Source: https://www.privacyrights.org/blog/privacy-rights-employees-using-workplace-computers-california
Timestamp: 2019-04-25 12:00:24+00:00

Document:
By John S. Caragozian and Donald E. Warner Jr.
Employers and employees are concerned about computers in the workplace. Employers worry that employees waste time, such as by chatting or shopping on-line.  Employers worry too that employees create liability by viewing and circulating pornographic, racist, or other improper material.
Actually, employees as well as employers may have rights. However, ascertaining these rights and identifying the as-yet unresolved questions requires a careful reading of statutes, case law, and other authorities, much of which is out-dated and thin.
Plainly read, Title III's definition of "electronic communication" includes e-mail and Internet use. The legislative history and case law are in accord.
[A]ll messages are recorded and stored not because anyone is "tapping" the system, but simply because that's how the system works. It is an integral part of the technology . . . . E-mail messages are, by definition, stored in a routing computer.
These two exceptions have been narrowed by case law. While the following cases illustrate employers' interception of telephone calls, the holdings should also apply to electronic communications (subject to the "content" and "storage" issues discussed above).
Ms. Watkins sued. The District Court granted summary judgment for Berry & Co., finding both implied consent and a business interest in the monitoring.
It is not enough for Berry Co. to claim that its general policy is justifiable as part of the ordinary course of business. We have no doubt that it is. The question before us, rather, is whether the interception of this call was in the ordinary course of business.
"[I]n the ordinary course of business" cannot be expanded to mean anything that interests a company.
Similarly, in Deal v. Spears,  plaintiff Sibbie Deal was employed in a store owned by defendants Newell and Juanita Spears. The Spearses asked Ms. Deal "to cut down on her use of the [store] phone for personal calls, and the Spearses told her they might resort to monitoring calls . . . ." Later, the store was burglarized. "The Spearses believed it was an inside job and suspected . . . Deal . . . ."
Ms. Deal sued. The Spearses' defenses included "consent" and "ordinary course of business." At trial, the District Court rejected the defenses and awarded $40,000 in statutory damages plus attorneys' fees.
[T]he Spearses had a legitimate business reason for listening in: they suspected Deal's involvement in a burglary . . . and hoped she would incriminate herself. . . . Moreover, Deal was abusing her privileges by using the phone for numerous personal calls . . . when there were customers in the store. The Spearses might legitimately have monitored Deal's calls to the extent necessary to determine that the calls were personal and made or received in violation of store policy.
But, the Spearses recorded twenty-two hours of calls, and . . . listened to all of them . . . . Granted, Deal might have mentioned the burglary at any time during the conversations, but we do not believe that the Spearses' suspicions justified the extent of the intrusion. . . .
In United States v. McLaren,  AT&T gave one of its employees, defendant William McLaren, a cellular telephone for business and personal use. After AT&T's cellular customers were victimized by cloning, AT&T suspected Mr. McLaren. "[A]cting on that suspicion, AT&T began intercepting and recording all calls to or from Mr. McLaren's cellular telephone during regular business hours each day as late as 7:30 p.m." Mr. McLaren then was indicted for his role in the cloning.
[T]here must be some substantial nexus between the use of the telephone instrument to be monitored and the specific fraudulent activity being investigated. Only by . . . that nexus could [AT&T] demonstrate as required by the statute, that such monitoring was "necessary" . . . .
Plaintiffs were employees in Mutual's central office, unknowingly had all of their calls recorded, and sued under Title III. The District Court granted summary judgment for Mutual.
The Second Circuit affirmed, finding that the nature of the alarm business made the "normal course of business" exception applicable to unannounced, blanket recording of all calls to and from Mutual's central station.
Taken together, Watkins, Deal, McLaren, and Arias have three general lessons. First, employer ownership of the communications equipment alone is not carte blanche to intercept employees' communications.
Third, implied consent must be based upon employees' clear, prior knowledge that their communications will be intercepted.  Knowledge that communications can be or might be intercepted is likely insufficient.
Two other sources of federal law--the United States Constitution and labor-management laws, especially the National Labor Relations Act ("NLRA")  --have limited application to interception of electronic communications. A detailed discussion of these sources is beyond the scope of these materials, but they may be critical in some workplaces.
