The legal question about whether and to what extent it is appropriate to
audit and monitor company computer systems is not yet settled. The cases
generally support an analysis of whether the employees had any "expectation of
privacy." Most e-mail and voice mail systems assign password and access numbers
or PIN numbers, often chosen by the employees, that adds an additional element
to the analysis. The courts are split on applying that standard.
The Omnibus Crime Control and Safe Streets Act of 1968, was amended by the
Electronic Communications Privacy Act of 1986. ECPA generally prohibits the
interception, accessing, or disclosure of electronic communications. ECPA
provides certain protections from access and monitoring of e-mail communications
on public systems such as telephone lines, on-line systems and cellular
telephone lines. 62. ECPA prohibits third parties, the government, police or
individuals from accessing or disclosing e-mail without proper authorization
such as obtaining a search warrant or obtaining prior consent by the user
or recipient. Applicability to private employer
circumstances continues to be debated. Statutory protection for communications
in the transmission phase and in stored communications is not identical and
requires separate analysis. Once stored, employer access is generally
unrestricted under ECPA. 63. With corporate systems opening
onto the Internet, it can no longer easily be argued that these systems are
self-contained. Additionally, plaintiffs can seek relief under the common law
and many state privacy statutes. 64. Corporate actions that will
withstand the most scrutiny are those limited to monitoring for reasonable
business purposes, on prior notice to employees and consistent with employee
expectations as to the use of the audited information. If no
policies or warnings were in place, it is difficult to defend unfettered access
to employee e-mail in particular even though a company is accessing its own
equipment and systems. Check union and any other labor agreements. Many already
address these issues and place parameters around monitoring, notice to
employees, and use of audited information. 65. For guidance,
we look to prior court rulings in related areas involving monitoring employee
telephone conversation and voice mail, and searches of employee
workplace. The best assistance that counsel can give in advising a corporate
client to reduce exposure to employee litigation is to set up guidelines and
educate employees and management. The Electronic Messaging Association has
published some guidelines and a tool kit which are good starting point to help
develop appropriate corporate policies.