by Jerome Coenic-Taylor

It seems almost inevitable that employees with Internet access via work-issued computers will use that access for personal reasons at some point during the work day. One of the most common things that employees do is log into their personal e-mail accounts to read and send e-mails. But have you expressly informed your employees through your employee handbook or company’s website about your e-mail policy? Better yet, does your company even have an e-mail policy, and if so, does it address employees’ personal e-mail accounts?

Although employees using work time to send personal e-mails is nothing new, the issue has taken on a new importance for employers and the courts because a number of employers have attempted to discover employee’s personal e-mails in litigation on the theory that e-mails made on work-issued computers and via company-provided Internet access are not private or confidential. But as with all developing areas of law, the courts have grappled with these questions of confidentiality and have come to different results. On one end of the spectrum, courts have held an employee communicating via e-mail on a work computer and via work-provided Internet access could destroy the confidentiality of the communication. On the other end, other courts have held that if the employee has a reasonable expectation that the communication would remain confidential, and takes measures to maintain the privilege, the communication remains privileged.

Although this area of law is still developing, some courts have set forth guidelines for determining whether such employee communications remain private. For example, a federal court in the Southern District of New York developed a four-factor test to evaluate claims of privilege for e-mails sent from or through an employer device or system:

1. Does the employer maintain an e-mail policy banning personal or other objectionable use?

2. Does the employer monitor the use of the employee’s computer or e-mail?

3. Do third parties have a right to access the computer or e-mails?

4. Did the employer notify the employee, or was the employee aware of the use and monitoring policies?

The most determinative of these factors was whether the employee was using a work e-mail account, or a password-protected personal e-mail account.

Some courts have held that employees have a reasonable expectation of privacy with respect to e-mails sent to or from an attorney via a personal e-mail account, such as a Yahoo!, Hotmail, or Gmail account, from a work computer. In one case, Strengart v. Loving Care Agency, Inc., 201 NJ 300 (2010), an employer sought to gain access to e-mails sent by a (soon to be) former employee who communicated with her attorney about suing her (then) employer. Her e-mails were sent from her personal e-mail account, but on her company-issued computer and via the company’s provided Internet access. Ultimately, the New Jersey Supreme Court held that the communications were confidential and privileged, in large part because the company’s computer policy did not expressly reference personal e-mail accounts, and thus the employee did not have express notice that the e-mails sent or received from her personal account were subject to monitoring.

Conversely, other courts have held that privilege did not exist. A federal district court in New York, for example, in In re Reserve Fund Securities and Derivative Litigation, 2011 WL 2039758 (S.D.N.Y. May 23, 2011), held that although the communication between a husband and wife would normally be protected by what courts refer to as the “marital privilege,” because the husband’s e-mails to his wife were stored on the company server and sent using a company computer over the company e-mail system, the court deemed that the husband had waived the marital privilege. In that case, the SEC sought production of a series of e-mails sent between the Vice President of the Reserve Management Company and his wife in the two days following Lehman Brother’s declaration of bankruptcy. The company’s e-mail policy expressly prohibited employees from using any e-mail account other than the company’s while on the company premises and provided that employees “should limit their use of the e-mail resources to official business.” The policy also instructed that if employees receive personal e-mails to their work e-mail account, they should delete and remove them regularly. Based on the policy, the court held it was clear that the employee should not have had an expectation of privacy for any e-mail communications. Thus, the communications were not privileged.

In light of the division among the courts regarding whether employee communications sent from a work issued device are privileged or not, employers should take the following into consideration:

• Consider providing your employees with a written e-mail policy that expressly states the company’s position on personal e-mails being sent while at work;
• Weigh the pros and cons of prohibiting all access to personal e-mail accounts or whether some use will be permitted. Consider the practical effect on employee morale of any policy that either outrightly prohibits personal e-mail access or states that employees are to have no expectation of privacy in personal communications made from a company-issued electronic device;
• If your computer server can and/or does capture employee e-mails sent from personal e-mail accounts, consider giving employees express notice of this;
• When drafting an e-mail policy, keep in mind that the more explicitly you put your employee on notice that personal e-mails, or even use of work-issued computers to access one’s personal account, may not be private, the more likely it is that a court will find that the employee had no expectation of privacy or confidentiality. Conversely, the more security/privacy you give your employees regarding their work-related e-mail (e.g. password protection), the more likely it is that a court will find a reasonable expectation of privacy. If the employer has a policy which prohibits the use of their computers for personal matters, the privilege may be deemed to be waived; and
• When drafting an e-mail policy, keep in mind that courts will hold companies accountable to their policies and may rely heavily on the representations made (or what is omitted) when determining such things as whether an employee had notice their personal e-mails would be monitored or an expectation of privacy was created. For instance, if the policy provides for some allowance of personal use of company-issued electronic devices, courts will more likely presume that the given communication at issue was permissible, or at least consistent with the e-mail policy.

Employers should realize, however, that courts are evaluating these issues on a case-by-case basis. Thus, no matter how well-drafted an electronic communications policy may be, there is no guarantee that it will provide an employer access to an employee’s personal communications in litigation. However, providing employees clear guidance as to which communications are considered by the employer to be private will at least place a company on firmer ground when arguing that a particular e-mail should be discoverable in ligitation or admitted into evidence at a proceeding. Further, it puts employees sufficiently on notice, so that they can take appropriate measures to protect their privacy and thus avoid the issue altogether.