Presumably, section 631's and section 632's texts encompass e‑mail and Internet use, though no appellate court has yet decided the issue.
Section 632 has been applied beyond aural communications. In People v. Gibbons,  defendant Michael Gibbons invited a woman to his home and then--without the woman's knowledge--videotaped sexual activity between them.
As noted above, no reported cases have directly addressed the Privacy Act's applicability to computer use. Gibbons broadly interpreted section 632 and extended it to new technology.
With regard to e-mail sent through an employer's network, though, two out-of-State, federal cases suggest that employees should know that all such e-mails are automatically stored and accessible to the employer.  Perhaps under these cases, employees ought not to expect privacy of such e-mail. Without a privacy expectation, e-mail transmitted through the employee's network probably does not qualify as a section 632 "confidential communication." Conversely, if an employer fosters a privacy expectation (say, by expressly allowing personal e-mail to be sent and received), then perhaps an employee's use of a workplace computer could be a "confidential communication."
Even if an employee cannot prove a Privacy Act violation, the employer still might be liable for common law invasion of privacy. In Sanders v. American Broadcasting Cos.,  defendant ABC sent a reporter under cover to work at a company providing psychic readings by telephone. The reporter used a hidden videocamera and microphone to record plaintiff and co-worker Mark Sanders' conversations with customers.
Mr. Sanders sued for violation of the Privacy Act and for common law invasion of privacy. The jury found no Privacy Act violation: co-workers could overhear each other's conversations, so no section 632 "confidential communication" occurred.
Consolidated secretly installed videocameras and microphones in bathrooms at its Mira Loma, California, terminal. Upon learning of the cameras and microphones, employees sued in State courts for violations of the Privacy Act (including section 632) and common law invasion of privacy. Consolidated removed under section 301 and then moved for dismissal. The District Court granted the motion.
[S]tate law rights and obligations that . . . can be waived or altered by agreement of private parties, are pre-empted by those agreements.
In sum, if a CBA bears on privacy expectations for e-mail, Internet, or other computer use, then Cramer bars judicial recourse and requires a grievance proceeding (presumably including arbitration).
(a)(1) An employer [including public entities] may not secretly monitor the electronic mail or other computer records generated by an employee.
(2) "[S]ecretly monitor" means to inspect, review, or retain electronic mail or other computer records in a manner that does not comply with the policies and practices that are disclosed to the employee . . . .
Some employers might have objected to SB 1822. It (i) would have applied to all employers, regardless of the number of employees; (ii) would have required preparation and distribution of a monitoring policy, even where the only "secret monitoring," as defined, is from the built‑in storage of a standard, off-the-shelf e-mail program (in other words, even where the employer never installed separate surveillance software); and (iii) was not restricted to confidential or personal communications.
Some employees might also have objected to SB 1822. It lacked an exclusionary rule, an express private right of action,  and statutory damages.
Currently, any surreptitious interception of employees' computer communications might expose the employer to liability under California law and, possibly, under Title III. The likelihood of employers' Title III exposure increases with blanket interception of personal communications via special software (i.e., not out of automatic storage).
(b) alternatively, express consent by employees to interception and use (for example, by adding such consent to the employment manual signed by employees).
(c) in either event and as an extra precaution, warning all recipients of outgoing e-mail of the employer's monitoring and use (because California Penal Code section 632 lacks the one-party consent exception).
While, these steps may produce employee complaints, they also may have the important effect of preventing much e-mail and Internet abuse.
The authors would like to thank several people who commented on prior drafts of these materials: State Senator Debra Bowen and her staff; James R. Farrand, Esq. of Arnold & Porter; Ms. Beth Givens of the Privacy Rights Clearinghouse; Jeremy Gruber, Esq. of the National Workrights Institute; and Kristen J. Moyer, Esq. of Sunkist Growers, Inc. Also, the authors presented a version of these materials at the State Bar of California's Labor And Employment Law Section annual meeting on October 28, 2000. However, all views and any errors in these materials are solely the authors'.
 . Recent estimates find nearly a third of employees' on-line time is non-business, with ninety percent of employees using their employers' computers to visit "recreational sites." See K. Naughton, "CyberSlacking," Newsweek, Nov. 29, 1999, at 63.
