Does the federal Stored Communications Act, which generally prohibits unauthorized access to electronic communications, apply to an employer who gets an employee's Facebook posts from a "friend" who discloses them without permission?
Not if the employer didn't ask for them, said a federal district court in New Jersey in Ehling v. Monmouth-Ocean Hospital Service Corp., but the decision implies that it could be a different story if the employer had "solicited" the information in any way. Although the case arose in a health care setting, the court's holding applies to retail employers, as well.
The plaintiff in Ehling was a nurse and paramedic who had a Facebook account with private settings. She was "friends" with a number of co-workers, but not with any of her supervisors. One of her co-worker "friends" disclosed her postings to her employer, including one that implied that paramedics should have killed an elderly gunman who was shot by security guards, or at least "allowed" him to die. The post stated as follows:
An 88 yr old sociopath white supremacist opened fire in the Wash D.C. Holocaust Museum this morning and killed an innocent guard (leaving children). Other guards opened fire. The 88 yr old was shot. He survived. I blame the DC paramedics. I want to say 2 things to the DC medics. 1. WHAT WERE YOU THINKING? and 2. This was your opportunity to really make a difference! WTF!!!! And to the other guards . . . . go to target practice.
After the co-worker showed the posting to an administrator, the Plaintiff was suspended with pay and given a memo indicating that management was concerned that her comment reflected a "deliberate disregard for patient safety." She then sued the employer and several individual executives, claiming among other things violation of the Stored Communications Act.
First, the court said that the SCA could apply to Facebook posts because the posts are (1) electronic communications, (2) that were transmitted via an electronic communication service, (3) that are in electronic service, and (4) that are not public. However, the court found that the SCA's "authorized user" exception applied because the co-worker making the disclosure was a "friend" of the Plaintiff and was authorized to see her posts. Moreover, the hospital administrator – who was not a Facebook "friend" – did not direct, pressure, or encourage the co-worker to disclose the Facebook material. The court granted summary judgment to the defendants on the Plaintiff's SCA claim.
Ehling illustrates the importance to employees of watching what they post on Facebook and other social media, but also a caution for employers: employers should never ask employees to access private social media information that the employer is not already authorized to access itself. This court strongly implied that doing so could violate the SCA.