Even if the ECPA does not apply to internal e-mail, it may apply to monitoring of messages on services like the Internet. The more prudent course is to conform your e-mail monitoring to the consent exception in the statute. Under this exception, an employer may intercept electronic communications if the prior consent of one of the parties to the communication has been obtained. The other theories on which employees may claim an invasion of privacy will vary from state to state. Some states, such as Maryland and Florida, require the consent of both parties to a communication before an employer may monitor e-mail.
Many states also have a common law right of privacy.
Therefore, especially for employers with multistate operations, it is important to consider location when crafting technology policies and before taking action in individual cases. Train managers and employees on policy and encourage employees to report violations promptly . Management at least should be sensitized to the discoverability of e-mail. All employees should be encouraged to use the same degree of care in writing e-mail as they would in drafting a letter on company letterhead. Urge them to avoid offhand comments that would not reflect favorably on the company if disclosed.