 . Per the American Management Association, more than half of large businesses have electronically monitored employees' computer use. See J. Rosen, "Fall Of Private Man," New Republic, Jun. 12, 2000, at 22. As for small businesses, the Windows version of Specter sells for $49.95; it was originally designed for home use (and, particularly, for parents to monitor children), but now its main customers include "distrustful bosses." P. Lewis, "Spy Software Puts Home PC's Under Surveillance," N.Y. Times, Jun. 22, 2000, at D1, col. 1 (nat'l ed.).
 . "[M]ost of this software can easily be configured so that computer users won't know they're under observation." M. Richtel, "Software To Watch Over You," N.Y. Times, Jul. 4, 1999, § 6 (magazine), at 12. See also L. Guernsey, "The Web: New Ticket To A Pink Slip," N.Y. Times, Dec. 16, 1999, at D1, col. 5 (nat'l. ed.) ("[C]ompanies can now record and view everything a person does on a computer, from typing a word-processing document to opening an image file. One new product, called Specter, surreptitiously takes digital snapshots of whatever appears on the screen. . . .").
 . E.g., K. Naughton, supra note 1, at 65 ("'It may be unfair for a boss to fire you for a five minute Web-site visit, but it's not illegal,' says Lewis Maltby, workplace rights chief for the American Civil Liberties Union. 'If you filed a lawsuit, you wouldn't have a prayer.'"); "Boss May Lurk As You Surf The Web," L.A. Times, Aug. 9, 1999, at E3, col. 1 ("'[T]here's absolutely no protection when it comes to electronic communications on computers,' says Jeremy Gruber, an attorney with the American Civil Liberties Union . . . . Employees at private-sector companies, Gruber says, can riffle through your e-mail, computer files and Web-browsing history at will . . . .").
 . 18 U.S.C. §§ 2510-22. Title III defines a "wire communication as "any aural transfer made . . . by the aid of wire, cable, or other like connection . . . and such term includes any electronic storage of such communication." 18 U.S.C. § 2510(1). Among the problems to be addressed by Title III were "employer-labor espionage" and the revelation of "[l]abor and management plans." S. Rep. No. 1097, reprinted in U.S. Code Cong. & Admin. News 1968, 90th Cong., 2d Sess., at 2154.
 . See generally S. Rep. No. 99-541, reprinted in U.S. Code Cong. & Admin. News 1986, 99th Cong. 2d Sess., at 3555 (ECPA expanded Title III "in light of dramatic changes in new computer and telecommunications technologies."). However, Title III, as amended by ECPA, has been criticized as "famous (if not infamous) for its lack of clarity," and even this criticism "might have put the matter too mildly." United States v. Smith, 155 F.3d 1051, 1055 (9th Cir. 1998) (citation omitted).
 . 18 U.S.C. § 2510(12). "Interstate commerce" under Title III is so broadly construed that using a telephone for a local call "is indisputably an instrumentality of interstate . . . commerce." E.g., Peavy v. Harman, 37 F.Supp.2d 495, 519 (N.D. Tex. 1999) (citations omitted).
 . 18 U.S.C. § 2511(l). See 18 U.S.C. §§ 2510(4) (defining "intercept" as the "acquisition of the contents of any wire (or) electronic . . . communication through the use of any electronic, mechanical, or other device . . ."); 2510(6) (defining "person" as "any employee, or agent of the United States or any State or political subdivision thereof, and any individual, partnership, association . . . or corporation."); § 2510(8) (defining "contents" as "any information concerning the substance, purport, or meaning of [the] communication"). The general "intent" required under Title III merely requires that the defendant "desires the consequences of his act . . . "; the defendant need not know that the act was illegal or a violation of law. E.g., Peavy v. Harman, supra note 7, 37 F.Supp.2d at 510, 514. Title III also prohibits possession of "any electronic, mechanical or other device . . . primarily useful for the purpose of the surreptitious interception of . . . electronic communications . . . ." 18 U.S.C. § 2512(1)(b).
