Tuesday, October 22, 2013

Policies on Personal Use of Company-Issued Electronic Communication Devices

Policies on Personal Use of Company-Issued Electronic Communication Devices
10/21/2013 by Gerard Morales, Joshua Woodard - Snell & Wilmer L.L.P

Many employers permit their employees to access personal accounts from company-issued electronic communications devices. They also permit employees to use their personal devices for work. Those rules are both convenient for the employee and efficient for the employer, as they make it unnecessary for the employee to carry separate devices for business and personal use. 
It is the nature of everyday business that disputes arise with respect to the content of communications between the company’s employees and customers, vendors, etc. Therefore, employers often have legitimate business reasons to access communications in company-issued devices and/or on employees’ personal devices which are used for work. Access to those communications often resolves a dispute. Clearly, said communications constitute pivotal evidence in the defense of formal claims.


The SCA

The Stored Communications Act, 18 U.S.C. § 2701 (“SCA”), prohibits intentionally accessing “without authorization a facility through which an electronic communication is provided.” Violations can result in equitable relief, damages, reasonable attorneys’ fees and litigation costs. 
Importantly, the SCA defines “electronic storage” as: Any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and Any storage of such communication by an electronic communication service for purposes of backup protection of such communication.

Recent SCA decision

In a recent decision, the United States District Court in Ohio[1] recognized the right of a former employee of a leading wireless communications company (“Company”) to maintain a suit under the SCA, alleging that her supervisor and Company violated the SCA when the supervisor accessed her personal emails, without her consent, on a Company-issued BlackBerry™. It was undisputed that the employee had been told by Company that she could use Company-issued BlackBerry™ for personal emails. When she quit her job, she returned the BlackBerry™ to Company, in accordance with Company’s policy of “recycling” the phones for use by another employee. 
The employee negligently failed to delete her personal Gmail™ account from the BlackBerry™, before returning it to Company. She had never expressly consented or authorized her supervisor or anyone at Company to access her emails.

Negligence is not implied consent

The court rejected Company’s defense that the employee’s negligence in failing to delete her Gmail™ account from the BlackBerry™ amounted to an “implicit consent” to access her emails for purposes of the SCA. The court emphasized that, “Negligence is, however, not the same as approval, much less authorization. There is a difference between someone who fails to leave the door locked when going out and one who leaves it open knowing someone is stopping by.” 

Vicarious liability

The court had no problem in finding Company vicariously liable. The supervisor who had accessed the employee’s emails was acting within the scope of his employment and in furtherance of Company’s interests. 

The need for policies on access

The court decision makes it clear that employers need to have clear written policies which give them the right not only to monitor, but also to access private messages in electronic communication devices provided by the employer and on employees’ personal devices which are used for work. 
Often, the handbook policies simply inform the employee of the employer’s right to monitor the communications and/or that they should not have an expectation of privacy regarding the communications in said devices. That is not enough.

Conclusion

While adequate authorization from the employee provides a complete defense to an SCA claim, inasmuch as the SCA prohibition is with respect to intentional access without authorization, the policy must be precise and clear. The employee must understand that if the employee uses the same device for work and for personal accounts, the employer can access all communications in said device. It is not sufficient to inform the employee that the employer has the capability of monitoring the communications. Such notices do not constitute implied consent to the employer’s access to the communications. Pointedly, the court stated, “Random monitoring is one thing; reading everything is another.” 
[1]Sandy Lazette v. Chris Kulmatycki, et al., 3:12-CV-2416 (N.D. Ohio, 2013). [back]



No comments:

Post a Comment