Source: https://blog.ericgoldman.org/archives/2012/06/accessing_an_em.htm
Timestamp: 2019-04-22 00:59:13+00:00

Document:
Browse: Home » 2012 » June » Accessing an Employee’s Facebook Posts by “Shoulder Surfing” a Coworker’s Page States Privacy Claim — Ehling v. Monmouth Ocean Hosp.
Accessing an Employee’s Facebook Posts by “Shoulder Surfing” a Coworker’s Page States Privacy Claim — Ehling v. Monmouth Ocean Hosp.
The facts here are relatively straightforward. Ehling is a registered nurse and a paramedic who worked for Monmouth Ocean Hospital Service Corp., a non-profit hospital corporation. Ehling was in union leadership and alleged that Monmouth engaged in a pattern of retaliatory conduct against her based on her activities and statements. Ehling apparently maintained a Facebook account and was careful not to friend Monmouth management, although she was friends with many of her coworkers.
The 88 yr old was shot, He survived. I blame the DC paramedics. I want to say 2 things to the DC medics. 1. WHAT WERE YOU THINKING? and 2. This was your opportunity to really make a difference. WTF!!! And to the other guards….go to target practice.
Monmouth management did not have access to Ehling’s Facebook post but asked another Monmouth employee to pull up Ehling’s profile and posts while “in [a] supervisor’s presence.” As a result of this and other allegedly retaliatory action taken by Monmouth, Ehling brought a variety of claims against Monmouth. Monmouth moved to dismiss two counts: (1) the claim under New Jersey’s wiretapping and eavesdropping statute and (2) one for invasion of privacy.
New Jersey Wiretapping Statute: The court dismisses the claim under the New Jersey statute. New Jersey courts have construed the definition of “electronic storage” to cover only those messages that are “in the course of transmission or are backup to that course of transmission.” According to the court, case law interprets the statute to not cover communications that have been received and are in “post-transmission storage.” Since the posts were not intercepted while “in transmission,” access of Ehling’s post failed to state a claim under the statute.
Invasion of Privacy: The viability of the invasion of privacy claim turned on the familiar issue of whether Ehling had a “reasonable expectation of privacy” in her Facebook posts. Under New Jersey law, this required her to show that: (1) Monmouth intruded on her solitude, seclusion or private affairs and (2) the intrusion would be highly offensive to a reasonable person. The court says that privacy for social networking posts is an “emerging, but underdeveloped” area of the law. Viewing the spectrum of cases, the court says that on one end of the spectrum, there is clearly no expectation of privacy in material posted to an unprotected site that’s accessible by anyone. On the other end of the spectrum, courts have recognized an expectation of privacy for password-protected on-line communications. (Citing, among other cases, Pure Power Boot Camp v. Warrior Fitness Boot Camp). There is no consistent approach with respect to communications falling in between—i.e., where someone makes statements to a “limited group” of people, such as their Facebook friends. These cases should be resolved on a case-by-case basis and the court concludes that plaintiff states a plausible claim for invasion of privacy.
Ehling brought a claim under the Stored Communications Act but Monmouth did not move to dismiss this claim. It’s not clear whether accessing the Facebook post “over the shoulder” of Ehling’s co-worker constitutes unauthorized access under the SCA, but I would have guessed the court would have declined to resolve this issue at the motion to dismiss stage anyway.
Although it’s unclear whether the Stored Communications Act covers Facebook posts, one early case in the discovery context–Crispin v. Audigier–said yes. In Crispin, the court said that Facebook posts may fall under the SCA, but this depended on the privacy settings in question. A couple of other cases have allowed SCA claims where an employer gains access to a privacy protected employee pages: (1) Pietrylo v. Hillstone Restaurant Group (MySpace page) and (2) Konop v. Hawaiian Airlines (private bulletin board). Both of these cases are somewhat distinguishable on the basis that in these cases, the employers obtained the credentials themselves and repeatedly accessed the sites or pages in question. (Accessing a communication that in storage requires the plaintiff to show that the employer “accessed a facility through which an electronic communication service is provided.”) To my knowledge, there have been no rulings squarely addressing the practice of “shoulder surfing,” an issue that will come up in the employment context, as well as in the context of school administration. To the extent the password laws aim to fill gaps in privacy protection, they should address this practice.
A cautionary note to employers (and other administrators): while this order did not squarely address the issue of “shoulder surfing” under the Stored Communications Act, it does reaffirm that employees can bring invasion of privacy claims based on unauthorized access to non-public posts.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v.