectation [of privacy] is relevant to assessing whether the search was too intrusive”



Note:

Utah equivalent of Fourth Amendment

Utah Constitution, Art I., § 14


Federal Statutes

Primarily….

Electronic Communications Privacy Act

Stored Communications Act

Computer Fraud and Abuse Act


Electronic Communications and Privacy Act18 U.S.C. § 2510, et seq.

§ 2511, criminalizes

Intentional interception of oral, wire or electronic communication

Discloses

Uses


Question: What is interception (……still debated…..)

Question: What is electronic communication?

United States v. Councilman, 418 F.3d 67 (1st Cir. Mass. 2005)

United States v. Szymuszkiewicz, 2009 U.S. Dist. LEXIS 60755 (E.D. Wis. June 30, 2009)



Civil Remedies

generally any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used



Relief

Preliminary, declaratory and other equitable

reasonable attorney’s fee and costs

Damages, either (a) actual plus profits OR (b) statutory ($100/day or $10,000)

18 U.S.C. § 2520



Employers cannot:

use any devices to intercept wire, oral, or electronic communication.

Use or disclose any information obtained through these methods

Disclose or obtain unauthorized access to stored communications.

Three Exceptions…..



Employers cannot:

use any devices to intercept wire, oral, or electronic communication.

Use or disclose any information obtained through these methods

Disclose or obtain unauthorized access to stored communications.

Three Exceptions…..



THREE EXCEPTIONS

If one party has given prior consent.

Business extension exception – Certain interceptions are OK in the ordinary course of business.

Provider exceptions – Certain interceptions OK on internal communications systems.



Consent: requires only that one party to the communication consent to its interception and access (but be wary of stricter statutes)

Providers: employers who own and provide their own e-mail or instant message systems are exempt

Not applicable if the interception occurs in the “ordinary course of business.”



whoever--

(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or

(2) intentionally exceeds an authorization to access that facility;

AND…..

Stored Communications Act (18 U.S.C. § 2701)


thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished . . .



(REMEMBER - CRIMINAL STATUTES)

Civil Remedy

Very similar to ECPA except minimum statutory of $1,000

Punitive if willful determination

18 U.S.C. § 2707



18 U.S.C. § 2702

Providers generally cannot disclose contents of communications except in certain instances



General Thoughts

Harsher penalties when done for malicious purposes or commercial advantage

Certain permission creates exceptions



General Thoughts

Provides exception for “the person or entity providing a wire or electronic communications service.”

Thus, courts have been favorable to employers when e-mails occur on employer-created e-mail servers.

BUT BE WARY…..MISPERCEPTION



City of Ontario, California v. Quon, et al.

SCA Question:

In storing texts, was Arch Wireless acting as a “remote computing service” or an “electronic communication service”?

If remote computing service, it could disclose, as subscriber was the City employer.



City of Ontario, California v. Quon, et al.

SCA Question:

If electronic communication service, it could not disclose because the City was not an “originator or an addressee or intended recipient of such communication.”

This is what Ninth Circuit concluded.



Impact of Quon on Use of Employer Devices

by Employees will continue….



Computer Fraud and Abuse Act (CFAA)(18 U.S.C. § 1030)

Prevents Unauthorized Access or Exceeding Authorized Access

to Computers in

Variety Contexts

- National Security- Financial Information- Information from Government- Protected Computer



Protected Computer

Financial Institution or related

Interstate or Foreign Commerce

18 U.S.C. § 1030(e)(2)



Protected Computer

…… and Causes Damage



Civil Remedy provision

18 U.S.C. § 1030(g)

Anyone harmed BUT….



One of five types of damage

Most Common

(I) loss to 1 or more persons during any 1-year period

(and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers)

aggregating at least $5,000 in value;



Also:

affecting medical examination, diagnosis, treatment, or care physical injury to any person;

a threat to public health or safety;

damage affecting a computer used by or for an entity of US



Must be

Unauthorized Access

Exceeding Authorized Access

Key Question….



