United States: U.S. Court Affirms Employer’s Right to Read Employees’ Email

U.S. law gives employees few protections against employer surveillance of their workplace communications. Even without express employee consent, U.S. employers generally may listen to workplace telephone conversations, read messages sent to and from corporate email accounts, and record and disclose the contents of employee communications. Employees that bring legal challenges to these practices rarely succeed in U.S. courts. The recent decision of the U.S. Third Circuit Court of Appeals in Fraser v. Nationwide Mutual Insurance Company, which upholds an employer’s reading of an employee’s electronic mail email ("email") messages, typifies the obstacles that complaining employees face under U.S. law. ¹

In the United States, monitoring of employee communications is governed primarily by the Electronic Communications Privacy Act of 1986 ("ECPA"). ² The ECPA is divided broadly into restrictions on two kinds of activity: (1) interceptions, which are acquisitions of communications in real time (e.g., while the parties to a conversation are speaking or while an email is in process of transmission); and (2) unauthorized access to communications after they have been placed in electronic storage. ³Taken together, these prohibitions apply to most kinds of electronic surveillance, including listening to and recording wireline and wireless telephone calls, reading email, and use of hidden microphones to eavesdrop on oral conversations. ⁴ Both governmental and private parties are subject to ECPA restrictions.

Unlike the counterpart regulations in many European jurisdictions, the ECPA is not comprehensive. A careful reading of the ECPA, including the definitions of key terms and the statute’s numerous exceptions, discloses ample scope for monitoring and recording of communications. A complete discussion of the gaps in the statute’s coverage is beyond the scope of this article, but those statutory provisions with particular value to employers are worth noting.

When an employer is accused of violating an employee’s rights under the ECPA, the employer’s legal position is improved if the challenged action can be classified as access to a stored communication rather than an interception. The ECPA’s prohibitions against interceptions, which involve the acquisition of the contents of a communication with the aid of an electronic, mechanical or other device, are more stringent than the prohibitions against unlawful access to stored communications. ⁵ For example, as we discuss further below, courts have found that an employer that provides a communication service to its employees may read those communications, when in storage on the employer’s system, for any purpose. Real-time interceptions of employee communications, however, may be unlawful unless they come within specific statutory exceptions.

The distinction between real-time interception of a communication, and access to that same communication in storage, is complicated by the technology of electronic communications in the digital era. Email systems, in particular, combine transmission and storage functions in ways that might not have been fully anticipated when the ECPA was written, and plaintiffs have tried to persuade the courts that intermediate or temporary storage of an email by the service provider should not convert the acquisition of that message from an interception to a mere acquisition of a stored communication.

An early example of this issue was the case of Steve Jackson Games, Inc. v. United States Secret Service ("Steve Jackson Games"). ⁶ In that case, the U.S. Secret Service had seized, pursuant to a search warrant, a Steve Jackson Games server that contained 162 email messages that had not been opened by their intended recipients. Among other claims, Steve Jackson Games alleged that the emails, although stored in the server, had been intercepted for purposes of the ECPA because the government had acquired the emails prior to delivery and prevented their delivery. ⁷ The district court rejected this argument on the ground that under the ECPA, an act of interception must be "simultaneous with the [communication’s] transmission." ⁸ On appeal, the Court of Appeals also rejected the plaintiff’s interception claim, but on the ground that the definition of "electronic communication" in the ECPA unlike that statute’s definition of "wire communication" did not include an electronic communication while in electronic storage. Accordingly, by definition, acquisition of an electronic communication while in electronic storage could not be an interception of that communication. ⁹

Subsequent decisions have confirmed the difficulty of challenging the seizure of a stored communication as an interception. Notably, in Konop v. Hawaiian Airlines, Inc., the U.S. Court of Appeals for the Ninth Circuit reviewed the case of Konop, an airline pilot who "maintained a website where he posted bulletins critical of his employer, its officers and the incumbent union . . . ." ¹⁰ An officer of Konop’s employer, using other employees’ names, gained access to the website and read Konop’s critical postings. Among other claims, Konop alleged that his employer’s activity violated the ECPA interception and access-to-stored communications provisions. The district court granted summary judgment for the employer on both claims, and Konop appealed.

