1984 IS STILL FICTION: ELECTRONIC MONITORING IN THE WORKPLACE AND U.S. PRIVACY LAW

Abstract

Electronic monitoring in the workplace has been the subject of relentless public criticism. Privacy advocates argue that technological advancements have given overbearing employers powerful tools to abuse employee dignity in the name of productivity and that new legislation should bolster workplace privacy rights. This iBrief contends that current U.S. legal doctrine governing electronic monitoring in the workplace is fair given the nature and purpose of the workplace, and potential employer liability for employee misconduct.

Introduction

¶          Technology continues to make the world a smaller place; it is easier to keep in touch with people than ever before. This is not an entirely positive development, however. The ease with which individuals' personal information may be recorded, documented, identified and produced is a controversial issue. For example, significant debate has centered on the Federal Bureau of Investigation's Carnivore Project which has the capacity to monitor millions of electronic communications worldwide.² Even the use of traffic cameras to monitor public intersections, where no one has an expectation of seclusion, is to some an invasion of privacy.³

¶          This debate is especially intense in the context of electronic monitoring in the workplace.⁴ Should employees have a right to Internet access free from employer supervision? In the United States, the law has not recognized a strong right to privacy for employee Internet use. This reality has driven many to argue for a reallocation of legal rights. Some assert that employees' privacy rights in the work place should be bolstered with additional statutory protections to preserve employees' sense of dignity.⁵ Others seek the development of an entirely new privacy regime.⁶ 

¶          This iBrief argues that changing the law governing workplace privacy is unnecessary. The current law in this area is sufficiently dynamic to incorporate technological advances and represents an equitable distribution of the legal rights and obligations of all parties concerned. Although employees have little legal protection while perusing the Internet or communicating by email at work, this minimal degree of protection is commensurate with the nature and purpose of the workplace and the substantial liability employers face for employee misuse of the Internet. Moreover, employers are unlikely to abuse their monitoring privilege, as it is in their best interest to balance surveillance needs with employee quality of life and because employer misuse of personal information is prohibited by a variety of existing legal doctrines.

I. Employees' Right to Internet Privacy in the Workplace

¶          As currently applied, federal law affords employees little protection from electronic monitoring. Internet monitoring, including local network email monitoring, has been attacked by employees primarily on two theories: first, as an unlawful interception of a wire communication or unauthorized wiretap; and second, as an invasion of privacy.⁷ 

¶          Challenges to electronic monitoring by employers based on unauthorized wiretaps typically fail because the state or federal wiretap statute is inapplicable to email monitoring, or because the particular manner by which employers monitor the communication is outside the scope of the statute.⁸ The statute most frequently at issue has been the 1986 Federal Electronic Privacy Communications Act ("EPCA"). The EPCA does not prohibit interceptions of electronic communications made in the ordinary course of business for the purpose of protecting the rights or property of the network provider, as well as interceptions made with the consent of the sender or recipient.⁹ Thus, those companies that monitor their networks to protect their interests, or do so with employee consent, have a strong argument that they are exempt from federal wire tap regulation.

¶          Invasion of privacy is a more potent ground on which employees object to Internet monitoring. A right of privacy generally extends to employees in the workplace. This right is, however, typically limited to those instances where the matter intruded upon is "intensely private."¹⁰ Thus, where an employer videotapes an employee's medical examination in her office¹¹ or reads personal medical documents on an employee's desk,¹² a jury may be permitted to hear the issue. However, the nature of the workplace is generally a public one and an employee is hired for the purpose of attending to company business, not personal matters. Therefore, courts tend to reject most employees' privacy claims on the basis that there was no reasonable expectation of privacy.¹³

¶          The public nature of the workplace has led many courts to find that no right of Internet privacy exists at work. The Restatement (Second) of Torts declares: "One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person."¹⁴ In applying this standard, courts have most commonly found monitoring of employee Internet use not to be an invasion of privacy for two reasons: first, employees have no reasonable expectation of privacy for communications voluntarily transmitted on an employer's network; and second, even if there were a reasonable expectation of privacy, the intrusion upon seclusion is not highly offensive. The courts have reached similar conclusions even when no notice of employer monitoring was provided to the employee.