Snap-on Business Solutions Inc. v. O'Neil & Assocs., Inc. (N.D. Ohio April 16, 2010)(Examined Agreements, question of fact denied MSJ)

LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009)(access not automatically unauthorized if disloyal)

International Airport Centers, LLC v. Citrin, 440 F.3d 418 (7th Cir. 2006)(employee who violates duty of loyalty, no authorization)

US v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009)(violation of TOS not enough)


State Statutes

Utah

Offenses Against Privacy76-9-403 Privacy Abuse76-9-403 Communications Abuse

Interception of Communications Act77-23a-1, et seq.

Access to Electronic Communications77-23b-1, et seq.


Utah 76-9-402. Privacy Violation

(1)A person is guilty of privacy violation if, except as authorized by law, he:

(a)Trespasses on property with intent to subject anyone to eavesdropping or other surveillance in a private place; or




(b) Installs in any private place, without the consent of the person or persons entitled to privacy there, any device for observing, photographing, recording, amplifying, or broadcasting sounds or events in the place or uses any such unauthorized installation; or




(c) Installs or uses outside of a private place any device for hearing, recording, amplifying, or broadcasting sounds originating in the place which would not ordinarily be audible or comprehensible outside, without the consent of the person or persons entitled to privacy there.


Utah 76-9-403. Communication abuse

(1) A person commits communication abuse if, except as authorized by law, he:

(a) Intercepts, without the consent of the sender or receiver, a message by telephone, telegraph, letter, or other means of communicating privately;

[Illinois legislation]



[the foregoing paragraph] does not extend to:

(i) Overhearing of messages through a regularly installed instrument on a telephone party line or on an extension; or

(ii) Interception by the telephone company or subscriber incident to enforcement of regulations limiting use of the facilities or to other normal operation and use; or



(b) Divulges without consent of the sender or receiver the existence or contents of any such message if the actor knows that the message was illegally intercepted or if he learned of the message in the course of employment with an agency engaged in transmitting it.

(2)Communication abuse is a class B misdemeanor.


Utah 76-9-401. Definitions

(1) "Private place" means a place where one may reasonably expect to be safe from casual or hostile intrusion or surveillance.

(2) "Eavesdrop" means to overhear, record, amplify, or transmit any part of a wire or oral communication of others without the consent of at least one party thereto by means of any electronic, mechanical, or other device.

(3) "Public" includes any professional or social group of which the victim of a defamation is a member.


Utah 76-9-401. Definitions

(1) "Private place" means a place where one may reasonably expect to be safe from casual or hostile intrusion or surveillance.

(2) "Eavesdrop" means to overhear, record, amplify, or transmit any part of a wire or oral communication of others without the consent of at least one party thereto by means of any electronic, mechanical, or other device.

(3) "Public" includes any professional or social group of which the victim of a defamation is a member.


Interception of Communications Act77-23a-1, et seq.

Akin to the ECPA


Access to Electronic Communications77-23b-1, et seq.

Akin to the SCA


Common Law

Privacy Torts

Utah

Intrusion Upon SeclusionPublic Disclosure of Embarrassing

Private FactsMisappropriation of Name or LikenessFalse Light in Public Eye


Common Law

Utah

Intrusion Upon Seclusion

(1) 'an intentional substantial intrusion upon the solitude or seclusion of the complaining party,’

(2) the intrusion 'would be highly offensive to the reasonable person.'"


Common Law

Utah - Intrusion Upon Seclusion

Physical intrusion not required

“As the Utah courts explained, although a physical intrusion may not always be necessary, ‘there must be something in the nature of prying or intrusion.’”

Barker v. Manti Tel. Co., 2009 U.S. Dist. LEXIS 819 (D. Utah Jan. 6, 2009)


Common Law

Utah - Intrusion Upon Seclusion

Publicity Not Required

“Thus, it is that affirmative physical intrusion, eavesdropping, investigation, examination or prying that constitutes the tort, not any subsequent sharing of the information learned in an intrusion.”

Barker v. Manti Tel. Co., 2009 U.S. Dist. LEXIS 819 (D. Utah Jan. 6, 2009)


Common Law

Intrusion Upon Seclusion

requires that the complainant have a reasonable expectation of privacy

and that any violation of that expectation be highly offensive.

