10/21/2013 by Gerard Morales, Joshua Woodard - Snell & Wilmer L.L.P
Many employers permit their employees to access personal accounts from company-issued electronic communications devices. They also permit employees to use their personal devices for work. Those rules are both convenient for the employee and efficient for the employer, as they make it unnecessary for the employee to carry separate devices for business and personal use.
It is the nature of everyday business that disputes arise
with respect to the content of communications between the company’s employees
and customers, vendors, etc. Therefore, employers often have legitimate
business reasons to access communications in company-issued devices and/or on
employees’ personal devices which are used for work. Access to those
communications often resolves a dispute. Clearly, said communications
constitute pivotal evidence in the defense of formal claims.
The SCA
The Stored Communications Act, 18 U.S.C. § 2701 (“SCA”),
prohibits intentionally accessing “without authorization a facility through
which an electronic communication is provided.” Violations can result in
equitable relief, damages, reasonable attorneys’ fees and litigation
costs.
Importantly, the SCA defines “electronic storage” as: Any temporary, intermediate storage
of a wire or electronic communication incidental to the electronic transmission
thereof; and Any storage of such communication by
an electronic communication service for purposes of backup protection of such
communication.
Recent
SCA decision
In a recent decision, the United States District Court in
Ohio[1] recognized the right of a former employee of a leading
wireless communications company (“Company”) to maintain a suit under the SCA,
alleging that her supervisor and Company violated the SCA when the supervisor
accessed her personal emails, without her consent, on a Company-issued
BlackBerry™. It was undisputed that the employee had been told by Company
that she could use Company-issued BlackBerry™ for personal emails. When
she quit her job, she returned the BlackBerry™ to Company, in accordance with
Company’s policy of “recycling” the phones for use by another employee.
The employee negligently failed to delete her personal
Gmail™ account from the BlackBerry™, before returning it to Company. She
had never expressly consented or authorized her supervisor or anyone at Company
to access her emails.
Negligence
is not implied consent
The court rejected Company’s defense that the employee’s
negligence in failing to delete her Gmail™ account from the BlackBerry™
amounted to an “implicit consent” to access her emails for purposes of the
SCA. The court emphasized that, “Negligence is, however, not the same as
approval, much less authorization. There is a difference between someone
who fails to leave the door locked when going out and one who leaves it open
knowing someone is stopping by.”
Vicarious
liability
The court had no problem in finding Company vicariously
liable. The supervisor who had accessed the employee’s emails was acting within
the scope of his employment and in furtherance of Company’s interests.
The need
for policies on access
The court decision makes it clear that employers need to
have clear written policies which give them the right not only to monitor, but
also to access private messages in electronic communication devices provided by
the employer and on employees’ personal devices which are used for work.
Often, the handbook policies simply inform the employee of
the employer’s right to monitor the communications and/or that they should not
have an expectation of privacy regarding the communications in said
devices. That is not enough.
Conclusion
While adequate authorization from the employee provides a
complete defense to an SCA claim, inasmuch as the SCA prohibition is with
respect to intentional access without authorization, the policy must be precise and clear. The employee
must understand that if the employee uses the same device for work and for
personal accounts, the employer can access all communications in said
device. It is not sufficient to inform the employee that the employer has
the capability of monitoring the communications. Such notices do not
constitute implied consent to the employer’s access to the
communications. Pointedly, the court stated, “Random monitoring is one thing; reading
everything is another.”
No comments:
Post a Comment