Previously, employment law attorney Robert L. Bailey discussed how technology enables employers (and anyone else) to track what others are doing on the Web and if that is even a good idea. Now, he looks at the legal aspects you must consider if you decide to monitor employees’ electronic activities.
Regulation of employers monitoring their employees’ electronic activities consists largely of ad hoc rules governing specific circumstances of the act of monitoring and what the employer does with the acquired information. Individually, states can have several laws governing the matter. The federal laws most directly relevant to employers’ monitoring of employees’ electronic communications consist of the various titles of the Electronic Communications Privacy Act of 1986, the Federal Wiretap Act (intercepting telephone calls), the Stored Communications Act (accessing electronically stored information), the Pen Registry Act (recording certain metadata about electronic communications like telephone numbers and e-mail contact information), and the Computer Fraud and Abuse Act.
Generally, these acts and their state-law counterparts prohibit the interception or acquisition of communications and data without consent when the person involved had a reasonable expectation of privacy. As a result, proving that consent was obtained can be the best defense (but note that some jurisdictions require consent from all parties, while others require consent from just one).
Your use of monitoring technology must not invade privacy rights. States have rules protecting personal privacy (including the rights to seclusion, to control the use of one’s name and likeness, to control publication of certain personal facts, and not to be depicted in a false light). Some states also have specific statutory schemes proscribing workplace intrusions like taking photographs, making video recordings without consent, and using two-way mirrors, peepholes, hidden cameras, or similar viewing devices. And common-law rules prohibit defaming a person’s reputation by slander or libel.
In addition, you may not retaliate against employees for protected conduct, including engaging in whistleblower activities, filing workers’ compensation claims, declaring bankruptcy, and fulfilling National Guard obligations. Largely at the instigation of tobacco companies, several states have even enacted statutes forbidding employers from discriminating against employees for any lawful off-duty conduct.
You also must be careful not to monitor employees in a way that would chill (dissuade) them from participating in certain union-related or protected concerted activities (like discussing conditions of employment on Facebook). An employer that takes adverse employment actions after monitoring its employees engaging in protected concerted online activities risks drawing the ire of an enforcement agency like the National Labor Relations Board.
Federal and state laws also prohibits discrimination based on certain protected characteristics, including gender, age, disability, national origin, sexual orientation, and political affiliation. The simple act of engaging in monitoring that uncovers protected activities or status can strip your company of the defense of ignorance, and a disgruntled employee can be expected to raise these issues following any adverse employment decision.
Technology for HR manual and HR Laws subscribers’ tip: Get tips for writing your Internet use policies and more online.
You should be aware of which technologies you can monitor and the many valid reasons for doing so. But you also must recognize the limitations on monitoring. To ensure that your efforts comply with the law, you should seek competent legal advice before undertaking any interception of electronic communications or data or disclosing any material obtained through monitoring.
The best policy is to have the best policy. That is, carefully craft, correctly disseminate, continuously train on, consistently enforce, and constantly update a broad, flexible written electronic activity and monitoring policy that applicants and employees read and expressly agree to in writing. At a minimum, your policy should explain:
- the categories of on- and off-duty activities that your company considers inappropriate,
- the lack of privacy for employees using employer-owned, employer-funded, or employer-operated equipment, and
- that you will monitor all (or specific) activities — at and away from work — to the fullest extent permitted by law without further notice.
A good policy should prevent employees from forming a reasonable expectation of privacy, at least to the extent the courts are willing to accept it as reasonable. Finally, consistent enforcement will reduce the likelihood of an employee claiming that you are using your monitoring policy as a pretext for any prohibited adverse employment action.
Robert L. Bailey is of counsel with Steptoe & Johnson in the firm’s Charleston, West Virginia, office. He is co-chair of the West Virginia University Institute of Technology Computer Science Advisory Council. He may be contacted at robert.bailey@steptoe-johnson.com.
Need help crafting your electronic workplace policies? The Technology for HR manual gives you policy pointers as well as talking points to bring up with employees.