Typically, courts find that employees meet neither requirement.


Common Law

Intrusion Upon Seclusion - General Observations

Any employer policy that notifies an employee that there is no expectation of privacy is likely to be sufficient.

Judges rarely find that systematic measures taken by a business to protect its interests to be offensive.

Courts rarely find that the degree of intrusion outweighs the interest of an employer.


More Common Surveillance Issues


Email Monitoring - ECPA

Emails considered “communications” by the ECPA

Steve Jackson Games, Inc. v. United States Secret Service816 F. Supp. 432 (W.D.Tex. 1993), aff'd, 36 F.3d 457 (5th Cir. 1994)

Reading and deleting messages stored on employee’s computer was not an interception under the Wiretap Act.

Generally, for an employee to sue under the ECPA, the email must be intercepted while being transferred


Email Monitoring - SCA

Provides exception for “the person or entity providing a wire or electronic communications service.”

A court has held that employers whose computer terminals and software were integral in the communications systems fell under this exception

Many other cases have also allowed access under this theory


Email Monitoring - Common Law

One MA case allowed invasion of privacy claim to go forward where

Employees could choose own passwords, no policy against personal emails, and the supervisor spent 8 hours reading through emails

Most challenges have not been successful


Email Monitoring - Cases

Thygeson v. Bancorp

The court denied claim holding that

"when, as here, an employer accesses its own computer network and has an explicit policy banning personal use of office computers and permitting monitoring, an employee has no reasonable expectation of privacy.”

2004 U.S. Dist. LEXIS 18863, 2004 WL 2066746 at *21 (D. Or. Sept. 15, 2004)



Recently cited in Idaho case

Alamar Ranch, LLC v. County of Boise, 2009 U.S. Dist. LEXIS 101866 (D. Idaho Nov. 2, 2009)

In discussion of attorney-client privilege, also citing

Kaufman v. SunGard Invest. Sys., 2006 U.S. Dist. LEXIS 28149 (D.N.J. May 9, 2006)

Where attorney-client privilege lost . . .



Where attorney-client privilege lost . . .

because

the company policy clearly informed employees that emails would be "subject to monitoring, search or interception at any time . . . ."



Smyth v. Pillsbury Co., 914 F. Supp. 97, 101 (E.D. Pa. 1996)

The Court concluded that an employee did not have a reasonable expectation of privacy in a company's e-mail system despite company assurances that e-mails would "remain confidential and privileged.”



Smyth v. Pillsbury Co., 914 F. Supp. 97, 101 (E.D. Pa. 1996)

“Once plaintiff communicated the alleged unprofessional comments to a second person (his supervisor) over an e-mail system which was apparently utilized by the entire company, any reasonable expectation of privacy was lost.”


Email Monitoring - Email Cases

Cole v. Zavaras, 349 Fed. Appx. 328 (10th Cir. Colo. 2009)

(approving conclusion by district court that no legal authority exists for the proposition that there is a reasonable expectation of privacy in e-mails sent to a stranger over the Internet, or that the person to whom the e-mails are directed may not disclose them)


Email Monitoring - Email Cases

United States v. Perrine518 F.3d 1196 (10th Cir. Kan. 2008)

citing a number of cases regarding privacy of subscriber information and…

United States v. Lifshitz, 369 F.3d 173, 190 (2d Cir. 2004)

("Individuals generally possess a reasonable expectation of privacy in their home computers. . . . They may not, however, enjoy such an expectation of privacy in transmissions over the Internet or e-mail that have already arrived at the recipient.").


Email Monitoring - Other Considerations

Can be used as evidence in cases

Inappropriate emails could be harassment in and of themselves.

National Labor Review Board

If employees are unionized, the bargaining agreement may restrict an employer’s ability to monitor email.


Instant Messaging

Same basic legal rules apply as apply to e-mails.

Especially if the IM service is provided by the employer.

Difference if using AOL, Google, or MSN programs:

Higher expectation of privacy, but this can be reduced through policies


Instant Messaging

Best option is to address IMs within policy that discusses email and other communications

How/when/why IM-ing is allowed

Clearly notify employees if there is a policy of storing or reviewing instant messages.