On the interception claim, the Court of Appeals, following the rationale of Steve Jackson Games, concluded that "for a website such as Konop’s to be ‘intercepted’ in violation of the [ECPA], it must be acquired during transmission, not while it is in electronic storage." ¹¹ Accordingly, the Court of Appeals upheld the district court’s grant of summary judgment for the employer on that claim. ¹²

Not all employer efforts to monitor employees’ communications, however, will fall outside the "interception" category. Where an employer listens in on or records an employee’s telephone conversation, or otherwise acquires the contents of an employee communication that has not been placed in electronic storage, those actions will be characterized as interceptions under the ECPA. Even where an employer’s actions fall within the "interception" category, however, certain exceptions to liability may be available to the employer. The principal such exceptions are discussed below.

One important gap in the ECPA’s interception restrictions is known popularly as the "business extension" exception. Specifically, a call is not intercepted for purposes of the ECPA if the device by which the contents of a conversation are acquired is a "telephone instrument or facility, or any component thereof . . . furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of its business or furnished by such subscriber or user for connection to the facilities of such service and used in the ordinary course of its business." ¹³ This language is generally interpreted to mean that an employer acting in the ordinary course of its business, and using an extension telephone or other device provided by the telephone company or other communications service provider, may listen to and perhaps even record employee conversations that take place on the employer’s business premises.

However, the business extension exception is not absolute. Notably, not every recording or interception device an employer might use will qualify as a permitted "telephone instrument or facility" under the business extension exception. As a general rule, employers are more likely to qualify for the exception if they monitor employee communications by means of extension telephones or other equipment normally provided by telephone companies, rather than specialized surveillance and recording equipment. ¹⁴ Also, employers relying on the business extension exception must demonstrate that their use of interception or recording equipment was "in the ordinary course of business." ¹⁵ In interpreting this language, the courts distinguish employees’ business calls, which may be extensively monitored if necessary to serve the employer’s business purpose, and personal calls, which ordinarily may be monitored only to the extent necessary to ascertain that those calls are, in fact, personal. ¹⁶

Unlike the statutes of some of the states, the ECPA permits a communication to be intercepted so long as "one of the parties to the communication has given prior consent to such interception." ¹⁷ Accordingly, under federal law, an employee’s consent to the employer’s interception of a communication, even where the consent of the other party to that communication is lacking, may immunize the employer from liability. ¹⁸

In order to take advantage of an employee’s consent to interception of his or her communications, however, the employer should make the employee’s consent to interception an express condition of employment, and should state that policy clearly in employee handbooks and other corporate communications as appropriate. Courts have denied employer claims of employee consent where the policy had been not been stated with sufficient clarity. ¹⁹

Interceptions of employee communications also are permitted where the employer is the "provider of a wire or electronic communication service" over which the communications are transmitted, and interception is "a necessary incident to the rendition of [the] service or to the protection of the rights or property" of the employer.²⁰ This exception is especially useful where an employee is suspected of communicating trade secrets or other proprietary information of the employers, or is engaging in other activities that harm the employer’s business interests. ²¹ Where those circumstances apply, an interception may be permitted even where the business telephone or one-party consent exceptions are unavailable.

As noted earlier, the ECPA provisions concerning access to stored communications are more lenient, as applied to employers that provide communications capabilities to their employees, than the interception provisions. Specifically, those provisions expressly do not apply to "conduct authorized . . . by the person or entity providing a wire or electronic communications service." ²² To the extent employee communications are stored on the employer’s server, therefore, the employer may read those communications regardless of whether they were acquired through use of a business extension, or whether any party to the original communication consented to such access, or whether such access is necessary in order to provide the service or protect the employer’s rights or property.

The most recent appellate decision concerning employer access to employee communications involves Richard Fraser, an independent insurance agent for Nationwide Mutual Insurance Company ("Nationwide") until he was fired in September 1998 for disloyalty. About a month before his termination, the company learned that Fraser had drafted letters to two competing companies expressing dissatisfaction with Nationwide and seeking to determine whether the competitors would be interested in acquiring certain of his policyholders. After learning about these letters, Nationwide became concerned that Fraser might be revealing company secrets to its competitors. In an effort to determine whether Fraser had actually sent letters to any of its competitors, Nationwide searched its main file server for any emails to or from Fraser that showed improper behavior. The email search confirmed Fraser’s disloyalty, and his contract with the company was terminated.