¶          In Smyth v. Pillsbury Co.,¹⁵ a federal district court conclusively rejected the argument that email monitoring by the employer constitutes an invasion of privacy.¹⁶ In the case, the employee plaintiff had been assured that the content of monitored emails would remain confidential and would not be used against employees for termination or reprimand, although the employee was advised that the email privilege should not be abused.¹⁷ After the employer reviewed multiple emails that contained offensive commentary about the employer, the employee was terminated for abusing the email privilege by sending too many emails.¹⁸ Granting summary judgment, the court held, "[O]nce plaintiff communicated the alleged unprofessional comments to a second person (his supervisor) over an e-mail system which was apparently utilized by the entire company, any reasonable expectation of privacy was lost."¹⁹ The court also found that the interception of emails was not highly offensive.²⁰ 

¶          Supporting these conclusions, the court emphasized the voluntary nature of the communication and the company's interest in providing a safe work environment.²¹ Because the emails were sent voluntarily, the facts at hand could be distinguished from those cases where employees were required to disclose personal information. Greater scrutiny would be warranted, for instance, when as a condition to continued employment an employee submits to a urinalysis test or search of their personal property.²² In recognizing an employer's substantial liability for employee Internet use, the court further asserted, "[T]he company's interest in preventing inappropriate and unprofessional comments or even illegal activity over its e-mail system outweighs any privacy interest the employee may have in those comments."²³ 

¶          The precedent established by Smyth does not mean that monitoring an employee's Internet use may never be considered an invasion of privacy.²⁴ For example, in another 1996 case, Restuccia v. Burk Technology, Inc.,²⁵ a Massachusetts superior court found that where two employees were not informed that their email could be accessed by others and their computer accounts were protected by individual passwords, a claim of invasion of privacy would survive summary judgment.²⁶ Other cases generally support the holding in Smyth. Even in those instances where no notice was provided to the employee that monitoring would occur²⁷ or when the employee was convinced that the employer provided him space to shelter emails from management's purview, there is not necessarily a reasonable expectation of privacy.²⁸ Where the employee has constructive notice that his or her emails are subject to management's review, courts have unanimously found monitoring not to be an invasion of privacy.²⁹

¶          Therefore, an invasion of privacy claim against an employer for monitoring employee Internet use is unlikely, and is almost certainly proscribed if the employer has given the employee notice.³⁰ This allocation of legal rights, which appears to favor the employer, has been attacked from all sides by commentators concerned about privacy and dignity. The current legal doctrine is, however, entirely fair and reasonable.

II. Monitoring Employee Use of the Internet Is Reasonable

¶          The minimal privacy protection afforded employees is fair and reasonable given the nature and purpose of the workplace, and the substantial liability employers face for employee Internet use.

¶          The workplace is generally not a private place. In the seclusion of one's home there is a well-established and legally protected expectation of privacy from other persons.³¹ However, upon leaving one's private residence and entering premises possessed by another, expectations of privacy are drastically reduced because one occupies property over which one does not exercise complete dominion.³² An expectation of privacy can be otherwise established by contract or substantiated where the premises are intensely private such as a locker room, hotel bedroom, or office restroom.³³ Nevertheless, such cases are the exception rather than the norm. An employer's facilities are predominantly public in nature because they are not directly owned by the employee and they are shared with others.

¶          The lack of privacy in the workplace is particularly justifiable because occupation by an employee of the premises is conditioned on using those premises to achieve employer goals. Employees are provided certain tools by the employer--for instance, a phone, voicemail, email and Internet access--principally because those items help the employee achieve a business objective. It is here, however, that many supporters of increased employee privacy rights make their stand. They contend that the increased productivity demands of the workplace require employees to mingle the personal and the professional, especially when it comes to such items as phone, email or Internet usage, and that the law in this area should recognize such a real workplace dynamic.³⁴ Employees are going to take care of personal business in the office because it is necessitated by circumstance and if the employee can most quickly resolve the personal matter by using workplace resources it also inures to the employer's benefit.³⁵ In such an environment, where employees' handling of intensely private matters results in a benefit to the employer in terms of increased morale and productivity, employees arguably should not be forced to sacrifice their privacy rights.

