As yet, no legislation specifically addresses e-mail privacy and electronic monitoring activities. The US Constitution’s Fourth Amendment’s guarantees of privacy focus on search and seizure issues that do not specifically relate to computer technology. According to recent actions, courts have not found a reasonable expectation of privacy on the part of employees, but have favored employer rights to protect their interests. Among the reasons given in the Defense Counsel Journal:
(1) The work is done at the employer’s place of business;
(2) The employer owns the equipment;
(3) The employer has an interest in monitoring employee activity to ensure the quality of work; and
(4) The employer has the right to protect property from theft and fraud.
In determining the extent of electronic monitoring to undertake, organizations must rely on existing federal and state provisions. In the US, the Electronic Communications Privacy Act (ECPA) of 1986 and recent case law provide some guidance.
The ECPA governs electronic communications and extends the federal wiretap statutes to include other electronic communications. Because the ECPA focus is on conversations, exclusions from the law exist. For example, stored e-mail messages are not considered contemporaneous electronic communications under the Act, as they are not simultaneously sent and intercepted. Organizations with an acceptable business reason may intercept and review employee e-mail transmitted on the firm’s networks. The “ordinary course of business exception” makes it easier for employers to prove legitimate business reasons for computer monitoring, especially in light of recent legislation to increase client information security.
Prior court rulings suggest that reasonableness is a standard applying to surveillance and monitoring activities. Electronic monitoring is reasonable when there is a business purpose, policies exist to set the privacy expectations of employees, and employees are informed of organizational rules regarding network activities and understand the means used to monitor the workplace. It is advised that organizations obtain consent from employees regarding monitoring or surveillance activities. Legal advisors suggest that it is essential for employers to demonstrate that monitoring is a routine and known activity in the firm.