Whose E-mail Is It Anyway?

As they have in many other areas of life, the Internet and e-mail have raised nettlesome issues concerning the scope of workplace "privacy." Can an employer consent to a government search of the contents of an employee’s computer, or must the government obtain a search warrant to do so? If an employee emails his attorney from a work computer, is the e-mail protected by the attorney-client privilege, or has the privilege been waived? How a business drafts and implements its Internet usage policy may well determine the degree of privacy its employees enjoy in their e-mails.

As Justice Stevens put it, "it would be foolish to contend that the degree of privacy secured to citizens by the Fourth Amendment has been entirely unaffected by the advance of technology." Kyllo v. United States, 533 U.S. 27 (2001). Indeed, the courts increasingly are being asked whether an employee has an expectation of privacy in a workplace computer sufficient to suppress evidence retrieved from the computer in violation of the Fourth Amendment to the U.S. Constitution. See, e.g., United States. v. Ziegler, 474 F.3d 1184 (9th Cir. 2007); United States v. Simons, 206 F.3d 392 (4th Cir. 2000). A defendant may invoke the protection of the Fourth Amendment only if the employee had a legitimate expectation of privacy in the workplace computer and the images and e-mails stored on that computer. The employee bears the burden of showing both a subjective expectation of privacy and an objectively reasonable expectation of privacy. The subjective expectation of privacy is relatively easy to prove by showing, for example, that the employee used an individual log-in and password to gain access to the computer.

However, showing that the employee’s expectation of privacy in a workplace computer is objectively reasonable poses a greater difficulty. Courts use the following factors to determine whether an employee has an objectively reasonable expectation of privacy:

• Whether the employer has complete administrative access to employee computers;
• Whether third parties have access to the computer/e-mail;
• Whether the employer regularly monitors Internet access;
• Whether e-mail traffic is monitored by the employer; and
• Whether employees are informed through training or an employment manual that computers are not to be used for personal activities.

In Simons, one of the most widely cited computer privacy cases, the Fourth Circuit held that an employee had no expectation of privacy in pornographic images obtained from the Internet and stored on his office computer. The court reasoned that there could be no expectation of privacy where the employer’s Internet-usage policy required employees to use the Internet only for official business, the employer informed employees that employee usage of the Internet was electronically audited, the employer’s information technology department had unfettered access to employee computers, and employees were informed through training and employment manuals that the company’s computers were not for personal use.

Moreover, in the age of telecommuting or working "remotely" from home, employees may not have a reasonable expectation of privacy in a personal computer that is used in the office, when the employee hooks the personal computer up to the employer’s network for file sharing and the computer is not password protected. See United States v. Barrows, 481 F.3d 1246 (10th Cir. 2007). The fact that the employee owns the computer is not enough to demonstrate a subjective expectation of privacy or to make that expectation reasonable.

In short, if there is no reasonable expectation of privacy, an employer may consent to the search of an employee’s workplace computer because the computer is considered workplace property, "even if the employee has placed personal items in [it]." See O’Connor v. Ortega, 480 U.S. 709, 716 (1987).⁽¹⁾

On the other hand, in cases where courts have found that a reasonable expectation of privacy in a workplace computer exists, the employer had no Internet-usage policy and/or failed to routinely search employee computers or monitor Internet and e-mail usage. For example, in Leventhal v. Knapek, the Second Circuit held that the employee had a reasonable expectation of privacy in the contents of his office computer because he occupied a private office with a door, the computer was in his office, he did not share use of his computer with other employees, and the employer neither had a general practice of routinely conducting searches of office computers nor placed the employee on notice that he should have no expectation of privacy in the contents of his office computer.

However, at least one court has found that, even where an employer’s computer system is monitored, the specific language of the monitoring policy and the actions of the employer determine whether an employee has an objectively reasonable expectation of privacy. In U.S. v. Long, the Court of Appeals for the Armed Services found that the defendant had an expectation of privacy in e-mails sent and received on a government computer because the employer had a practice of recognizing the privacy interests of its users in their e-mail, the employer performed computer system maintenance without monitoring e-mails, and the monitoring policy stated that it was to "monitor the computer system, not to engage in law enforcement intrusions by examining e-mails unrelated to maintenance of the system." United States v. Long, 64 M.J. 57 (Armed Services Ct. App. 2006).

Another emerging issue, which has not been litigated nearly as much as Fourth Amendment search issues, is whether the attorney-client privilege is waived when an employee uses a company e-mail system to communicate with a personal attorney. Such communications may be privileged if the employee possesses a subjective expectation of confidentiality that is found to be objectively reasonable. Even though this area of law is not yet well developed, courts appear to apply the same standard that is used in the Fourth Amendment cases described above.

The leading case is In re Asia Global Crossing, Ltd., 322 B.R. 247 (Bkrtcy. S.D.N.Y. 2005). There the court determined that use of a company’s e-mail system by an employee to send personal e-mails to the employee’s counsel did not, without more, waive any attorney-client privilege in such communications. The factors that the court considered were exactly the same as those factors used by the courts in the Fourth Amendment privacy cases—whether an e-mail is privileged depends on the company’s e-mail policies regarding use and monitoring, its access to the e-mail system, and the notice provided to employees.

The considerations used to determine whether e-mails on a home office computer that is used for company business are privileged are the same. The court in Curto v. Medical World Communications, Inc., 2006 WL 1318387 (E.D.N.Y. 2006), relying on Asia Global, determined that an employee had not waived her right to assert the attorney-client and work product privileges concerning documents retrieved from her company- owned laptop because the computer was not connected to the employer’s server and was not located in the employer’s offices. The court reasoned that the employer was not able to monitor the employee’s activity on the home-based computer or monitor e-mails at any time.

* * *

Although questions regarding whether e-mails are privileged or protected by the Fourth Amendment are relatively new and will continue to be litigated, an employer likely may disclose an employee e-mail to the government in cases where the communications violate the employer’s computer-use policy, the employer has administrative access to the employee’s computer, and the employee was informed through training or an employment manual that the workplace computer is not to be used for personal activities.

⁽¹⁾ Public employer searches for noninvestigatory, work-related purposes and investigations of work-related misconduct are not subject to the requirements of the Fourth Amendment. O’Connor v. Ortega, 480 U.S. 725-26. Such a search is legal so long as it is "justified in its inception" and "reasonably related in scope to the circumstances" that prompted the search. The special needs of government employers in conducting workplace searches in connection with investigations of work-related misconduct outweigh a public employee’s expectation of privacy. Leventhal v. Knapek, 266 F.3d 64, 73 (2d Cir. 2001).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.