The Employer’s Right to Monitor Employee E-mails and Its Implications for the Attorney-Client Privilege
While many employees primarily use e-mail at work to conduct company business, there is also a natural tendency to occasionally use e-mail to conduct purely personal matters while on the company clock. It is a safe bet that everyone reading this article has at one point or another used e-mail at work to communicate with a family member or friend about a non-work related matter. Most employers recognize this fact and understand that it is good company policy to allow employees some personal freedom at work.
A question that gets overlooked by many is whether the employer has the right to review any e-mail communications sent by its employees at work. As explained below, employers are generally permitted to review work e-mail sent over the company’s network or via a company e-mail account, as long as they provide clear notice to their employees that they should not expect privacy in such work-related e-mails. An issue that has increasingly arisen in litigation is whether an employer can review personal e-mails sent by an employee to his or her attorney using a company e-mail, computer, or network. As discussed below, employers and their attorneys should be cautious in reviewing personal, password protected e-mails from a personal e-mail account between an employee and his or her attorney and using such e-mails in litigation. This article discusses the general rule allowing an employer to review its employees’ e-mails and its implications for the attorney-client privilege.
The Employer’s Right to Monitor Its Employees’ E-mails
The general rule is that an employer has the right to review its employees’ e-mails sent using a work e-mail address or computer, as long as the employer provides clear, written notice of such practice to its employees.1 The basis for this rule is that employees do not have a reasonable expectation of privacy in e-mails sent using a company e-mail or computer if they are provided with written notice that the employer may review all e-mails sent at work.2
The Electronic Communications Privacy Act (“ECPA”)3 was enacted by Congress in 1986 and generally prohibits the unauthorized “interception” of or access to electronic communications, including telephone, e-mail, and computer communications. There are several notable exceptions, however, that give an employer wide latitude to monitor the e-mail of its employees. Those exceptions include the following:
- The Consent Exception: If one of the parties involved in the communication consents, then interception and review is permitted. An employment agreement or computer use policy signed by an employee will typically constitute consent under the ECPA.4
- The Business Use Exception: The ECPA does not prohibit interception if it is conducted within the ordinary course of an employer’s business and the employer has a legitimate business interest in the communication.5
- The Service Provider Exception: The ECPA permits the provider of an electronic communication service to intercept or access electronic communications that are stored by that service. In other words, the employer is allowed to monitor its employees’ e-mails that are transmitted or stored by the company-provided computer system.6
Wisconsin recently enacted a new social media law that prohibits an employer from obtaining certain information from an employee’s personal social media account.7 Sara C. Mills’ article published in the Summer 2014 issue of this Journal provides an overview of this law.8 The law prohibits an employer from asking an employee or job applicant to grant access to, allow observation of, or disclose information that allows access to his or her personal internet account. Like the ECPA, there are a number of large exceptions under Wisconsin’s new social media law, including an exception that permits an employer to monitor and access electronic data that is stored on an electronic communications device paid for in whole or in part by the employer or electronic data that is traveling through or stored on the employer’s network. Based on this exception, it is safe to say that employers still have the right to access and monitor the e-mails sent by their employees at work or using a work e-mail if they provide their employees with notice.
Does the Attorney-Client Privilege Apply to Personal E-mails Sent by an Employee at Work?
Given the right of an employer to monitor and review its employees’ e-mails sent through a work account, an interesting question that has increasingly arisen is whether the attorney-client privilege attaches to e-mails sent by an employee to his or her attorney using a work e-mail, network, or computer. There are currently no Wisconsin cases that specifically address this issue. In the jurisdictions that have dealt with this issue, the primary test is whether the employee had a reasonable expectation of privacy in communications with his or her attorney. The relevant factors that have been applied to determine whether an employee has a reasonable expectation of privacy include the following:
- Does the employer maintain a policy banning personal or other objectionable use?
- Does the employer monitor the use of the employee’s computer or e-mail?
- Do third-parties have a right of access to the computer or e-mails? and
- Did the employer notify the employee, or was the employee aware, of the use and monitoring policies?9
No single factor is dispositive.10 The essential question comes down to “whether the [employee’s] intent to communicate in confidence was objectively reasonable.”11
The Majority Approach: Communications Not Privileged
Using the above framework, the California Court of Appeals has ruled that the attorney-client privilege does not attach to e-mails sent by an employee to her attorney using her work account. In Holmes v. Petrovich Development Co.,12 an employee sued her former employer for sexual harassment, retaliation, and numerous other claims. While employed, the employee was advised in writing of the company’s computer use policy that stated: (1) the company’s computers were to be used only for company business and that employees were prohibited from using them to send or receive personal e-mails; (2) the company would monitor its computers for compliance with this policy and thus might “inspect all files and messages...at any time”; and (3) employees using company computers to generate personal messages had “no right of privacy with respect to the information or message.”13 After suit was filed, the employer reviewed the employee’s laptop and discovered a number of e-mails between the employee and her attorney using the company’s e-mail account addressing potential legal action against the employer.