 . Under ECPA Title II, "a provider of electronic communication service . . . may disclose a record or other information pertaining to a subscriber to or customer of such service (not including the contents of communications . . . ) to any person other than a governmental entity." 18 U.S.C. § 2703(c). Presumably, an employer providing computers with e-mail and Internet access is "a provider," see Bohach v. City of Reno, 932 F.Supp. 1232, 1236 (D. Nev. 1996); 18 U.S.C. §§ 2710(14), 2711(l), but neither ECPA Title II nor case law has specified whether an employee is a "subscriber" or customer." Courts have ruled that an Internet Service Provider ("ISP") may lawfully disclose some personal information about customers. See, e.g., United States v. Hambrick, 55 F.Supp.2d 504, 507, 508 (W.D. Va. 1999), aff'd per curiam, 2000 U.S. App. LEXIS 5570 (4th Cir. 2000) (ISP's are "free to turn stored data and transactional records over to nongovernmental entities. . . . ECPA does not create a reasonable expectation of privacy in that information." Specifically, the ISP may disclose stored information when the customer "knowingly revealed his name, address, credit card number, and telephone number to [the ISP] . . . [The ISP's] employees had ready access to those records in the normal course of [the ISP's] business . . . ." [Citation omitted.]); In re Application of United States, 36 F.Supp.2d 430, 432 (D. Mass. 1999) (distinguishing "contents" from "related" records, "i.e., personal information of subscribers, user activity logs, billing records and so on." [Citation omitted.]). Cf. United States v. Kennedy, 81 F.Supp.2d 1103, 1110 (D. Kan. 2000) (an individual has no "Fourth Amendment privacy interest" in "subscriber information" such as his name, address, telephone number, and log‑on time and date which he "knowingly revealed" to his ISP).
 . Certainly, an employee could argue that, under the broad definition of "contents" in 18 U.S.C. § 2510(8), supra note 8, the name of a Web address alone may be "contents" and therefore protected from interception by Title III if the Web address suggests the "contents" of the employee's communication. Cf. McVeigh v. Cohen, 983 F.Supp. 215, 220 (D.D.C. 1998) ("In these days of 'big brother,' where through technology and otherwise, the privacy interests of individuals from all walks of life are being ignored or marginalized, it is imperative that statutes explicitly protecting these rights be strictly observed.").
 . 18 U.S.C. §§ 2511(4)(a), 2512(1).
 . 18 U.S.C. § 2520(b), (c)(2). See 18 U.S.C. § 2510(6), supra note 8. Title III has a two-year limitation on civil actions, commencing from a plaintiff's "first . . . reasonable opportunity to discover the violation." 18 U.S.C. § 2520(e).
 . 18 U.S.C. § 2515.
 . E.g., United States v. Meriwether, 917 F.2d 955, 960 (6th Cir. 1990) ("The ECPA does not provide an independent statutory remedy of suppression for interceptions of electronic communications." [Citations omitted.]).
 . See 18 U.S.C. § 2518(10)(C) ("The remedies and sanctions described in [Title III] with respect to the interception of electronic communications are the only judicial remedies and sanctions for non-constitutional violations of [Title III] involving such communications."). See also S. Rep. No. 99-541, supra note 6, at 3577 ("The purpose of [section 2518(10)(C)] is to underscore that [ECPA] does not apply the statutory exclusionary rule contained in Title III . . . to the interception of electronic communications."). But cf. McVeigh v. Cohen, supra note 10 (holding that, under ECPA Title II--which, like Title III, has no exclusionary rule for illegally obtained electronic communications and has the same "only judicial remedies" language--"it is elementary that information obtained improperly can be suppressed where an individual's rights have been violated.").
 . S. Rep. No. 99-541, supra note 6, at 3557 ("[E]lectronic communication . . . also includes electronic mail [and] digitized transmissions . . . ."). See also United States v. Mullins, 992 F.2d 1472 (9th Cir.), cert. denied, 509 U.S. 905, 113 S.Ct. 2997, 125 L.Ed.2d 691 (1993) (applying Title III to SABRE, the computerized travel reservations system); Wesley College v. Pitts, 974 F.Supp 375, 378, 381-84 (D. Del. 1997), aff'd 172 F.3d 861 (3rd Cir. 1998) (applying Title III to a college's e-mail network).