Unwilling to accept his termination, Fraser brought suit against Nationwide alleging various claims, including violation of his privacy rights under the ECPA and a parallel state statute. Fraser claimed that the company’s actions in accessing his email without his permission violated the interception provisions of ECPA Title I. He also claimed that the company’s search of his email violated Title II of the ECPA, which creates liability for accessing, without authorization, electronic communications in electronic storage. The district court disagreed, and granted summary judgment in favor of Nationwide. Fraser appealed.

The primary issue in Fraser’s Title I claim was whether Nationwide had "intercepted" an electronic communication when it accessed Fraser’s email in storage. The district court had found that the company’s actions did not constitute an unlawful "interception," but reached that conclusion under a questionable interpretation of the law that would, if accepted by other courts, have limited the ability of employers to argue that certain acquisitions of stored email are not interceptions. Specifically, the district court relied on its own interpretation of the ECPA definition of "electronic storage," which includes any "temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof" and "any storage of such communication . . . for purpose of backup protection of such communication." ²³ In the district court’s view, the definition’s reference to "temporary, intermediate" storage must mean storage of a message before it has been retrieved by the addressee, and the reference to "backup protection" must mean temporary storage that "protects the communication in the event the system crashes before transmission is complete." ²⁴ Accordingly, in the district court’s view, both forms of electronic storage refer only to storage of a message during transmission, and cannot refer to post-transmission storage. This gloss on the statutory definition of "electronic storage" determined the district court’s view of Fraser’s ECPA claims.

On the Title I interception claim, the district court opined that interceptions can occur only during transmission and not when a communication is in post-transmission storage. Because the employer acquired Konop’s email "after the email had already been received by the recipient," the email had not been acquired from intermediate or back-up storage, but merely from post-transmission storage, and therefore had not been intercepted in the course of transmission as required for a Title I violation. ²⁵

Although the district court ruled for the employer on the interception issue, the court’s rationale had a downside for employers in future cases. According to the district court’s narrow definition of "electronic storage," had Konop’s employer retrieved the email after it was sent, but before the intended recipient had opened it, the employer would have "intercepted" an electronic communication. On this rationale, employers would be protected from interception claims only when they retrieved employees’ emails from intermediate or back-up storage, rather than post-transmission storage as defined by the district court.

On appeal, the Third Circuit affirmed that there was no interception, but did so without endorsing the district court’s idiosyncratic reading of "electronic storage." Adopting the reasoning of Steve Jackson Games, the Third Circuit agreed that an "intercept" under the ECPA cannot be accomplished by acquisition of messages in electronic storage. Because the company did not monitor the messages in real time as they were transmitted, the Third Circuit found here, as the Fifth Circuit had found in Steve Jackson Games, that Nationwide did not "intercept" Fraser’s emails. Accordingly, Nationwide’s search did not violate Title I of the ECPA.

Fraser also alleged that Nationwide violated Title II of the ECPA when it retrieved, without authorization, Fraser’s email from electronic storage on the company’s server. The district court rejected this argument, relying again upon the fact that the email in question was obtained from post-transmission storage. According to the district court, because the email in question was neither in "temporary, intermediate storage" nor in "backup" storage, it was not unlawfully acquired from electronic storage for purposes of Title II of the ECPA.

On appeal, the Third Circuit expressed appropriate skepticism about the district court’s reading of the "electronic storage" definition, then affirmed the district court’s decision on different grounds. Specifically, the court relied on the holding in Bohach v. City of Reno ²⁶ to find that Nationwide’s search of Fraser’s email fell within the service provider exception to Title II. Under this exception, a provider of an electronic communications service may access communications in electronic storage on its system without violating the ECPA. As noted earlier, in Bohach, the court held that the Reno police department could retrieve pager text messages stored on the police department’s computer system because the department is the provider of the service and "service providers [may] do as they wish when it comes to accessing communications in electronic storage." ²⁷ Because Fraser’s emails were stored on a system administered by Nationwide, the Third Circuit held that the company’s search likewise fell within the provider exception.²⁸ Accordingly, Nationwide’s search did not violate Title II of the ECPA.

The Fraser decision demonstrates the continuing disadvantages faced by U.S. employees who challenge their employers’ workplace surveillance practices. Against this background, the best advice an American attorney can give an employee client is to assume that none of his or her workplace communications is private.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved