Keeping an Eye on Your Employees

Created August 20, 2008

Employers have long engaged in monitoring employees to help maintain quality standards, protect against untrustworthy employees, and shield the company against potential liability.  Advances in technology have made electronic methods of monitoring easily available and effective.  While federal and Virginia laws do not carve out an explicit right to privacy for employees, employers are not entitled to subject employees to limitless scrutiny.  Employers must understand the legal restrictions on employee monitoring and craft office policies accordingly.

In addition to existing statutory restrictions, under Virginia law there are certain causes of action that employees may rely upon to protect against overzealous employer surveillance: (1) unreasonable intrusion upon the employee’s seclusion, or solitude, or into his private affairs; (2) public disclosure of true, embarrassing private facts about the employee; (3) publicity which places the employee in a false light in the public eye; and (4) misappropriation of employee’s name or likeness for commercial purposes.[1]  The first of these common law torts addresses whether the employee had a reasonable expectation of privacy over the area the company monitored, while the other three deal with how an employer may wrongfully use the information gained during the surveillance.  Thus, even in situations where the employee may not have a reasonable expectation of privacy, an employer must take great care to use the information properly to avoid any repercussions.

One area where monitoring is simply not allowed is the mail.  Under federal law, an employer is not allowed to open and examine an employee’s personal mail.  See 18 U.S.C. § 1702.  However, there are many other areas where an employee may be subject to surveillance, each with different statutory contours as described below.

Phone Conversations.  Monitoring an employee’s phone conversations implicates both federal and Virginia law.  Under the Federal Wiretapping Act, it is illegal to “intentionally intercept[] . . . any wire, oral, or electronic conversation.”  18 U.S.C. § 2511(1)(a).  It is also illegal to “intentionally use[] . . . any electronic, mechanical, or other device to intercept any oral communication when . . . (iv) such use . . . (A) takes place on the premises of any business or other commercial establishment the operations of which affect interstate or foreign commerce; or (B) obtains or is for the purpose of obtaining information relating to the operations of any business or other commercial establishment the operations of which affect interstate or foreign commerce.”  18 U.S.C. § 2511(1)(b).  Virginia law, under the Virginia Wiretapping Act, is substantially similar.  Va. Code § 19.2-61, et seq.

While these laws appear to preclude any employer from monitoring its employees’ phone calls, there are three important exceptions to these prohibitions.  First, federal and Virginia law both allow wiretapping when at least one of the parties to the call has given prior consent to the monitoring.[2]  See 18 U.S.C. § 2511(2)(d) and Va. Code § 19.2-62(B)(2).  Thus, if the employee has consented to the employer’s monitoring, such as through an employment contract, the employer will be able to monitor that employee’s calls.

Second, there is what is called a “business extension exception,” wherein wiretapping is allowed when through a device that is “furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of its business and being used by the subscriber or user in the ordinary course of its business or furnished by such subscriber or user for connection to the facilities of such service and used in the ordinary course of its business.”  18 U.S.C. § 2510(5)(a)(i), and see Va. Code § 19.2-61.[3]  This exception covers most devices that are able to intercept phone calls.  However, an employer may only monitor those conversations that are at least arguably work-related; the monitoring of personal phone calls beyond the point of simply determining whether the call is work-related is normally considered to be outside “the ordinary course of business,” and thus prohibited.

Lastly, there is a “service provider exception,” whereby an employee of the provider of a “wire or electronic communications service” can monitor a communication going through that service if that doing so is within the “normal course of [the employee’s] employment while engaged in any activity which is a necessary incident to the rendition of [the employee’s] service or to the protection of the rights or property of the provider of that service.”  18 U.S.C. § 2511(2)(a)(i), and see Va. Code § 19.2-62(B)(1).  This covers any private telephone service provided by the employer.

Taken together, an employer that wishes to monitor its employees’ phone calls should first, at the outset of employment, obtain the employees’ consent to the monitoring.  If the employer owns the phone system, it should inform the employees of this fact and of the employer’s right to monitor calls.  Even with an employee’s consent, employers should only monitor personal phone calls to the extent necessary to determine that the call is personal, and not work-related, in nature.