¶          This argument is valid so long as employees do not abuse the privilege. Unfortunately, the privilege is commonly abused. One recent study found that employees use the Internet 75.5% of the time for their work and 24.5% of time for personal reasons such as reading the news, viewing pornography, day trading and keeping up on sports scores.³⁶ Shirking did not begin with the creation of the Internet, of course. Before the Internet, employees wasted time by the water cooler or in the smoke room. The difference is that those environments were easily monitored without the aid of surveillance software. There is some sense of seclusion in one's use of the Internet because it usually takes place at an individual terminal. However, if an employer is entitled to measure the effort employees put into their work, then monitoring Internet usage should be reasonably expected by all employees and even welcomed by some.³⁷

¶          Employee misuse of the Internet can also result in substantial legal liability for the employer.³⁸ Under the doctrine of respondeat superior, an employer may be held liable for the actions of an employee committed within the scope of employment or in furtherance of the employer's interest.³⁹ While "scope of employment" could be interpreted narrowly, vicarious liability of an employer for the actions of her employees has been and continues to be interpreted broadly.⁴⁰ So long as an employee's wrongful act is closely connected to a work activity, the scope of employment condition is likely met.⁴¹ Even if the employee engages in an activity specifically forbidden by the employer, so long as he was carrying out job responsibilities, the employer will probably be liable.⁴² Thus, an employer will likely be liable in those instances where an employee commits a foreseeably wrongful act during regular business hours in an office provided by the employer.⁴³ This broad interpretation is even more daunting to an employer-defendant because the employer bears the burden of showing that an act was outside the scope of employment.⁴⁴ Therefore, employee claims will often survive summary judgment and exponentially increase the cost and risk of litigation to the employer. Some courts have been more willing to declare that an employee was off on a "frolic of his own" as opposed to acting in the scope of employment; however, for employers seeking to operate safely within the confines of the law, judicial uncertainty favors conservatism and justifies supervision.

¶          The potential for employer liability to third persons arising out of unlawful employee conduct on the Internet is significant. The Internet is a powerful instrument with which employees can commit numerous illegitimate or unlawful acts. Not only can employees communicate with each other beyond the view of managers, they can also communicate with the entire World Wide Web without management's notice. Defamation, public disclosure of private facts, false light, intentional infliction of emotional distress are all causes of action easily satisfied by an employee's publication of information to the web. Trade secrets and patents belonging to a client also are easily ruined by Internet transmission. These causes of action are in addition to spamming, computer fraud and other computer-oriented abuses. Many of these Internet offenses will likely be based upon facts that bring the conduct within the scope of employment. They can be committed during regular work day hours by an employee using the Internet under the auspices of performing work-related tasks, on a network and computer provided by the employer, and it is entirely foreseeable that that these privileges are subject to employee abuse in many different ways.

¶          Moreover, employers are liable in some cases even for those acts committed by its employees outside the scope of employment. Generally, an employer has a duty to ensure a safe working environment and the safety of those who will foreseeably come into contact with its employees.⁴⁵ The doctrine of negligent retention may result in employer liability if an employer knew or should have known that an employee was unfit to carry out his duties.⁴⁶ An employer is also liable for an employee's conduct if that employee used his actual or apparent authority to commit a wrongful act.⁴⁷ Most significantly, violations by employees of anti-discrimination statutes like Title VII of the Civil Rights Act of 1964,⁴⁸ the Americans with Disabilities Act,⁴⁹ and the Age Discrimination in Employment Act⁵⁰ can result in substantial liability for an employer.⁵¹ Title VII involves the greatest potential liability for most employers. While the Supreme Court has found sexual harassment to fall outside the scope of employment, if an act is committed by a supervisor⁵² and involves a "tangible employment action" against the complaining employee such as termination, reassignment with significantly different responsibilities, or a significant change in benefits, a violation will be deemed to have occurred.⁵³ Absent an employer's ability to establish that it took reasonable care to prevent or correct the wrong and that the employee failed to avail herself of the employer's remedial measures, the employer will be held liable for the supervisor's actions and possibly subjected to punitive damages.⁵⁴

