Every attorney who deals in privacy issues, every attorney who advises companies on drafting acceptable use policies for computers and Internet use, every attorney who counsels companies on creating and enforcing workplace rules ought to stop what he or she is doing and read the court's opinion in Stengart v. Loving Care Agency Inc., No. A-3506-08T1 (N.J. Super.Ct., App. Div., June 26, 2009). There might be some money in it for you.
This case involved workplace computer use rules that the employer claimed gave it the right to search through and retain e-mail messages a former employee had sent to her attorney. The messages were transmitted through the employee's personal e-mail account, but on an employer-issued laptop computer. After the employee left the employer and became a plaintiff, the employer made a copy of the plaintiff's laptop's hard drive, turning up e-mail messages she had sent to her attorney with the laptop.
The appellate court held that the employer had no right to retain the former employee's e-mail messages to her attorney, finding that attorney-client privilege substantially outweighed the employer's interest in enforcement of its computer use rules.
It is getting late in the day here on the East Coast, so I'm going to take what might charitably be called an impressionistic go at this decision. Here goes.
Acceptable Use Policy Was Ambiguous
The court was very critical of the way the acceptable use policy was drafted. Acceptable use policies should convey a "clear and unambiguous understanding" about their scope. This one failed that test. The policy claimed the company had a right to intercept "matters on the company's media systems and services," however, the policy never defined "media systems and services." The policy also permitted "occasional personal use" of company computers, but it made no attempt to define when personal use was permitted. Also, the policy's use of the term "e-mail system" created an ambiguity on the question of whether or not the policy covered an employee's personal e-mail account accessed via the employer's computer.
My impression is that the loose language picked apart by the court here is commonplace. Companies are on notice now that loose language might not survive a court challenge. Ambiguities in the employer's computer use policy made it tough for the employer to defend its conduct in this appeal. This wasn't the employer's only problem, though.
Employer Doesn't Own All Personal Communications
The court was not willing to accept at face value the employer's claim that it was entitled to the employee's e-mail messages merely because they were created with company property. The court believed that the employer was required to assert a plausible justification for intruding into the employee's personal communications. The court flatly rejected the employer's argument that it had a right to access the employee's communications merely because they were created with company property. In the process, the court served up some lofty rhetoric about the right of privacy in electronic communications in the workplace.
[Provisions in the acceptable use policy] reflect the entirely proper imposition of the company's right to own and possess communications made by the employee in furtherance of the company's business. As interpreted by the company, however, those provisions purport to reach into the employee's personal life without a sufficient nexus to the employer's legitimate interests. This claimed right seems to be based principally on the fact that the computer used to make personal communications is owned by the company, although the company provides no plausible explanation for the policy's expressed acknowledgment that "[o]ccasional personal use is permitted." No rationale is offered to explain how one aspect of the policy creates the company's absolute right to retain, as its own property, all emails whether business-related or personal, with the provision that "[o]ccasional personal use is permitted."
Ignoring the significance of its express permission for "[o]ccasional personal use," the company's argument appears to rely chiefly on the fact that plaintiff utilized the company's computer and that anything flowing from that use becomes subject to the company's claimed ownership right. We reject the company's ownership of the computer as the sole determinative fact in determining whether an employee's personal emails may become the company's property.
...
Certainly, the electronic age -- and the speed and ease with which many communications may now be made -- has created numerous difficulties in segregating personal business from company business. Today, many highly personal and confidential transactions are commonly conducted via the Internet, and may be performed in a moment's time. With the touch of a keyboard or click of a mouse, individuals may access their medical records, examine activities in their bank accounts and phone records, file income tax returns, and engage in a host of other private activities, including, as here, emailing an attorney regarding confidential matters. Regardless of where or how those communications occur, individuals possess a reasonable expectation that those communications will remain private. ...
A policy imposed by an employer, purporting to transform all private communications into company property -- merely because the company owned the computer used to make private communications or used to access such private information during work hours -- furthers no legitimate business interest.
Employers out there, you're on notice now that you should have a more nuanced and situation-specific justification for snooping in personal e-mail accounts than the "We own it, we own it all" strategy adopted by the employer in this case.
Policy Not Enforceable as Contract
The court was unwilling to treat the acceptable use policy as a contract, preferring instead to characterize acceptable use polices as "regulations unilaterally imposed by employees." Instead, the court's deference to the terms of the policy was commensurate with what the court called its "moral force." A company regulation loses "moral force" when it is "based on no good reason other than the employer's desire to rummage among information having no bearing upon its legitimate business interests."
Here's another bit of rhetoric, from a judge who has clearly lost all patience with the employer's legal arguments:
We thus reject the philosophy buttressing the trial judge's ruling that, because the employer buys the employee's energies and talents during a certain portion of each workday, anything that the employee does during those hours becomes company property. Although we recognize the considerable scope of an employer's right to govern conduct and communications in the workplace, the employer's interest in enforcing its unilateral regulations wanes when the employer attempts to reach into purely private matters that have no bearing on the employer's legitimate interests.
Ouch.
Trial Court Should Have Required Employer to Prove Case
Speaking of the trial judge, the appellate court was openly disappointed in her failure to make the employer adequately prove the existence of a computer use policy, and its terms, and the extent to which the policy was applied and enforced within the company. For example, the appellate court counted five separate versions of the policy in the record, none of which contained a signed acknowledgement by the employee that she had read and understood the policy. It was error for the trial court to decide disputed fact issues without a hearing, the court said.
Employer's Law Firm Could Be Disqualified
The employer's law firm may very well have gotten itself removed from this case. Attorneys for the employer read the employee's personal e-mail messages -- which obviously contained communications between the employee and her attorney -- without first affording the employee an opportunity to assert attorney-client privilege over them. The court said that it was unreasonable for the attorneys to assume that the employer's acceptable use policy had turned the employee's privileged e-mail messages into company property. These attorneys were ethically obligated, the court said, "to cease reading or examining the document, protect it from further revelations, and notify the adverse party of its possession so that the attorney's right to retain or make use of the document may thereafter be adjudicated by the court."
The court ordered the trial court to conduct a hearing to determine whether the employer's law firm should be disqualified from representing the employer for the remainder of this litigation.
All in all, a lot to chew on late on a Friday afternoon. I prefer to look on the bright side. The case is a strong win for workplace privacy proponents. And every acceptable use policy called into question by this opinion is an opportunity for some attorney to get paid to write a better one.
Comments