On March 30, 2010, the New Jersey Supreme Court issued its opinion in Stengart v. LovingCare Agency, Inc., 2010 WL 1189458 (N.J. March 30, 2010). This hotly anticipated ruling was a clear win for employee privacy rights. It was also clearly the right decision given the facts.
In its decision, the Court affirmed the Appellate Court’s ruling that an employer was precluded from accessing attorney-client privileged email. The email was deemed protected by way of the attorney-client privilege even though the employee accessed the email during work hours using an employer’s laptop. The key factor in creating a reasonable expectation of privacy was the plaintiff’s use of her personal Yahoo! webmail service to send and receive the email. In other words, although the laptop computer used was employer property, the information remained “employee property” given it was password protected via the Yahoo! website. Moreover, she never stored the password on the company laptop. The Appellate Divison and Supreme Court were likely also swayed by the fact the attorney-client privileged email in question were used by the employer’s counsel in a pending litigation involving plaintiff.
The Court went into detail regarding how the employer’s Electronic Communications Policy (which was part of its employee handbook) did not provide notice regarding any lack of privacy in a webmail service. Specifically, the Court ruled:
It is not clear from that language whether the use of personal, password-protected, web-based e-mail accounts via company equipment is covered. The Policy uses general language to refer to its “media systems and services” but does not define those terms. Elsewhere, the Policy prohibits certain uses of “the e-mail system,” which appears to be a reference to company e-mail accounts. The Policy does not address personal accounts at all. In other words, employees do not have express notice that messages sent or received on a personal, web-based e-mail account are subject to monitoring if company equipment is used to access the account.
The Policy also does not warn employees that the contents of such e-mails are stored on a hard drive and can be forensically retrieved and read by Loving Care.
The Policy goes on to declare that e-mails “are not to be considered private or personal to any individual employee.” In the very next point, the Policy acknowledges that “[o]ccasional personal use [of e-mail] is permitted.” As written, the Policy creates ambiguity about whether personal e-mail use is company or private property.
Id. at 13 – 14.
A more carefully crafted employee manual would have not likely led to a different result. It appears as if the Court provides a roadmap for employers but one in which attorney client communications would always remain sacrosanct. For example, although many employee manuals already outright preclude employees from accessing webmail via company computers, such a blanket prohibition would likely not be enough going forward given this ruling. See Id. at 28 – 29 (“[E]mployers have no need or basis to read the specific contents of personal, privileged, attorney-client communications in order to enforce corporate policy. Because of the important public policy concerns underlying the attorney – client privilege, even a more clearly written company manual – that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee’s attorney client communications, if accessed on a personal, password protected e-mail account using the company’s computer system – would not be enforceable.”).
It appears as if the correct approach for employers looking to access certain employee email exchanged via a webmail service is to provide even more specific guidance regarding what may or may not be done by the employee. For example, it may help to provide an explicit warning that all email exchanged via a webmail service is subject to the general email policy of the firm. Banning pornography and “hate speech” email would clearly not be a problem under this ruling. When it comes to attorney-client material, a warning regarding the insecure nature of such communication may be warranted as well as a reminder that non-business communications are deemed inappropriate and can possibly lead to termination. Nothing in the ruling would preclude using non-business activity against an employee. As well, transmitting proprietary company material with insecure, un-archived, and non-sanctioned forms of communication such as webmail services would likely still be considered against corporate policy under this ruling. Finally, when drafting a policy, it should be made clear that the company cannot and will not guarantee the confidentiality of any communications made using a webmail service.
Given many employees blur personal and company time, it is often the case that employees are checking their personal email on company time. Indeed, the advent of webmail services from Yahoo!, Google, Microsoft and others makes it an almost a trivial task to check personal email on company PCs, laptops, and smart phones. Given the Stengart decision, New Jersey employers should evaluate their current procedures regarding use of webmail services with an understanding that attorney-client email may be strictly off limits to corporate eyes.