¶          Therefore, to the extent that an employee's use of the Internet falls outside of the scope of employment, causes of action may arise for breach of an employer's general duty of care, under the doctrines of negligent retention or actual or apparent authority, or under various statutory sections like Title VII. Negligent retention, in particular, presents an interesting dilemma for employers. An employer may be held liable for an employee's acts if the employer "should have known" what the employee was doing. Therefore, if monitoring an employee's Internet activity is a common and cost efficient method of supervision, the failure to implement such an electronic surveillance system could be used against the employer.⁵⁵ For example, a Wall Street firm was recently fined for failing to monitor instant messages sent between traders.⁵⁶ An employer's general duty of care may also give rise to the same conflict. Title VII claims of harassment and discrimination have already been an area flush with litigation over employer liability for employee emails. Emails are often cited in the complaint and accepted as evidence of harassment and discrimination.⁵⁷

¶          The potential for employer liability to third persons injured by its employee's Internet use is not the limit of damage that can be caused by an employer's failure to monitor electronic activity in the workplace. Great damage can be caused to the employer's own operations. Given their actual or apparent authority, employees may have the ability to bind the corporation to unwanted contracts or be officially quoted by the press on an unapproved topic. Similarly, trade secrets, patents and business models and plans may be distributed without management's notice.

¶          Hence the workplace is more public than private, and most assuredly, it is a place for work. The ease with which the Internet provides employees a mechanism for shirking their responsibilities and engaging in illicit activities warrants employer monitoring of electronic activity. Regulators have recognized that the substantial liability employers bear for their employees' acts requires this supervision. Even the Equal Employment Opportunity Commission specifically recommends that employers closely monitor employee conduct to mitigate their liability for harassment and discrimination.⁵⁸ While some may view monitoring as an intrusion meant to assert even greater control over employees, for most employers Internet surveillance stems from their basic responsibility to ensure a safe workplace for their employees and the public at large. Indeed, employers have a number of incentives to ensure that they do not abuse their right to monitor.

III. Employers Are Unlikely to Abuse Their Right to Monitor

¶          While some commentators take a principled stand and reject all employer monitoring of employee Internet use, many would agree that if the sole motivation for monitoring employees' Internet usage was to detect crimes and maintain a safe and respectable work environment, an employer's right to monitor electronic activity would be less objectionable. Thus the right itself is not as objectionable as the potential for that right to be abused. Many commentators fear that employers may use their ability to monitor to turn the workplace into an "electronic sweatshop" or use the information obtained through their surveillance to the detriment of the employee.⁵⁹ These fears are reasonable given the fact that employers typically possess substantial bargaining power. Anecdotal evidence of employee monitoring at its worst includes stories about an employees being fired for inappropriate comments about a supervisor in emails to co-workers, chair devices that monitor worker "wiggling" in the belief that more wiggling means less work, and employer monitoring of bathroom use that includes publication of a schedule of total bathroom minutes per employee.⁶⁰ However, employers actually have little incentive to abuse their monitoring privilege because it does not promote a productive work environment. Moreover, if information gathered through electronic monitoring were improperly handled, the employer could very well be subject to substantial liability.

¶          As discussed in Part II, monitoring employee Internet use is one tool to prevent shirking. Where extended water cooler stops and smoke breaks are easily identified and checked, it is far more difficult for the employer to determine whether an employee is actually being productive while using the Internet, especially if the difficulty of the task varies or an employee's contribution is not able to be easily identified. Thus, electronic monitoring software that records and consolidates information on how that employee is using her computer helps overcome this information asymmetry. Of some objection is the fact that electronic monitoring is so comprehensive that every detail is recorded. As one commentator asserts: "Worst of all, the supervisor isn't even human. Employees must labor at top speed under the view of unwinking computer taskmasters that record every item of work completed, along with every mistake, rest break and deviation from standard practice."⁶¹ The fact that an Internet monitoring system will record every detail, however, distorts the nature of the employer's objective and the reality of the threat.

¶          Employers seek to maximize productivity, but they must do so with an understanding that they are dealing with employees who are limited by their own human nature. Even the finest employee may be guilty of the occasional ESPN.com break and this deviation is perfectly acceptable so long as that employee is productive relative to his peers.⁶² An employer is aware that a Google search for a doctor is entirely that employee's own business and that permitting employer resources to be used to that end will likely increase productivity by saving time. With regards to those occasions where an employee speaks out against management to a third person, many times employers will respect co-worker communications so long as they do not disrupt the work environment. In those cases where an employer does take action against the employee it is often justified, as employers should not be required to tolerate subversive commentary that achieves no constructive purpose. Furthermore, being caught chatting about inappropriate topics over email is almost indefensible if notice of monitoring has been provided.

