May an employer access an employee's emails sent using a company-issued laptop via a personal, password-protected, web-based email account? And, if those emails were sent to the employee's attorney for the purpose of obtaining legal advice, does the employee's use of the company laptop waive the attorney-client privilege? Those questions recently were addressed by a New Jersey appellate court in Stengart v. Loving Care Agency, Inc.
The plaintiff in Stengart sent the emails to her attorney regarding her intent to sue her employer for discrimination . After the lawsuit was filed, the company created a forensic image of the laptop's hard drive and discovered the emails. When plaintiff's counsel first learned that these emails were in the possession of the company's counsel, plaintiff's counsel requested that the original emails and all copies be turned over based on the attorney-client privilege, but the company's counsel refused.
The trial court concluded that the emails were not protected by the attorney-client privilege because the company's electronic communications policy put the plaintiff on sufficient notice that her emails would be viewed as company property. On appeal, however, the New Jersey Superior Court, Appellate Division, disagreed, stating that the policies underlying the attorney-client privilege substantially outweigh "the employer's interest in enforcement of its unilaterally imposed regulation," and rejecting "the employer's claimed right to rummage through and retain the employee's emails to her attorney."
First question: Assuming the employer discovered the emails before the plaintiff's resignation, did it have a right in the first instance to review personal emails sent by the plaintiff using company computer equipment, but a private, password-protected email account? The New Jersey appellate court said no.
According to the company, its electronic communications policy notified employees that it reserved the right and “will” exercise the right to "review, audit, intercept, access, and disclose all matters on the company's media systems and services at any time, with or without notice." In addition, the policy said that email and voice mail messages, Internet use and communication and computer files are considered part of the company's business and client records. "Such communications are not to be considered private or personal to any employee." The policy then went on to identify certain uses of the email system that were specifically prohibited but also accepted that "occasional personal use" would be permitted.
According to the appellate court, the employer was unable to demonstrate that this policy, as opposed to multiple other drafts of the policy, actually was ever put into effect or that, in any event, it applied to an executive-level employee such as plaintiff. Furthermore, in the face of plaintiff's denial that she was aware of the policy, the employer could not produce a signed acknowledgment from her.
The court next considered whether the company’s policy should apply to emails sent on the employee's personal account. Here, the court again bent over backwards to find ambiguities in the policy that "cast doubt over the legitimacy of the company's attempt to seize and retain personal emails sent through the company's computer via the employee's personal email account."
Finally, the court looked at whether the employer's policy was reasonable in claiming "ownership" of personal emails sent using company computers. Here, the court held that the employer's ownership of its computer systems did not justify its right to retain personal emails, particularly when the policy expressly acknowledged the right to occasional personal use of the email system. In analogizing the computer to a "file cabinet" for personal communications, the Court noted that a policy imposed by an employer, purporting to transform all private communications into company property -- merely because the company owned the computer system -- furthered no legitimate business interest. The court conceded, however, that "an employer may monitor whether an employee is distracted from the employer's business and may take disciplinary action if an employee engages in personal matters during work hours. That right to discipline or terminate, however, does not extend to the confiscation of the employee's personal communications.”
In light of the court's views, it is not surprising to learn that it held that the policies underlying the attorney-client privilege outweighed the employer's claimed interest in ownership of or access to otherwise privileged communications because they were sent on the company computer. Therefore, the court reversed the trial court's conclusion that plaintiff waived the attorney-client privilege when she risked disclosure of her communications by using a work-issued computer.
So what do we learn from this decision? With respect to the attorney-client privilege issue, the Stengart decision is contrary to many others that have held that employees who communicate with their attorneys using the company computer waive the privilege when they are told that personal email communications used on company computers will not be private. Those courts finding a waiver of the privilege typically have relied on the employer's policy to find that the employee knew that personal communications of any nature would not remain private. The difference here seems to be plaintiff’s use of her password-protected personal email account instead of her company's email account.
But, what about the employer’s right to access the personal email account? We have seen previously from the Van Alstyne case that courts may be hostile to employers accessing their employees' personal email accounts. The Van Alstyne decision, however, never really makes clear how the employer accessed its employee's account. For instance, it is not clear whether the employer improperly obtained or circumvented the employee's password. By contrast, the Stengart court, though hostile to the privacy implications, does not completely foreclose the employer's right to view emails sent using a personal account if the employer disseminates a policy giving it the right to monitor all personal emails sent on its computer systems regardless of the account used. Clearly, this is a situation where the moral high ground is going to shift depending on the steps the employer has taken to notify its employees of the limitations on their expectation of privacy, the means used by the employer to access personal communications, and the nature of the employee's personal communication (e.g. communications with an attorney vs. viewing child pornography). The wise employer will contact counsel before proceeding.