4B-2-Employee Monitoring

Workspace privacy Europe v US

As a general proposition, employees in Europe have significantly more privacy protections in the workplace. Workplace monitoring that is encouraged or required in the United States may not be permitted in countries that are part of the European Union. Therefore, multi-national companies may need to develop several sets of policies regarding their employee-monitoring practices.

Postal Mail

Under federal law, it is a criminal offense to interfere with U.S. postal mail delivery.17 Mail is considered to be "delivered," however, when it reaches a business.18 Accordingly, a business is generally permitted to open mail and packages delivered to a business address without running afoul of this law. This is true even if the mail is marked "personal" or "confidential." To lower the risks associated with opening an individual's mail, many businesses prohibit employees from receiving personal mail at work.

Unionized Workforce Issues Concerning Monitoring in the U.S. Workplace

Collective bargaining agreements can modify the obligations that an employer has to its workforce. In a unionized workforce, employers face additional complications regarding employee monitoring. For example, the National Labor Relations Board ("NLRB") held in Colgate-Palmolive Company that covert video surveillance of any portion of the workplace must be subject to collective bargaining. More recently, the NLRB held in Purple Communications, Inc. that, absent special circumstances, employers who provide employees access to employer email systems during off-work hours were not permitted to monitor communications protected by the National Labor Relations Act ("NLRA"), such as union organizing. As these examples illustrate, the NLRA may impose additional obligations on employers regarding the monitoring of a unionized workforce or a workforce attempting to unionize.

Mobile Computing and "Bring Your Own Device"

Employee monitoring of devices that the employer owns is generally permitted. Increasingly, however, many companies permit employees to use their personal devices for work purposes. This is done both as a cost-saving measure by the employer, as well as to facilitate ease of communication and productivity by permitting employees to use the same technology at home as in the office. These policies are generally referred to as Bring Your Own Device ("BYOD") policies.23 When employees use their personal devices for business purposes, they have a greater expectation in the privacy of that device. Accordingly, employee monitoring that might be appropriate on company-owned equipment may not be appropriate if an organization allows employees to BYOD. BYOD policies present a number of challenges to employers, particularly when it comes to the security of company information. An employee using his or her personal device, which is outside of the complete control of the employer, has the potential to create security vulnerabilities. Before adopting a BYOD policy, employers are advised to consider the security implications and the legal exposure they may face from, for example, breach notification laws. As a general rule, BYOD policies should prohibit employees from downloading or copying proprietary information onto their personal devices. Data Loss Prevention ("DLP") is the term given to the strategies implemented to avoid the unauthorized access or misuse of sensitive data.24 DLP strategies often employ the use of information security tools, employee training, and administrative standards and policies. DLP practices become particularly important when BYOD policies are implemented. At the same time, however, some DLP strategies involve significant employee monitoring that may not be appropriate on an employee's personal device.

Key Points

Employees have little expectation of privacy in the workplace Employee monitoring practices should be put into a formal written policy Employees should be made to sign an acknowledgement that they have been provided and reviewed these policies Applicable law may either require or prohibit certain types of workplace monitoring The Wiretap Act and the ECPA impose significant limits on employee monitoring - Telephone monitoring is generally permitted because of the one-party consent rule and the exception for a party providing a wire communication service (generally the employer) - Video monitoring is permitted if there is no sound recorded - Email is generally subject to monitoring under the Stored Communications Act because the employer typically provides the communication service; this practice was upheld in Quon - Connecticut and Delaware have enacted additional restrictions applicable to email monitoring in the workplace Monitoring of mail is permitted because mail is "delivered" when it reaches the business Location-based monitoring is permissible if done during normal business hours, done for a business purpose, and properly disclosed - There is a distinction between tracking employees and tracking vehicles Bring Your Own Device ("BYOD") Policies: An employment policy that allows employees to use a personal device for business purposes - Monitoring that might otherwise be appropriate may need to be limited if a BYOD policy is implemented Data Loss Protection: Strategies implemented to avoid the unauthorized access or misuse of sensitive data, including on personal devices Collective bargaining agreements and the NLRA may impact the employee monitoring

Little expectation of privacy in the workplace.

Except for government employees protected by the Fourth Amendment, employees in United States of America have relatively little expectation of privacy in the workplace. Because the employer owns the materials used, the premises where work is conducted, and the tools used by employees, the employer has a large amount of authority to monitor the use of those assets. This includes monitoring computers and IT equipment owned by the employer. Monitoring of computer use is especially prevalent with employers, with methods that include screen captures, key stroke logging, and tracking idle time on a computer.

Best practice to establish formal policies for any workplace monitoring conducted by employers

It is considered best practice to establish formal policies for any workplace monitoring conducted by employers. In some cases, written policies may be required for monitoring to be considered legal and permissible. Companies generally include the following information in such written policies: (1) the purpose of monitoring; (2) what conduct or activities are being monitored (especially with respect to IT equipment); (3) how monitoring is being conducted; (4) what information or records are being maintained; (5) how those records are used; and (6) who those records are disclosed to. It is also considered a best practice to have employees sign consent forms acknowledging these policies.