¶          Along the same lines, an employer's ability to monitor often must be balanced with considerations of employee morale and job satisfaction. For example, one University of Wisconsin study found that workers whose communications were monitored suffered from higher rates of depression, anxiety and fatigue than those not subject to monitoring at the same business.⁶³ It is logical to assume that excessive monitoring aggravates these symptoms. Ultimately, if an employer fails to determine the appropriate bounds of propriety, her business will suffer regardless of whether electronic privacy is granted employees or not.

¶          Examples such as the chair device that monitors wiggling and the public bathroom log also demonstrate that monitoring abuses, when they occur, are not limited to computer surveillance. An employer may abuse her authority regardless of whether new technology is made available to her or not. If the bargaining power of the employer is that substantial, it is a wonder how an electronic privacy statute will improve the workplace, given the fact that excessive monitoring can take so many different forms. Employers who are not permitted to monitor computer activity by using a software program may eliminate individual office space, or require employees to create individual logs and print out all correspondence. As noted in one journal of sociology: "Management has long had the tools necessary to tell who was, in its opinion, a good worker and who a bad worker, via observation, auditing and related forms of surveillance of clerical workers."⁶⁴ The mere fact that some work environments will exist where employer monitoring rights will be abused fails to justify additional statutory protections.

¶          Even if the employer happens across private information in her monitoring of an employee's Internet use, several legal principles require that the information be handled with the respect it deserves. The cause of action for public disclosure of private facts forbids the "unreasonable publicity of private information."⁶⁵ A cause of action under the doctrine of false light arises where "offensive publicity attributes to the plaintiff's characteristics, conduct, or beliefs that are false, such that the plaintiff is placed before the public in a false position."⁶⁶ Similarly, defamation prevents false elaboration upon the discrete facts obtained by the employer in the course of his surveillance.⁶⁷ An action for intentional infliction of emotional distress may also lie in those instances that are particularly outrageous.⁶⁸ Additional causes of action may arise depending upon the circumstances or the particular nature of the information.⁶⁹

¶          Consequently, despite those anecdotal cases where employers have abused their dominant position, most employers do not have an incentive to use electronic monitoring unfairly. Employers will, in most cases, account for the personal lives of their employees, and numerous legal doctrines prevent the misuse of private information obtained by monitoring. Despite these incentives, there will exist those work environments that are substandard to the point of being abusive; there will be those organizations where employees are limited in their ability to voice their disapproval by quitting because job opportunities are limited. Nevertheless, these workplace environments are unlikely to be improved significantly by the creation of additional statutory protections for electronic privacy. Excessive monitoring can take many controlling forms without the aid of computer surveillance if that is the intent of the employer. Still, these instances are exceptions.

Conclusion

¶          Commentators have attacked the current state of employment privacy law as anachronistic, outmoded and unrealistic, given the new power that computer surveillance software has provided to employers. Other common law countries like the United Kingdom and Australia have responded to these criticisms and set out statutory schemes specifically governing monitoring of employee computer use.⁷⁰ Additional statutory protection in the United States, however, is unnecessary.

¶          Undoubtedly, U.S. law affords employees little protection against employer monitoring of their Internet activities. As a matter of judicial precedent, this allocation of rights is unlikely to change. With time, as more and more employers realize the need to monitor the Internet activities of their employees and employment decisions are increasingly supported by computer monitoring, fewer employees will believe that their online conversations are confidential.⁷¹ Thus to some extent, the lack of judicial enthusiasm for the privacy of employee Internet activity will render it a public activity.

¶          This outcome, however, is entirely fair given the nature and purpose of the workplace and the substantial liability employers face for the actions of their employees. Moreover, employers are unlikely to misuse their monitoring privilege as it is in their best interest to balance surveillance needs with employee quality of life, and because employer misuse of personal information is prohibited by a variety of existing legal doctrines. Fundamentally, the Internet has not changed the balance of power in the workplace. Employees have a new and creative way to shirk their responsibilities, and employers have technological means by which they can mitigate these indiscretions.

Footnotes