Recently, a political firestorm has erupted as news stories revealed that Former Secretary of State (and likely Presidential Candidate) Hillary Clinton utilized private e-mail accounts to conduct government business during her tenure as Secretary of State. Pundits from the left, right, and center have weighed in on the political impact of Clinton’s e-mail practices. But putting politics aside, as the story of Clinton’s e-mail usage unfolds, employers should be asking if it is a good idea to allow their employees to send work-related e-mails on private e-mail accounts. In fact, the wise employer should enact and enforce policies that mandate employees to use company-issued e-mail accounts for work-related communications and prohibit employees from using private e-mail accounts to send work-related e-mails. Here are five reasons why such a policy is smart for employers.
1. The Ability To Access and Monitor An Employee’s E-mail Communications A policy which prohibits employees from using personal e-mail accounts to send work-related e-mails ensures that an employer will have the ability to monitor an employee’s work-related e-mails. If employees are sending work-related information via their private e-mail accounts, an employer has little, if any, ability to access those e-mails. Indeed, even if the employee accesses his or her private e-mail account on a company issued computer, an employer’s hands may be tied when it comes to monitoring and reviewing the e-mails contained in the employee’s private e-mail account.
While it is standard for employers to implement computer usage policies advising employees that the employer has the right to monitor e-mails and that there is no expectation of privacy in information sent or received on a company computer, those policies may not extend to e-mails sent and received on private web-based e-mail accounts. For example, in Stengart v. Loving Care Agency, the New Jersey Supreme Court found that an employer was prohibited from monitoring e-mails an employee sent from her personal web-based e-mail account. Even though the e-mails were sent on the a company computer, the Stengart Court concluded that an employee had a reasonable expectation of privacy in e-mails sent via a personal e-mail account.
Accordingly, to ensure that the employer maintains the full ability to access and monitor an employee’s e-mail, employer’s should adopt a policy mandating that work-related e-mails be sent via the employer issued e-mail accounts, and prohibiting employees from utilizing personal e-mail accounts for work-related purposes.
2. The Protection of Confidential and Proprietary Information. The fear that confidential and proprietary information will be leaked to a competitor, used to start a competing business, or otherwise misused, strikes at the heart of many employers. In order to quell that fear, employment lawyers regularly advise employers to immediately cut off the departing employee’s access to its computer and e-mail systems followed up with a review of e-mails sent and received on the employer’s e-mail systems to confirm if the employee has misused confidential information. However, when an employee uses a private e-mail account for company business, an employer has no control over an employee’s private e-mail account, no mechanism to block immediate access, and no ability to review the e-mails which reside on the private account. Instead, when employees use their private e-mail account to conduct company business, the employer is left to the mercy of the employee to return any confidential information or work-related information which may reside in the employee’s private e-mail account. Leaving it to the employee to determine which information is confidential, which information is work-related, and which information is personal can get messy. Just ask Hillary.
Indeed, when the employer is unsatisfied with the employee’s efforts to return confidential information which resides in the employee’s personal e-mail, the only recourse may be to start a legal proceeding seeking injunctive relief. This process is often lengthy, always disruptive to the employer’s business, and undoubtedly costly (especially when it involves the use of expensive forensic experts). Therefore, to limit the risk that confidential and proprietary information will be misused, employers should require that employees refrain from using private e-mail accounts to conduct work-related activities and that all work-related e-mails be sent and received over the employer’s e-mail systems.
3. Control of the Discovery Process. Any employer who has had the unfortunate experience of being sued knows that the first thing most plaintiff’s attorneys do after commencing a lawsuit is serve the employer with broad electronic discovery requests including requests for all e-mails relevant to the lawsuit. Responding to those requests, which often includes the search and review of thousands (and in some cases hundreds of thousands) of e-mails, is a daunting task which can be a nightmare for employers. To limit the potential universe of e-mails that may be subject to discovery requests, employment lawyers counsel employers to implement e-mail retention policies which govern how and to what extent employers maintain e-mails. However, e-mail retention policies are worthless when employees conduct employer business on their private email accounts. When discovery includes subpoenas for e-mails contained in an employee’s private e-mail account, the employer loses the ability to control the information that is subject to discovery and thus, the ability to control the discovery process. Mandating employees to send work-related e-mails on their employer-issued e-mail account and not via personal e-mail accounts ensures control over the discovery process.
4. Keeping Personal and Business Related E-mails Separate Benefits Employees Too. After discussing the fact that she had to separate personal e-mails concerning her daughter’s wedding, her mother’s funeral and her yoga classes from e-mails concerning government business, Hillary Clinton admitted that it would have been “smarter” to have separate e-mail accounts for personal and government business. When employees use personal e-mail accounts for work-related business, they too run the risk that their personal e-mail accounts will be the subject of discovery or, worse yet, a forensic search.
Most plaintiffs know when an employee uses personal e-mail accounts for work-related business. Most plaintiffs will seek e-mails from that personal e-mail account during discovery. And, like Clinton’s critics, most plaintiffs (and their attorneys) are not likely to take the employee’s word that he or she has turned over all of the relevant or work-related e-mails contained on the personal e-mail account and will seek to have a forensic expert review the employee’s personal e-mail account.
One of the more unpleasant conversations I had during my 17+ years of practice was with a high level executive in a company being sued for retaliation. The client had routinely used his personal Yahoo account to send work-related e-mails. I had the unpleasant task of advising the client that the plaintiff was requesting a court to grant permission to have a forensic expert review the client’s Yahoo account because the plaintiff was not satisfied the client turned over all relevant work-related e-mails stored on his Yahoo account. My ears are still ringing from the client’s shouting. Of course, the client was understandably upset and downright angry at the possibility that some former disgruntled employee, a bunch of attorneys, and forensic experts were now going to be viewing e-mails about his personal life: kids’ soccer schedules, the poker games he played with his buddies, even the love notes he sent to his wife. The battle over the plaintiff’s ability to have a forensic expert review the client’s Yahoo account would have been easily avoided had the client not sent work-related e-mails from his Yahoo account. Therefore, a policy prohibiting employees from using personal e-mail accounts to conduct work-related e-mails is not only sound for the employer, it also protects employees.
5. Technology Permits It. Recent advancements in technology, including the development of remote access software, make it feasible for an employer to implement policies prohibiting employees from utilizing private e-mail accounts to conduct work-related business. Several years ago, many employers would have politely listened to my sound legal advice, perhaps adopted the policy I recommended, and, in a New York minute, tossed both my advice and the policy out the window the moment a demanding customer needed information from an employee who was traveling on business, out sick or otherwise unable to connect to the company e-mail systems. Indeed, despite the legal risks, when a demanding customer needed information, most employers would not care if the communication was sent via Yahoo, Gmail or carrier pigeon as long as it got to the customer.
However, being away from the office is no longer an excuse for not using a company e-mail account. Remote access software allows most employees with an internet connection to access their employer e-mail accounts remotely. Indeed, for most employers, remote access software is both readily available and cost-effective. Employees can remotely access company emails from home, the airport, or their kid’s basketball game and they can do so on desktops, laptops, tablets and smartphones.
Accordingly, a policy mandating that employees use employer issued e-mail accounts to conduct work-related activities not only makes legal sense, but, given the availability of remote access software also makes practical sense.
In sum, as we continue to hear news stories about the dangers of government officials using private e-mail accounts for government business, employers and employees should also consider the dangers of employees using private e-mail accounts for work-related activities. Employers should adopt policies mandating their employees use employer issued e-mail accounts to send work-related communications and prohibit employees from using private e-mail accounts for work-related activities.