What Is Workplace Privacy?
Workplace privacy is a term that describes privacy issues in the workplace. Privacy can be implicated in several ways in the workplace. For example, hiring, firing, and performance reviews all have potential privacy concerns, and how employers interact with employees in these matters can have privacy implications.
As a rule, most U.S. employees have very little expectation of privacy in their workplaces. Very few states have enacted laws about workplace privacy issues, although some states may have laws relating to general issues, such as telephone wiretapping. Not all states have considered the impact of those laws in the workplace.
Employers can use technology, such as electronic communications, to make workers more productive. Employers provide employees with equipment to use at work. This equipment includes desktop and laptop computers, cell phones, telephones, voicemail, email, and internet access. These technologies allow employers a greater opportunity to monitor how their employees are working each day. This is called workplace monitoring.
This section will discuss the following types of monitoring:
- Telephone and voicemail monitoring
- Video surveillance monitoring
- Computer use monitoring (including internet access)
- Email monitoring
For the most part, workplace monitoring is permissible in the United States. Courts are just beginning to address the limits of an employer’s ability to monitor employees. Employers usually are permitted to monitor their employees so long as the employer has a legitimate business reason to do so. However, employers have great discretion in determining legitimate business reasons for monitoring.
Workplace monitoring is legitimate when used to measure employee productivity and workplace safety. It is also legitimate when used to protect employer assets and prevent theft. Workplace monitoring can also properly be used to:
- Ensure that employees are properly using the organization’s sensitive data
- Verify that employees are not violating other policies (such as acceptable use policies)
- Protect the company from liability for bad acts committed by employees
Telephone, Voicemail, and Email Monitoring
Some organizations monitor employee telephone, voicemail, and email conversations as a part of routine activities. One reason to do this is to make sure the employees are providing good customer service. Employees have few protections from this type of monitoring.
Telephone and Voicemail Monitoring
An employer’s right to monitor telephone conversations must be reviewed under federal and state law. Federal protection for electronic communications is found in the Electronic Communication Privacy Act (ECPA). It also protects telephone calls. Under this law, generally the use of eavesdropping technologies to record a telephone conversation requires a court order.
However, telephone conversation monitoring in the ordinary course of business may be allowed without a court order. To use this ECPA exception, an employer must state a legitimate business interest in monitoring telephone calls. Employers also must show that the monitoring occurred on equipment provided by a communications service provider.
NOTE
Gartner estimates that almost 80 percent of companies will be monitoring their employees in some way in 2020.28
Courts tend to give employers deference when reviewing their legitimate business reason for monitoring. In most cases, the reason is met if the monitoring is even slightly related to business matters. Employee telephone calls with customers about services or products that the employer provides clearly relate to business matters and can be monitored. Monitoring telephone calls for quality control purposes also is a legitimate business purpose.
For monitoring to stand up in court, an employer must show that the monitoring took place on equipment supplied by its phone system service provider. The equipment used to monitor calls must be more than a simple tape recorder. In Deal v. Spears (1992), the Eighth Circuit Court of Appeals found that a recorder purchased at a consumer electronics store did not qualify as ordinary telephone equipment.29 The court held that even though the employer’s reason for monitoring was legitimate (the prevention of theft), the exception was not met. The monitoring was a violation of federal law.
Federal law allows monitoring only when the conversation clearly relates to the employer’s business. Employers must immediately stop monitoring a call once they determine that it is personal. Personal calls are outside of the ordinary course of business.
However, employers may always monitor employee telephone calls when the employee gives consent. In this case, an employer must provide notice of the monitoring. It also must show that its employees consented to the monitoring. Employers can prove that they gave notice by putting their monitoring policy in the employee handbook. They can show that an employee consented to monitoring by having employees sign an acknowledgment form. There is no violation of the ECPA if an employee gives the employer permission to monitor the employee’s call.
Most state laws have wiretap statutes that are based on federal law. There may be subtle differences from state to state. In Delaware, for example, employers must provide written notice before monitoring calls.30 In Connecticut, all parties to the conversation must give consent before a call can be monitored.31
There is far less regulation with employer monitoring of stored voicemail messages. Under federal law, employers that provide electronic communication services may access messages once they are stored in their computer or telephone systems, which they can do without notifying employees. If an employer owns the telephone system, then it may legally access stored voicemails.