Video Monitoring

Many businesses use closed-circuit television ("CCTV") in the workplace, both as a security measure and to monitor employees. Because the terms "wire communication" and "oral communication" are defined to include only audible noise,10 video recordings that do not record audio are not subject to the Wiretap Act. Some state laws, however, limit the use of video recording and photography, whether in certain spaces or more broadly. In Michigan, for example, placing an "observing, recording, transmitting, photographing, or eavesdropping device" in a "private place" to monitor "sounds or events" is prohibited.

Location-Based Monitoring

Many employers monitor the location of their employees, often through use of GPS tracking devices on company vehicles. Location monitoring is generally permissible if employee location is tracked during normal business hours, done for a business purposes, and the monitoring has been properly disclosed.19 But there is often a distinction between tracking a company vehicle and tracking an employee individually. California law provides a good example of this dichotomy. California's penal code provides that "[n]o person or entity in this state shall use an electronic tracking device to determine the location or movement of a person."20 That same law, however, provides that it "shall not apply when the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle."21 Similar laws exist in Minnesota, Tennessee, and Texas.22

Reasons employers monitor their employees' activities during work hourS

Many of the reasons that employers monitor their employees' activities during work hours are similar to the reasons why employers conduct background screening. Monitoring employees may increase productivity and work quality, lower the incident of workplace accidents, protect the employer's assets (e.g., it lowers the risk of employee theft), protects the employee's clients (e.g., it lowers the risk of a data breach), and employee monitoring may be required by law.

Excessive monitoring in workspace

Nevertheless, excessive monitoring can raise significant privacy concerns, and some laws specifically prohibit certain methods of employee monitoring. Bugging a workplace to secretly record employees, for example, may run afoul of the Wiretap Act.3 If an employer places recording equipment in a bathroom stall, they open themselves to potential liability in tort,4 or even criminal liability. In addition to any applicable laws, labor contracts may also prohibit various types of employee monitoring.

Laws that strongly encourage, or even require, monitoring of the workplace.

Some laws strongly encourage, or even require, monitoring of the workplace. Telemarketers, for example, are required under the Telemarketing Sales Rule ("TSR") to retain records related to customer calls, such as records of oral "express verifiable authorizations," which indirectly keep significant records of their employees who are on the other end of those calls.2

Technology and Specific Types of Monitoring Activity

The various types of monitoring that are available to employers has expanded over time. New technologies have permitted new methods of employee monitoring, such as location-based monitoring. Other types of technology that have been available for decades, such as video monitoring, have gradually lowered in price, making these methods more economically viable. In addition to the implications of the Wiretap Act and the SCA, other laws may be implicated depending on the manner in which employers monitor their workforce. Below are some other forms of employee monitoring and the laws implicated by their use:

Email Monitoring

Under Title II of the ECPA, called the Stored Communications Act ("SCA"), it is generally illegal to acquire, alter, or block electronic communications while in electronic storage. There is a broad exception to this rule, however, if the conduct is authorized "by the person or entity providing a wire or electronic communications service." In the context of the workplace, the employer is more often than not the entity providing the electronic communication service, thereby permitting it to access stored communications on that service. In the case City of Ontario v. Quon, the Supreme Court specifically upheld an employer's authority to look at an employee's text messages when the employer provided the communication device and the search was conducted to determine whether the employee was abiding by the employer's electronic usage requirements. At least two states, Delaware and Connecticut, have enacted significant additional restrictions on accessing communications that are applicable to employers. In Delaware, it is unlawful for an employer to "monitor or intercept any telephone conversation or transmission, electronic email or transmission, or Internet access or usage without prior written notice and daily electronic notice." Likewise, in Connecticut, "each employer who engages in any type of electronic monitoring shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur."

Telephone Monitoring

While it is generally not legal to intercept a wire communication, the Wiretap Act is an example of a "one-party consent" law. The consent exception often applies in the workplace. Additionally, the ECPA permits employers to monitor unannounced for a business purpose if they are the party providing the wire or electronic communication service (as is often the case) and monitoring is done in the ordinary course of business. Employers must nevertheless be mindful of intercepting wholly-personal phone calls, which are not subject to this exception. Likewise, many states have a two-person consent statute requiring all parties consent prior to interception.

Requirements Under the Wiretap Act and the Electronic Communications Privacy Act of 1986 (ECPA)

While the Fair Credit Reporting Act ("FCRA") is perhaps the most far-reaching federal law dealing with the pre-employment stage of the employer-employee relationship, the Wiretap Act, as amended by the Electronic Communications Privacy Act ("ECPA"), is the federal law with the greatest implications for employee monitoring. The Wiretap Act places restrictions on monitoring of the physical workplace, as well as monitoring of email systems and telephone communications. As you learned in Module III.A.5, the Wiretap Act broadly prohibits the interception of "wire" (e.g., telephone), "oral" (e.g., water cooler comments), and "electronic" (e.g., email) communications, with a violation constituting a criminal offense.5 Different rules, however, apply to each category of communication, which has implications for various types of employee monitoring. It is important to note that there is no preemption of state law under the Wiretap Act. It is often the case that state laws restrict various types of employee monitoring to a greater degree than the Wiretap Act restricts such monitoring.