Suppose you suspect that some of your employees are exposing proprietary information online. To either confirm or refute your suspicions, you would like to keep a closer watch on proceedings through electronic means. But is it legal? In other words, are you invading the privacy of employees through your snooping?

The answer isn’t simple. It is relatively safe to say that the legislation in this area has not kept up with technology. The primary applicable federal statute, the Electronic Communications Privacy Act (ECPA), was enacted back in 1986 (although it has been modified since then). The law has also been coordinated with the USA PATRIOT Act.

The ECPA was initially intended to govern third-party interceptions of electronic communications. It imposes civil and criminal penalties on anyone who intentionally intercepts, uses or discloses wire, oral or electronic communications. For this purpose, an “electronic communication” is defined as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photo electronic or photo optical system that affects interstate or foreign commerce.” Thus, this legislation appears to have a wide application in the current business environment.

Under the ECPA, an employer may be able to monitor electronic communications if the monitoring occurs in the ordinary course of business or it has the implied consent of employees. On the other hand, state law may provide greater protection for employees.

For instance, some states recognize a right of privacy that includes the right to be free from physical or electronic intrusions into a person’s private affairs. But note that state law can vary widely in this area. As a result, employers should be cautious and conservative when monitoring employee e-mail.

Before an employer begins to conduct surveillance of employees, it should ask these questions:

1. Is the surveillance necessary in pursuit of a valid business purpose? If an employee is reasonably suspected of theft or other wrongdoing, the surveillance may be justified. Conversely, indiscriminate surveillance without a business purpose is difficult to justify and may be illegal.
2. Is the type and extent of surveillance the minimum needed to achieve the business purpose? Assuming the surveillance is necessary, it may be considered an invasion of privacy if it is excessive or unnecessarily intrusive.
3. Have employees been warned of the possibility of surveillance? If no warnings have been provided, a court may determine that the employee had a reasonable expectation of privacy that was invaded by the employer.

The laws relating to electronic communications are still evolving. Consult with your legal and business advisers concerning specific applications of the law.

At Lewis, Hooper & Dick, LLC, we offer comprehensive services in information technology. Please contact Lori Servis at (620)275-9267.

Back to Issue