The Holmes court found that the employee’s use of company e-mail to communicate with her attorney was “akin to consulting her attorney in one of defendants’ conference rooms, in a loud voice, with the door open so that any reasonable person would expect that their discussion of her complaints about her employer would be overheard by him.”14 Based on the employer’s detailed computer use policy and employee’s use of her work e-mail account, the court held that the employee lacked a reasonable expectation of privacy, and that her communications were accordingly not protected by the attorney- client privilege.15
A number of other courts have reached similar results to that reached in Holmes, finding that the privilege does not apply even where the employer’s computer and email policies allow for limited personal use and the employee used his or her personal e-mail account. In these cases, the employer’s policies specified that the employee should not expect privacy in personal e-mails sent from work and unequivocally gave the employer the right to monitor all e-mail use connected to the employer’s work accounts, equipment, or network.16
The Minority Approach: Communications Privileged
The above cases contrast sharply with a 2010 New Jersey Supreme Court decision. In Stengart v. Loving Care Agency, Inc., the court held that the attorney-client privilege attached to e-mails sent by an employee from her company-provided laptop to her attorney using a personal, password- protected, web-based e-mail account.17 In that case, an employee sued her former employer for discrimination.18 While employed, the employee used a company-provided laptop computer to conduct company business and had a company provided e-mail account.19 Prior to leaving her employment, the employee used her company- issued laptop to communicate with her attorney about her situation at work through her personal, Yahoo e-mail account.20
After suit was filed, the employer hired experts to create a forensic image of the laptop’s hard drive, including temporary internet files.21 Those files contained the contents of seven or eight e-mails the employer exchanged with her lawyer via her Yahoo account.22 The bottom of the e-mails sent by the employee’s attorney warned readers that the information was “only intended for the personal and confidential use of the designated recipient” of the e-mail, which may be a “privileged and confidential” attorney-client communication.23 After obtaining the e-mails, the employer’s attorney used the information contained in the e-mails during discovery.24 The employee’s attorney demanded that the e-mails be returned claiming that they were protected by the attorney-client privilege.25 The employer argued that the employee had no reasonable expectation of privacy in files on a company-owned computer in light of a computer use policy that provided that the employer could review and access “all matters on the company’s media systems and services at any time.”26 The trial court sided with the employee, finding that the e-mails were privileged, but the New Jersey Court of Appeals reversed.27
The New Jersey Supreme Court held that the employee could reasonably expect that e-mails with her attorney through her personal, password- protected, web-based e-mail would remain private, and that sending and receiving those e-mails using a company laptop did not eliminate the attorney- client privilege that protected them.28 The court found that the employer’s computer use policy was ambiguous and that the use of the term “e-mail system” in the policy appeared to refer to the company’s e-mail accounts, not personal accounts.29 Notably, the Stengart court went a step further and held that an employer has no right to read or access an employee’s personal, password-protected e-mail communications with her attorney regardless of what the computer use policy states.30 While employers can adopt and enforce lawful policies relating to computer use to protect the assets and productivity of a business, the court found that they have no basis to read the contents of personal, privileged, attorney-client communications merely because they were sent using the employer’s laptop or server.31
Recommended Practices for Employers and Their Attorneys
As exhibited by the cases discussed above, it is very important for employers to have a clear and concise computer use policy that informs employees that their e-mail may be monitored while at work. Such a policy should not only explain the extent of the employer’s monitoring of e-mails but also state that the employee has no reasonable expectation of privacy using e-mail while at work regardless of whether the e-mail was sent from a work or personal account. The more specific the policy is about a lack of privacy for employees who use their personal e-mail over the employer’s computer system, the more likely an employee will be found to have waived the attorney-client privilege by using those systems to communicate with his or her attorney.
With that said, the New Jersey Supreme Court’s decision in Stengart has created some uncertainty for employers on whether they may review an employee’s personal e-mails with their attorney sent using a work computer or work server. The Stengart court went to the unusual length of holding that the attorney-client privilege will never be waived by an employee who uses her personal e-mail at work to communicate with his or her attorney even if the employer has a clear computer use policy advising otherwise and the employee is using a company- provided computer and network.