Email Monitoring
Email monitoring is very similar to telephone conversation monitoring. The federal wiretap laws in place for monitoring telephone conversations also apply to intercepting email conversations. Similar to telephone conversations, real-time email monitoring may be permitted in some instances. An employer may intercept employee email using equipment furnished by the provider of electronic communication services. However, an employer must have a legitimate business purpose for intercepting email.
Email monitoring does raise some questions that are different from telephone conversation monitoring. For instance, email is different because it can be stored indefinitely on the employer’s equipment. Under federal law, stored electronic communications can be accessed by the organization that provides the electronic communications service. This “stored communication” exception is very broad. If the employer provides the email service, then it may properly access stored emails from that service.
Under federal law, employee consent always permits an employer to monitor an employee’s email. State laws generally permit email monitoring in a manner that is similar to telephone monitoring. There may be occasional variations among the states. In Delaware, for example, employers must provide written notice before monitoring email communications.
Court cases generally have found that employers are free to read email messages when the employer provides the email account. These courts sometimes, but not always, consider whether the email was intercepted for a legitimate business reason or if it was viewed from its storage location.
Sometimes employees access their private, web-based email accounts from employer-provided equipment. This is a different issue from employers’ monitoring of work-provided email. Employers who access private email accounts may run into problems with the federal law, even if the employee has accessed that private account from a work-provided computer, because the ECPA prohibits employers from accessing an employee’s personal email account. Courts have found that employers act inappropriately if they use computer-monitoring equipment to obtain usernames and passwords to employee personal accounts. If the employer then accesses those private email accounts without permission, it is considered an ECPA violation.
Computer Use Monitoring
Employers may monitor employee computer and internet use for many reasons. In addition to the business reasons already mentioned, employers may monitor computer and internet use to discourage inappropriate online conduct at work. This could include discouraging online shopping during work hours or viewing adults-only websites.
Employees generally do not have any reasonable expectation of privacy in their use of employer-provided resources. An employer generally is allowed to monitor an employee’s use of work-provided computers and internet access. This monitoring includes reviewing files and software on the computer. It also includes tracking internet use and the web pages that an employee visits.
An employer can monitor computer or internet use in many ways:
- Employing keystroke loggers to monitor keystrokes made in a certain period, or the number of websites visited
- Tracking how much time employees spend in software applications provided for work purposes to measure productivity
- Using software programs to measure employee time spent on the internet. Employers can also block employee access to some web pages to limit the types of sites that employees can access from work.
There is no federal prohibition against employer computer or internet-use monitoring when the employer provides the equipment to the employee. Computer and internet monitoring is permitted in most states. Connecticut32 and Delaware33 are notable exceptions. These states require employers to give notice before monitoring computer use.
Many questions are unanswered concerning the limits of employer computer use and internet monitoring. Court opinions provide little guidance. Employees that challenge employer computer monitoring claim that the monitoring infringed upon their reasonable expectation of privacy in the use of the work computer. Different courts in different areas have come to different conclusions.
Some courts have ruled that an employee never has any privacy in employer-provided computers. Other courts have decided that an employee may have a reasonable expectation of privacy in employer-provided computers. These cases are very fact-dependent. For instance, if an employee keeps the computer in his or her locked office and uses a password to protect the machine, he or she might have a reasonable expectation of privacy in the work computer. Courts also look at whether the employer had a written policy that gave employees notice of monitoring.
Monitoring an Employee’s Personal Computer
A potential question also arises when employers allow employees to use their own personal equipment at work. In United States v. Barrows (2007), an employee brought his personally owned laptop computer to work, which he connected to his employer’s network. He used the computer at work in an open workspace area and did not password-protect his computer. While he was away from his desk, another employee accessed his computer and found illegal materials.
The Tenth Circuit Court of Appeals held that the employee did not have a reasonable expectation of privacy in his personal computer.34 There was no expectation of privacy because he had connected the computer to his employer’s computer network. The court also said the employee had no expectation of privacy in the machine because he used it in an open area, left it on when he was not using it, and took no steps to password-protect the machine.
Off-Duty Computer Monitoring
Computer use and internet monitoring create individual privacy concerns. For example, internet monitoring can be invasive. People use the internet to research many things, and sometimes very sensitive things. An employer who monitors internet use might inadvertently learn very personal things about an employee.