 . Title III defines "electronic storage" as "(A) any temporary, intermediate storage of a wire of electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication." 18 U.S.C. §2510(17).
 . 36 F.3d 457 (5th Cir. 1994), aff'g 816 F.Supp. 432 (W.D. Tex. 1993).
 . 36 F.3d at 458-59.
 . Id. at 461 (emphasis in original). Compare id. at 461-62 ("Congress' use of the word 'transfer' in the definition of 'electronic communication' and its omission in that definition of the phrase 'any electronic storage of such communication' (part of the definition of 'wire communication') reflects that Congress did not intend for 'intercept' to apply to 'electronic communications' when those communications are in 'electronic storage.'" [Footnote omitted.]) with 18 U.S.C. § 2510(1), supra note 5.
 . See 932 F.Supp. at 1234 & n.2, 1235.
 . Id. at 1234, 1235-36. See also United States v. Reyes, 922 F.Supp. 818, 837 (S.D.N.Y. 1996) (retrieving telephone numbers from pagers' memories is not a Title III violation).
 . E.g., E. Tittel & M. Robbins, E-Mail Essentials, at 7 (1994).
 . ECPA's Title II prohibits anyone from accessing "without authorization" electronic communications "in electronic storage." 18 U.S.C. § 2701(a). However, this Title II prohibition excepts ". . . conduct authorized--[¶](1) by the person or entity providing a wire or electronic communications service . . . ." 18 U.S.C. § 2701(c). Thus, an employer, as the "provider of the `service,'" may access its own electronic storage, and "neither it nor its employees can be liable under § 2701." Bohach v. City of Reno, supra note 9, at 1236. See also Smyth v. Pillsbury, 914 F.Supp. 97, 101 (E.D. Pa. 1996) (omitting any mention of Title III and finding no violation of Pennsylvania common law where a defendant employer "intercepts" an e-mail sent over an in-house network from a plaintiff employee to his supervisor).
 . See United States v. Smith, supra note 6, 155 F.3d at 1059.
 . See id. at 1056-59 & n.10.
 . See 18 U.S.C. § 2511(2)(d). See, e.g., United States v. Axselle, 604 F.2d 1330, 1338 (10th Cir. 1979).
 . E.g., United States v. Amen, 831 F.2d 373, 378 (2d Cir. 1987) cert. denied, 485 U.S. 1021, 108 S.Ct. 1573, 99 L.Ed.2d 889 (1988); Griggs-Ryan v. Smith, 904 F.2d 112, 117 (1st Cir. 1990).
 . U.S.C. § 2510(5)(a). Whether surveillance software is a "telegraph or telephone instrument, equipment, or facility" under section 2510(5)(a) has not been adjudicated. Courts have even disagreed whether a tape recorder constitutes such "equipment . . . ." E.g., Arias v. Mutual Central Alarm Service, Inc., 202 F.3d 553, 557 n.3 (2d Cir. 2000), aff'g 182 F.R.D. 407 (S.D.N.Y. 1998), and cases cited therein. However, a separate, but somewhat analogous, section of Title III omits the "telegraph or telephone instrument . . ." language: under 18 U.S.C. § 2511(2)(a)(i), "a provider of wire or electronic communication service" is permitted ". . . to intercept, disclose, or use that communication in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service . . . ." See, e.g., United States v. Mullins, supra note 16, 992 F.2d at 1478 (holding this section 2511(2)(a)(i) applicable to American Airlines' monitoring of communications over SABRE, its then-owned computerized travel reservations network).
 . 704 F.2d 577 (11th Cir. 1983).

References: v. 
 v. 
 v. 
 v. 
 § 6
 § 2510
 v. 
 § 2510
 v. 
 § 2511
 § 2510
 v. 
 § 2512
 § 2703
 v. 
 v. 
 v. 
 § 2510
 v. 
 § 2520
 § 2510
 § 2520
 § 2515
 v. 
 § 2518
 v. 
 v. 
 v. 
 §2510
 § 2510
 v. 
 § 2701
 § 2701
 § 2701
 v. 
 v. 
 v. 
 § 2511
 v. 
 v. 
 v. 
 § 2510
 v. 
 § 2511
 v.