Voice Mail and E-mail.  Under federal law, stored wire and electronic communications, such as voice mail and e-mail, may be accessed if under the authorization of “the person or entity providing a wire or electronic communications service.”  18 U.S.C. § 2701(c)(1).  Thus, if the employer owns the phone service, it can give itself authorization to listen to an employee’s voice mail.  Similarly, if the employer provides the e-mail service, it can review the employee’s e-mails.  If the employer makes clear to the employee that the employee’s voice mail and e-mail are subject to monitoring as a part of company policy, the monitoring will be allowed within the contours defined by the company’s policy.  U.S. v. Simons, 29 F. Supp. 2d 324 (E.D. Va. 1998), aff’d in part and remanded in part, 206 F.3d 392 (4th Cir. 2000).

However, if the employee has a reasonable expectation of privacy, or the employer does not have a reasonable business-related justification for the monitoring, such searches may be prohibited.  A clear example of this is when the employee has his or her own e-mail service not provided by the employer.  The employee would have a reasonable expectation of privacy over e-mails sent and received in their personal Google account, even if that account is used for work purposes.

A typical description of company policy would be contained in the employee handbook, signed by the employee as an indication that the employee reviewed the handbook and agreed to the terms therein.  As an example, a company policy to allow the monitoring of e-mail should state that the company’s e-mail system is the property of the company and that the employee has no expectation of privacy over their use of that system.  The company should explicitly state that the employee’s e-mails are subject to monitoring and viewing by the company, without notice to the employee.  The company should also state that the e-mail system should not be used to promote non-work-related causes, create a hostile work environment, or harass others.  The policy should also warn against using the e-mail system to transmit copyrighted materials, trade secrets, proprietary or confidential information without authorization from the company.  The company should reserve the right to discipline employees that violate these rules, including termination as appropriate.

Computers and Internet.  If the employer provides the computer(s) that the employee uses during the course of their work, the employer can institute a monitoring policy over that computer and all of the files on it, as well as sites accessed on the Internet.  Again, so long as these policies are clearly stated in the employee handbook and agreed to by the employee, and the employer has a strong business-related justification to conduct these searches, there will be no expectation of privacy over these areas.

Additionally, there are a host of other monitoring devices for computers that do not raise federal legal issues.  For example, a keystroke monitoring system that simply counts the number of keystrokes entered by the employee has been held to be legal under the Federal Wiretap Act.  See, e.g., United States v. Ropp, 347 F. Supp. 2d 831 (C.D. Cal. 2004).  Programs that tabulate when certain tasks are accomplished by an employee are acceptable, along with “black boxes” that accumulate data on usage of a given computer or machine.

Video Surveillance.  Employers have long used video cameras to monitor certain areas of the office to maintain security.  In general, surveillance by visible cameras presents no danger to the employer unless those cameras are placed in toilet stalls or similar sensitive areas.  Where management can lawfully see, a camera can too.  The presence of a visible camera destroys any expectation of privacy over the area monitored.

Hidden cameras can present some issues.  Although Virginia has very little case law addressing this matter, other states generally consider whether employees have a reasonable expectation of privacy for the area under surveillance by hidden camera to determine if there is an invasion of privacy.  In most cases, workplaces are not expected to be private.  Thus, the main issue is not whether the camera can be set up, but how the footage will be used.  If the intent of the camera is to catch employees violating company policy, use of the footage must be very carefully handled so as to not give those employees a cause of action against the employer.

Emerging issues.  An increasingly prevalent area of surveillance that the courts seem to be upholding is the hiring of private investigators to conduct surveillance on employees that are suspected of taking leave dishonestly under the Family Medical Leave Act.  While still a relatively new development, this is one in which the courts are, so far, siding with employers.  With that said, however, this is a very delicate topic as it deals with surveilling employees when they are not at work.  In most cases, there are heavy suspicions of the employee abusing their FMLA leave before any surveillance is conducted, and it is highly encouraged that employers seek legal counsel before considering this option.

In conclusion, an employer considering surveillance of its employees should review applicable federal and state statutes to ensure that its methods are in compliance.  Employers should also make its surveillance policies well-known to the employees, and have the employees affirm those policies explicitly.  Even then, employers must be careful to only use the information gained from surveillance in ways that will not give the employee cause to accuse the employer of violating his or her privacy.  Before instituting a surveillance program or using the fruits of such surveillance, it is recommended that the employer consult a lawyer.