Another privacy concern is the monitoring of an employee’s off-duty internet activity. Employers can easily search the internet for information related to potential and current employees. They can view employee postings on blogs, web pages, or email lists, as well as comments made in response to media articles.
Many large employers have fired employees for online comments made on their own time when those comments are related to the employer’s business. Often the employer is most worried about social media posts that could harm the employer’s reputation. For example, in 2004 Delta Airlines fired a flight attendant for pictures that she posted on her personal website. The flight attendant was wearing her Delta Airlines uniform in the posted pictures. She later sued Delta for firing her. The case was ultimately settled, but the terms are confidential.
NOTE
A majority of states limit the ability of an employer to fire an employee for off-duty activity. Most of these laws deal with activities such as alcohol or cigarette use. These laws state that an employer cannot fire an employee for use that was both off-duty and away from the employer’s premises.
Video Surveillance Monitoring
Employers may want to use video surveillance to monitor their employees. They can use video surveillance to protect against workplace theft, as well as protect workplace safety and monitor productivity.
Workplace video surveillance monitoring generally is allowed if employees are given notice. Employers must have a legitimate business reason for the surveillance. Employers must not use video surveillance to monitor places where employees have a reasonable expectation of privacy. Areas considered private include restrooms, employee lounges, or private offices. Employers must be careful when using hidden video surveillance, because it can be a privacy violation if the person under hidden surveillance has a reasonable expectation of privacy in the area under surveillance.
Some states have laws that set limits on what employers may videotape, and employers can run into complications with federal and state wiretapping laws if video surveillance also includes audio recording. Audio recording can trigger the wiretap acts.
Special Rules for Public Employees
Some special rules exist for workplace monitoring of public employees. Public employees are employees that work for the federal, state, or local government. Individuals in public employment have some extra privacy protections because their employer is the government. The federal constitution protects individuals from interference by the government. State employees have similar extra protections because of rights provided in state constitutions.
Workplace Monitoring and Employee Privacy
In City of Ontario v. Quon (2010), the U.S. Supreme Court overturned a federal appeals court holding that an employee’s privacy rights are violated if his employer reads personal text messages sent on an employer-provided device.
In the case, a California police officer was provided with an employer-issued pager. The police department had a general computer, internet, and email use policy that stated the use of the equipment was limited to city business. The police department did not have a formal policy about text messaging. Officers were told that text messages sent on the pager would not be reviewed so long as the officers reimbursed the department for charges that went above the service contract amount.
The police officer, in this case, was a heavy user of the pager. He always paid the police department for the excess use amounts. Eventually, the police department decided to audit pager use to determine whether the basic service contract amount needed to be increased.
The police department requested transcripts of the text messages sent from the pagers, which the pager service provider gave the police department. The department reviewed the transcripts of the police officer’s text messages. The police officer sued, stating that reading the messages violated various federal laws and his right to privacy.
The Ninth Circuit Court of Appeals said that the police officer had a reasonable expectation of privacy in the text messages sent from his pager. The court based its decision on the fact that the department said there would be no review of pager text messages. The police department appealed that ruling.
In June 2010, the U.S. Supreme Court ruled that reviewing the police officer’s text messages did not violate federal law or the police officer’s privacy rights. The Court held that the police department’s audit of pager use was not intrusive and was for a legitimate purpose. The Court also found that the police officer did not have a reasonable expectation of privacy in the text messages.
Although this case deals with a public employee, it does help provide clarity for all employers on the acceptable limits of electronic communications monitoring. One thing that the case does help highlight is that all employers must have very clear policies on the use of electronic communication devices. You can read the Supreme Court’s decision in this case at http://www.supremecourt.gov/opinions/09pdf/08-1332.pdf.
The Fourth Amendment protects federal employees from unreasonable government search and seizure. Therefore, the federal government must provide employees with notice if it intends to monitor the electronic communications of its employees. Even though the government might have to take additional steps to make sure that employee monitoring is legal, courts have recognized the government’s right to engage in workplace surveillance for legitimate business reasons.
Workplace monitoring continues to be a sensitive issue for both employers and employees. Employers typically win legal challenges against workplace monitoring practices, especially if the monitoring is for a legitimate business purpose. To protect their own personal privacy, employees must assume that equipment provided by their employers is for work activities only. Employees should not engage in personal computer and internet activities on an employer’s computer if they wish to protect their privacy.