Until recently, the idea of a lawsuit or termination review in which every previous conversation within a company was recorded and made available for introduction into court was unimaginable. Before the wide-spread use of electronic mail (e-mail) and other forms of electronic data recording and communication, companies often relied upon the limited contents of individual employee files to support employee terminations or justify disciplinary action. Today, any internal investigations begin with the employee's computer and e-mail system.
New technologies allow employers to monitor many aspects of their employees' activities on employer-provided computer systems. However, such monitoring of employee computer terminals, stored data and electronic mail is largely unregulated, although pending court cases are considering employees' rights to privacy regarding such electronic data. Employers contend that unless written company policy provides otherwise, an employer may read and recover data from any computer or network provided by the employer. Employee advocates maintain that an employee has a reasonable expectation of privacy over such information unless specifically and properly advised in writing though an employment contract, manual or other adequate means of written notification.
Random Monitoring vs. Specific Purpose
The law is particularly unsettled regarding an employer's right to random computer monitoring absent sufficient and proper written notification of such monitoring. Some states, including California, recognize employee privacy rights in the workplace where a reasonable expectation of privacy exists.(1) Government employees may also have some minimal rights under the Federal Constitution, in particular the Fourth Amendment, which safeguards against unreasonable search and seizure. Under these circumstances, random monitoring and data retrieval by the employer may be improper.
In states where the law does not specifically provide for such employee privacy rights, private employers are arguably free to monitor their employees' activities on employer-owned computer networks and terminals. This is provided that the employer has not specifically limited its rights to randomly monitor though written policy or contracts. Some union contracts or language contained in employee handbooks or manuals, for example, may limit the employer's right to monitor without notice.
However, Federal Law under the Electron Communications Privacy Act of 1986 (ECPA) prohibits the interception of e-mail transmissions.(2) While the ECPA does not specifically prohibit an employer from randomly monitoring employee e-mail, the ECPA does not specifically exempt employers from regulation either. To date, there are no court decisions on record that address employer's rights and prohibitions under the ECPA in regard to random monitoring and interception of employee e-mail and other computer data in the normal course of business.
It is advisable, if not mandatory, that employers provide clear written notification of their right and intent to randomly monitor, read and intercept data from workplace computer networks and terminals. This information should be communicated through employee manuals drafted in consultation with counsel, and supplemented with memoranda and computer interface messages displayed each time an employee boots his or her employer-provided computer.
The law is more defined in cases when an employer can demonstrate a specific and legitimate purpose in searching and recovering data from an employee's computer drive and intercepting e-mail messages made in the ordinary course of business. The ECPA permits employers to monitor and intercept an employee's cellular, wire or electronic communications on employer-provided systems when such monitoring is necessary for the protection of the rights or property of the employer.(3) Even states that favor employee privacy interests recognize that in given circumstances employers may conduct reasonable workplace searches as a necessary means incident to the protection of its rights and property, or in furtherance of other countervailing interests of the employer.(4) A recent decision under the ECPA found an employer's monitoring of an employee's cellular phone conversations on an employer-provided phone to be proper where the employer demonstrated a reasonable suspicion of illegal cloning activities by the employee.(5) Analogies may be drawn to the monitoring of e-mail messages to and from an employee reasonably suspected of theft of company trade secrets or other confidential information.
With these concepts in mind, it is critical that companies develop and maintain procedures and guidelines for internal investigations in order to establish the integrity and fairness of the process, and to ensure that the basis and justification of the investigation are properly memorialized and documented. Employers should establish written policies and procedures governing internal investigations. Additionally, new computer data recovery software enables data to be efficiently obtained while establishing an indelible record of the scope, methodology, purpose and chain of custody of the recovery effort, thereby establishing a concise record and verifiable methodology of the investigation.
Unless proper protocol and procedures are established, evidence gathered in the course of internal investigations may be excluded from consideration in court if the employer cannot demonstrate adequate cause and justification in the procurement of the evidence. Worse, an employer may even be subjected to liability in some cases. However, the establishment of proper guidelines and procedures and the utilization of the right software provide an excellent line of defense of the integrity of the investigation.
1. California Constitution, Article 1, section 1; Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1
2. 18 U.S.C. 2510, et seq.
3. 18 U.S.C. § 2511(2)(a)(i)
4. Hill v. National Collegiate Athletic Assn., supra, 7 Cal.4th at pp. 39-40
5. United States v. McLaren, 957 F.Supp. 215 (M.D. Fla 1997)
John Patzakis is a partner in the law firm of Corey & Patzakis and practices business law. He can be reached at LAattorney@aol.com. © Copyright 1998—.