Monitoring Web Usage

Not a “communication” under ECPA, making it easy to regulate.

If an employee wants to challenge monitoring of Internet usage, it must be done under common law

Likely “intrusion upon seclusion” invasion of privacy.

Not much case law on this. Typically hard to claim, especially if logged on to an employer’s network or if an employer’s written policy is in use.



Still grounds that have not fully been covered

Logging in from a remote location (home computer, for example)

One search was ok in CA appeals because the computer was issued by work and employee signed an electronic equipment policy establishing no expectation of privacy.



Still grounds that have not fully been covered

Obligation to third parties to monitor and stop inappropriate online action that could harm third parties?


Blogging

Statutory concerns

Blog-related discipline may not be used to retaliate against the employee’s statutory rights.

If an employer's behavior has a disparate impact upon a protected class of employees, or employees are treated differently, i.e. subjected to disparate treatment, Title VII of the Civil Rights Act is applicable


Blogging

Statutory concerns

Whistle blowing or discussing terms of employment are protected.

Blogs advocating employee activity to improve terms and conditions of employment might also be protected under the National Labor Relations Act.


Blogging

Common solution: Have an employee blogging policy

May not be able to limit off-duty blogging

Limit blogging on company equipment

If employees note themselves as employees on the blog, require a disclaimer

Prohibit mentioning clients, customers, etc without their consent

Notify of any practice of monitoring blogs.


Blogging

It is difficult to prevail under a tort theory of privacy since blogs are posted online for anyone to view.

Thus absent any federal or state statutory protections, employers can terminate, at will, employees whose blogs they dislike.


Blogging

Termination Examples

A former Delta Airlines flight attendant says she was terminated for her blog, Diary of A Flight Attendant. Posing in her Delta uniform in an empty plane, Ellen Simonetti says she was terminated for placing "inappropriate" pictures on the Web.


Blogging


Michael Hanscom, a temporary Microsoft employee, was fired in 2003 by Microsoft for photos posted on his blog, eclecticism. At the site, Hanscom took a picture of several Apple G5 notebooks being unloaded on a loading dock


Blogging


A high profile Washington, D.C. blogging termination involved Jessica Cutler, then a staff assistant to Senator Mike DeWine. Cutler was terminated after blogging about her sexual exploits with various Washington politicians. Jessica was terminated for "misusing an office computer.




Arbitration Development

Union guidelines brought arbitration into the field of employee surveillance.

Present day labor arbitrators have confronted issues with employee surveillance and technological developments.

This method is being relied on more heavily as the disputes become more frequent.



Suggested Guidelines

Right to affirmatively refuse monitoring;

Notice of monitoring;

Notice of the particulars of the monitoring;

Notice of infractions related to the use of new technology;




Notice of resulting discipline for those infractions;

Consistent enforcement of policies relating to technology;

Confidential review of information discovered through monitoring;




Limited collection of information through technological monitoring;

Reasonable suspicion of an infraction before monitoring;




Assessment of the accuracy and reliability of the information produced by the monitoring;

Compensation for a violation of privacy; and

Restrictions on discipline imposed based on information gathered as a result of monitoring.



Monitoring Personal Use of Computers

Forbidding personal use is out of sync with modern workplace reality



Monitoring Personal Use of Computers

Right to Privacy When Using Computer for Personal Reasons

Some arbitrators - employees have a right to privacy in their computer usage.

Others - e-mails are not private unless employer policy explicitly says so.

Many employees believe their communications will be private and if viewed, they would not be disciplined for their contents.



Monitoring Personal Use of Company Computers

Nonetheless…..Some Uses Can Be Prohibited

An employer has a legitimate business interest in prohibiting certain computer uses that are likely to negatively impact the business or workplace.




Nonetheless…..Some Uses Can Be Permitted

Illegal conduct….

downloading images of child pornography





Illegal conduct….

defamatory communication





Illegal conduct….

offensive images of a racial or sexual nature, or that result in racial or sexual harassment



Notice of Use

Provides an important safeguard for employees' right to privacy

Does Not Interfere With Ability to Monitor



Surreptitious Surveillance, when is it appropriate?

