Monitoring Employee Email

By Peter J. Preston

The problems your company might nip in the bud through looking at your employees' email are easy to see: the spread of a virus; offensive jokes; fraudulent schemes; gambling; harassment; and disloyal conduct can all be spotted and addressed if a company watches what its employees say via email. The question, though, is whether monitoring company email to avoid legal problems will in turn get you into legal trouble with your employees. Generally speaking, reviewing employee email is not against the law, but you should not be doing so contemporaneously with the sending and receipt of the messages, and you should let your employees know you're doing it.

Federal Law Allows Employer Review of Employee Email

Looking through old emails on your company's equipment does not violate the ECPA.

The federal law that applies to workplace monitoring of email is called the Electronic Communications Privacy Act ("ECPA"). Among other things, the ECPA prohibits "intercepts" of electronic communications, including email. Federal courts interpreting this part of the ECPA have said that companies do not "intercept" an email as that term is used in the ECPA by searching through emails stored on the company server. In other words, looking through old emails on your company's equipment does not violate the ECPA. A system in which emails are watched in real time, as they come in and go out, may not fit within this analysis and should be used with caution.

One recent case illustrates how the ECPA applies to workplace email. In Fraser v Nationwide Insurance, an insurance agent, who used the email system provided by the company he represented, was suspected of being disloyal. The company had learned of two letters the agent wrote to competitors inquiring about moving his customers to them. A search of the agent's emails that resided on the company's file server confirmed his disloyalty and his contract was terminated. He sued, claiming a number of things, including violations of his rights under the ECPA. Because the company had searched its old files for email to and from the agent - as opposed to monitoring them as they were sent and received - the court ruled that no "intercept" had occurred.

The agent also claimed the company violated another part of the ECPA that prohibits anyone from accessing electronic communications that are in electronic storage, including backup storage, without authority. The court readily rejected that argument, too, given the exception that the ECPA makes for those who provide the communications service. In this case, as in most workplaces, the employer provides the service, and thus is "free to do as [it] wish[es] when it comes to accessing communications in electronic storage."

Other Legal Considerations

While it is nice to know you are complying with federal law when you look at employees' email that is not the end of the story. Each state has its own laws that may apply, both in the form of statutes passed by the legislature and in judge-made law. For example, in the Fraser case discussed above, the agent also tried to allege a claim for invasion of privacy under state law, but he was too late in raising that claim. Some of those laws are tougher, and require more from an employer, than the ECPA. This article does not attempt to describe each state's laws on the topic, and any smart business owner will seek advice from an attorney licensed in his or her state, but some general principles are worth considering:

Be Upfront About Email Policies

Tell your employees you reserve the right to monitor their email communications.

Tell your employees you reserve the right to monitor their email communications, because they are using company-provided equipment to send and receive email. Most state law claims arising from employers looking at email assert the employee's privacy was infringed or invaded. How strong such a claim is will turn, in part, on whether the employee had a legitimate expectation of privacy in the first place. If employees are told in writing, through a policy handbook or periodic memos, that the company may review their emails at any time, it will be much harder for the employee to prove she had an expectation of privacy. Plus, telling your employees that their email is fair game is the honest thing to do, and may also have a deterrent effect in the first place.

Have a Purpose

Be reasonable in what you monitor.

Be reasonable in what you monitor. You will save company time and money if you only look into employee email when you have a good reason. In addition, you will be on the safest legal ground when you limit email searches to instances in which you have a reasonable suspicion, like the company had in the Fraser case after learning the agent was drafting letters to competitors.

Deter False Confidence

Don't give your employees reason to believe their email is private. Be clear with your employees that there are no circumstances in which your company will consider employee email to be anything but company property.

Don't give your employees reason to believe their email is private. This is a corollary to the first point above. Most email clients today allow a sender to mark email messages as "confidential" or "private." Be clear with your employees that there are no circumstances in which your company will consider employee email to be anything but company property. Employees may expect their "personal" email is confidential if it has nothing to do with their job, but you have to be sure your workers know that is not the case.

If your company is providing email accounts for your employees, and you tell the employees that the company may monitor email and they should not have any expectation of privacy in their workplace emails, your company will likely be on the right side of the law. Be sure, however, to consult with a lawyer in your state to learn of any variations your state might impose.



Peter J. Preston is an attorney at the Chicago office of Sedgwick, Detert, Moran & Arnold LLP.

© 2003 Sedgwick, Detert, Moran & Arnold LLP. This communication is made available with the understanding that it does not constitute the rendering of legal advice or other professional service. Statement in Compliance with Texas Rules of Professional Conduct: Unless otherwise indicated in individual attorney biographies, lawyers resident in the firm’s offices are not certified by the Texas Board of Legal Specialization.