Wisconsin courts have not yet addressed this issue and it is difficult to forecast how they would rule. In light of this uncertainty, employers and their attorneys should exercise caution in reviewing such communications. In the event an employer and its attorney discover that e-mails were sent by a plaintiff employee to his or her attorney using a work computer or account, the most prudent approach, if an attorney-client privilege objection is made, would be to turn the e-mails over to the court for an in-camera review and obtain a ruling on whether the privilege applies. For now, it is probably unwise to simply assume such e-mails are not privileged and use them in litigation given the uncertainty on this issue.
It should not be forgotten that, as a matter of promoting good employee morale, employers should still act reasonably in accessing and reviewing their employees’ e-mails, even though they have a broad right to do so. Employees will not want to work for a company that is known for snooping around its employee’s e-mails without a strong justification and for refusing to allow them to use their work e-mails for small, personal matters. A company will go only as far as its employees will take it, and it is important to give employees some freedom and trust in using e-mail at work.
Justin Lessner is a member of Axley’s Litigation Practice Group with a broad litigation practice, including business disputes, construction defect litigation, product liability, professional liability defense, employment matters, and insurance defense. He is also experienced in handling condemnation and eminent domain matters.
Mr. Lessner has litigated a wide variety of matters from inception through trial or arbitration and appeal in many courts both in and out of Wisconsin, including Illinois, Indiana, Iowa, Ohio, Georgia, and New York. He uses his breadth of experience to assist clients in developing the most appropriate and efficient strategy to handle complex litigation and business disputes. Mr. Lessner is highly regarded by his peers and was named to the 2013 and 2014 Illinois Rising Stars Lists by Super Lawyers Magazine, a recognition given to no more than 2.5% of attorneys in the state. Prior to joining Axley, Mr. Lessner worked at a well-known litigation firm in Chicago.
Justin was born and raised in the Madison area and is proud to call Madison his home. Outside of work, Justin enjoys spending time with his wife and two young daughters, as well as playing hockey, golf, and attending Packers games.
Justin is admitted to practice in Wisconsin and Illinois state and federal courts. He is also admitted to practice in the Sixth and Seventh Circuit Court of Appeals.
1 See Biby v. Board of Regents, 419 F.3d 845, 850-51 (8th Cir. 2005) (holding that state university policy stating that computer files and e-mails may be searched in response to litigation requests eliminated user’s reasonable expectation of privacy); Smyth v. Pillsbury, 914 F. Supp. 97 (E.D. Pa. 1996) (holding that employer was entitled to review e-mails sent by employee at work and employee had no reasonable expectation of privacy in such e-mails).
3 18 U.S.C. § 2510, et seq.
4 18 U.S.C. § 2511(2)(d).
5 18 U.S.C. § 2510(5)(a).
6 18 U.S.C. § 2511(2)(a)(1).
7 2013 Wisconsin Act 208 (enacted April 8, 2014).
8 See Sara C. Mills, Friend Me or You’re Fired: An Overview of Wisconsin’s New Internet Privacy Statute, Wis. Civil Trial J., Vol. 12, No. 2 (Summer 2014).
9 In re Asia Global Crossing, Ltd., 322 B.R. 247, 258-59 (Bankr. S.D.N.Y. 2005).
11 Id. at 258.
12 191 Cal. App. 4th 1047 (Cal. App. 3rd Dist. 2011).
13 Id. at 1051.
16 See, e.g., Aventa Learning, Inc. v. K12, Inc., 830 F. Supp. 2d 1083 (W.D. Wash. 2011) (holding that there was no reasonable expectation of privacy in personal e-mails sent over company computer when company policy discouraged personal use and warned that e-mails were not private); In re Royce Homes, LP, 449 B.R. 709 (Bankr. S.D. Tex. 2011) (holding there was no reasonable expectation of privacy in personal e-mails sent to attorney when computer use policy clearly provided employer had right to review any e-mails sent over company networks or equipment); United States v. Hamilton, 701 F.3d 404 (4th Cir. 2012) (finding that e-mails sent through work e-mail were not subject to marital communication privilege when spouse was on notice his accounts were subject to search but did not take any efforts to protect allegedly privileged material).
17 201 N.J. 300, 990 A.2d 650 (N.J. 2010).
18 Id. at 308.
20 Id. at 309.
23 Id. at 309-10.
24 Id. at 310.
26 Id. at 311.
28 Id. at 321.
29 Id. at 322.
30 Id. at 325.