With the proliferation of emails in today’s workplace it is little wonder that many employees take their email work home, but employers should be aware that new problems abound when these employees send their company emails to Yahoo! MSN, AOL, and Google. The Internet has transformed communications, making the transfer of information as simple as a keystroke. Issues stemming from this change are likely to get more, rather than less, complicated in the years to come.
Ownership of Emails and Privacy
Throughout the US the law is that clear that employers own the emails on their company computer system. So, although employees may think their emails are private, because they are sent on systems owned by the company, they simply are not private to the employee unless the company has promised them privacy.
However, few employers realize the potential ramifications of employees sending company-owned business emails to their private accounts. Once an email leaves the relatively secure confines of the employer’s system, the employer can no longer maintain control over the content or eventual destination. This is even more troubling in the context of new electronic discovery rules.
Outside the U.S., such as in Canada, Japan, and the EU, employee privacy of emails may be mandated and are private to the employees. So if an employee at a Toronto bank wants to send emails to an account with an outside mail service, they probably have a right to do so, and can do so with an expectation of privacy. However, arguably, the business documents and files still belong to the employer.
Email ownership and privacy get very complicated when emails are exchanged between countries where the laws vary. For instance, when the Toronto bank employee sends an email to his colleague in the bank’s Dallas office, it is not entirely clear whether Canadian or U.S. law applies to the email.
Email Service Issues
It should come as no surprise that no one knows the backup email systems used at Yahoo! MSN, AOL and Google. This includes whether and how backup copies are retained. It could also mean third-party access may be allowed, made all the more likely amid news reports of mismanaged or lost emails among the top Internet-based email companies. So when an employee sends confidential company documents to their own private email account on one of these services, that information is at risk because it is out of the employer’s control.
So a business may be very alarmed to learn that its trade secrets or confidential information is sent by Yahoo! MSN, AOL and Google since there is no way to know if these services scans the emails. Even more alarming is the thought that this could potentially result in SEC violations if the information transmitted contains not-yet-disclosed facts upon which one could trade.
If the control of company information via email is not a big enough concern for employers, there is also Instant Message (IM) systems to consider. Of course, if the emails are sent to others embedded in IM systems, there may be no record later since the nature of IM is that this is not preserved. However, the fact that an IM could contain company information should also be perplexing for employers.
Electronic Discovery Issues
The protection of emails for litigation is paramount to prevent the destruction of electronic evidence, in the post-Zubulake and Morgan Stanley litigation world. As well, as of December 1, 2006, there are new Federal Rules of Civil Procedure regarding electronic evidence became effective.
Under these new Rules, litigants are now required to provide more electronic evidence, meaning that emails stored on Internet-based personal accounts present new problems for litigants and their attorneys. For instance, if a company has a 30-, 60- or 90-day retention policy for emails, management may think it has routinely destroyed company emails in accordance with their policies. However, if employees forwarded work to an outside email service, unless they were deleted, the emails will remain on these outside email servers, and, as a result, be subject to discovery.
These emails may also be retained on employees’ laptops and home computers, making this a fruitful area of discovery as well. If employers do not have, or fail to enforce, document-retention policies, the situation is made even more difficult.
If employers want to protect themselves from losing control over documents, they need to prevent their employees from sending or receiving any emails containing company information on any outside service, and then establish policies and monitor employees’ compliance.
Understanding document retention policies and particularly those policies concerning email is critical in every company today to protect themselves from problems with electronic discovery tomorrow.