Have you unwittingly violated the Stored Communications Act (SCA), a federal law enacted as part of the Electronic Communications Privacy Act of 1986? The SCA establishes a criminal offense for whoever “intentionally accesses, without authorization, a facility through which an electronic communication service is provided.” In other words, the SCA protects the privacy of electronic communications while in electronic storage (for example, emails stored on an electronic server). Under the SCA, violators can be sued criminally and civilly.
As it pertains to employers, the SCA has been interpreted to allow employers to access communications stored on their own wire or electronic communications services (for example, employer-provided email service) so long as the access is authorized under the employer’s own policies, and the employer has a valid business purpose for doing so. That interpretation even applies in situations in which the employee considers such messages to be private. Additionally, even if an employer does not require employees to sign an “electronic communication in the workplace” policy, they still likely have the legal right to read employee email messages transmitted through company email accounts.
But what about situations in which an employee uses a personal email account on an employer-provided device? Typically, in these instances, courts have held that an employer cannot access employees’ private, personal email account communications. Other courts, however, have held that employers may monitor personal email accounts if the employee is using employer-provided technology and has consented in writing to a broad policy that allows for the monitoring of all computer use. Of course, the answer to this developing legal topic will vary court-by-court and state-by-state. In the interim, employers may consider addressing the monitoring of emails on employer-provided devices with the following in mind:
• Just because employers are legally allowed to monitor emails in some circumstances does not mean they should, or that it is a best practice. Remember that, in most instances, personal email use on work technology is common and harmless.
• Consider drafting a policy or amending a pre-existing policy notifying employees that their use of the company-provided technology may be monitored and that employees have no expectation of privacy on the employer’s technology.
• Hold a frank discussion with employees regarding the nature and extent of email monitoring and the reasons for its implementation.
