Ethics, Law, and Compliance in Workplace Privacy Monitoring

Introduction: Balancing Privacy and Employer Oversight

There is always a need to balance the individual's right to privacy with a government or business's right to investigate breaches of security, whether of a technical or non-technical nature. This tension sits at the heart of workplace ethics, law, and compliance. As the Privacy Rights Clearinghouse notes, "new technologies make it possible for employers to monitor many aspects of their employees' jobs that they could not previously, and such monitoring is virtually unregulated. Therefore, unless company policy specifically states otherwise (and even this is not assured), your employer may listen, watch, and read most of your workplace communications" (Fact Sheet 7, 2012).

Most companies take advantage of the fact that the law is largely on their side regarding workplace monitoring. "Of the 43% of companies that monitor e-mail, nearly three-fourths use technology to automatically monitor e-mail. And 28% of employers have fired workers for e-mail misuse" (Fact Sheet 7, 2012, Privacy Rights Clearinghouse). Employers also monitor web-surfing and block specific websites to reduce the risk of security breaches that can shut down the company and bring productivity to a halt, as well as to ensure that employees are performing the work they are being paid to do rather than spending company time on personal social media.

The Legal Landscape of Workplace Monitoring

The question of an employee's "expectation of privacy" defines the degree to which employers may lawfully monitor employee behavior. Workplace privacy law in the United States does not provide uniform protections; rather, the legality of monitoring often turns on whether the employer has issued a clear, written policy informing employees of the extent of surveillance. The absence or presence of such a policy has proven decisive in litigation, as the cases below illustrate.

Key Court Cases on Employee Privacy Expectations

Two contrasting court decisions demonstrate how policy language directly determines legal outcomes. In the New Jersey case of Stengart v. Loving Care Agency, Inc. (2010), the court found that "the employee had a reasonable expectation of privacy in the use of a personal web-based email account — even though accessed from the employer's computer — where the use of such an account was not clearly covered by the company's policy and the emails contained a standard hallmark warning that the communications were personal, confidential, attorney-client communications" (Adams, 2012).

By contrast, in the California appellate case of Holmes v. Petrovich Dev. Co. (2011), the court found in favor of the employer's right to monitor employee email. In that case, the employee had been explicitly warned that her email correspondence from work would be monitored and that the employer's computers "were to be used only for company business and that employees were prohibited from using them to send or receive personal email" (Adams, 2012). Even though she was contacting her attorney, "the court held that the emails did not constitute confidential communication between client and lawyer" (Adams, 2012). The employee was therefore found to have had no reasonable expectation of privacy.

These two cases illustrate the critical role that explicit, written policy plays in determining the legal rights of both employers and employees. The attorney-client privilege, ordinarily a strong protection, was effectively waived in Holmes because the employee communicated over a monitored channel after being clearly warned.