Documentary evidence obtained through a nonconsensual search is appropriate "so long as the methods employed are not excessively shocking to the conscience of a reasonable person....”

Another case suggests that surreptitious monitoring is appropriate when there is a known violation but no knowledge of who has engaged in the violation.




When there is a reasonable suspicion that a violation of company policy has taken place.




Employers should give notice:

Type of conduct that will constitute an infraction and the level of discipline for each infraction.

Monitoring will take place when the employer has a reasonable suspicion of an infraction.

Monitoring system that will be used.


Policy Guidelines

We have discussed various items for a policy….

….presumes the need for a policy.


Novel Issues


Novel Issues - Text Messages/Smart Phones

City of Ontario v. Quon United States Supreme Court (2010)


Novel Issues - Video Surveillance

Hernandez v. Hillsides, Inc., Supreme Court of California (2009)

Secret camera placed in an office shared by 2 female employees without notice to them. Intended to find identity of person using their office after closing to view pornographic materials.

The camera was not operated during business hours and plaintiffs' activities were not viewed or recorded


Novel Issues - Video Surveillance

Hernandez v. Hillsides, Inc., Supreme Court of California (2009)

Reasoning

Expectation of privacy?

Yes. Less because the office is shared.

Reasonableness in inception and in scope?

Actual surveillance was drastically limited in nature and scope, exempting plaintiffs from its reach, and defendants were motivated by strong countervailing concerns.


Novel Issues - Phone Surveillance

Narducci v. Moore (7th Cir. 2009)

Defendants worried about threats from residents to finance officials (calls usually due to residents not paying utility bills) and about employees making personal calls on village time and using village phones.

No calls were ever actually reviewed


Novel Issues - Phone Surveillance (cont’d)

Narducci v. Moore (7th Cir. 2009)

Rule for justifiable at inception:

When there are reasonable grounds for suspecting that the search will turn up evidence that the employee is guilty of work-related misconduct, or that the search is necessary for a non-investigatory work-related purpose.

Rule for justifiable in scope:

So long as "the measures taken by the employer are reasonably related to the search's objective and they are not overly intrusive in light of the nature of the alleged misconduct."


Novel Issues - Drug Free Workplace Act

41 USC § 701

Only applied to employers who meet qualifications

Must provide notice that drugs are not allowed. Also must note counseling, rehab, etc. for recovery options.


Novel Issues - Title VI of Civil Rights Act

No-dating policies have been challenged as sex discrimination.

Dress codes may result in religious discrimination.


Novel Issues - Smoker’s Rights

Most states have laws that prohibit employers from making employment decisions based on lawful, out of work activities (marital status, lifestyle, appearance)

Approximately thirty states protect against discipline for smoking off-duty and away from the employer's premises


Novel Issues - Pen Registers/Trap & Trace

18 USCS § 3121

Need a court issued warrant.

Exceptions:

relating to the operation, maintenance, and testing of a wire or electronic communication service or to the protection of the rights or property of such provider, or to the protection of users of that service from abuse of service or unlawful use of service;

or



18 USCS § 3121


Exceptions:

to record the fact that a wire or electronic communication was initiated or completed in order to protect such provider, another provider furnishing service toward the completion of the wire communication, or a user of that service, from fraudulent, unlawful or abusive use of service;

or



18 USCS § 3121


Exceptions:

where the consent of the user of that service has been obtained


Charles Lee Mudd Jr.Mudd Law Offices

Park City Office

311 Main StreetSecond FloorP.O. Box 483Park City, Utah 84060435.640.1786 Telephone435.603.1035 [email protected]

om

Chicago Office

3114 West Irving Park Road

Suite 1WChicago, Illinois 60618773.588.5410 Telephone773.588.5440 [email protected]

om

Documents

© 2010 Mudd Law Offices Privacy in the Workplace: Electronic Surveillance Under State and Federal Law Charles Lee Mudd Jr. – Mudd Law Offices