Introduction

As surveillance technology improves, employers increasingly monitor their employees, both in and out of work.  Public sector employees enjoy First and Fourth Amendment protections, but private sector employees lack these fundamental protections.  State and federal common law and statutory protections developed during the past twenty years provide a handful of remedies for private workers when employers unduly infringe upon their right to be let alone.  Nevertheless, these laws fail to provide adequate protection in light of technological advances that make employer monitoring simple, cheap, and surreptitious.   Employees, with limited exceptions, should be given greater protection of their privacy and freedom of expression both in and especially out of the workplace.  

This paper explores the legal basis for privacy in and out of the workplace, specifically off- duty employee monitoring in the private sector.  Part I details this history, discusses disturbing trends in employee monitoring, and explores open legal and ethical questions stemming from the increase in employee monitoring.  Part II reviews the interests implicated by employee monitoring and suggests a balancing point to stem employer invasiveness but protect against employee malfeasance.  The current common law protections described in Part III as well as the statutory protections covered by Part IV demonstrate that, in practice most law misses the mark and leaves employees with insufficient rights against invasive monitoring.  Finally Part V proposes new federal legislation to close the gaps in employee privacy law.

I.  Social and Historical Context of Off Duty Monitoring

A.  History of Worker Monitoring

The separation between work and home life is a recent phenomenon, developed during industrialization and urbanization.[1] The typical family in preindustrial society received little privacy; “business was conducted in the house, and the house was a crowded bustling place with little opportunity for the family to retreat in isolation.”[2]  It was not until city dwellers started working predominantly in offices that the home life was thought of as separate from work life.[3]  As Justices Warren and Brandeis stated, “[t]he intensity and complexity of life, attendant upon advancing civilization, have rendered necessary some retreat from the world. . .”[4]

Today privacy is taken, albeit mistakenly, for granted.[5]  However, even in the early Twentieth Century, the concept of privacy was challenged by the desire to monitor employees in and out of the workplace.  For example, Henry Ford created a “Sociology Department . . . . responsible for ferreting out immoral and undesirable behaviour on the part of Ford employees.”[6]  Today news stories frequently describe how employees are disciplined for their off duty behavior.[7]  Underlying these stories is a private employer’s right to substantially monitor their employees.  Employers are given broad discretion, with some exceptions, to log and monitor an employee’s phone use, voicemail,[8] and much more.

B.  Recent Developments of Off Duty Monitoring

An American Management Association study found sixty six percent of employers monitor workers' Web site connections; forty three percent review e-mail; forty percent of companies analyze the contents of outbound e-mail; forty five percent track content, keystrokes, and time spent at the keyboard; and thirty percent have fired for misuse of the internet.[9]  RFID is another tool many employers use to track the location of their employees in and out of work, although not much is known about the extent to which this is used for off-duty monitoring.[10]  Eight percent of employers now use GPS technology to track wherever their employees go.[11]

Aligo's WorkTrack is a technology that allows employers to monitor the location of their employees over the internet using employer provided cell phones.[12]  Technologies like Aligo promise to increase productivity, efficiency, and overall cost savings.[13]  However there are serious invasion of privacy concerns. First, the product has an “on break” mode, which allows employers to know when an employee is not working.[14]  These monitoring features often do not shut off at the end of the workday, allowing the employer to monitor even off duty behavior.[15]  Aligo and similar technologies are used by large employers such as Sun Microsystems, Lucient Technologies, and Motorola.[16]

The trend in monitoring appears to be increasing.[17]  As technology becomes more accessible, monitoring becomes easier. The social networking revolution is one prime example of how, if given easy means, employers will pry into the lives of their employees.  Employers increasingly use social networks to screen job applicants,[18] “Forty-five percent of employers use social networking sites to research job candidates.”[19]  Employers now have the power “to gather enormous amounts of data about employees, often far beyond what is necessary to satisfy safety or productivity concerns.”[20]  It is very likely that without greater privacy protections, as GPS and RFID monitoring become less expensive that more employers will begin utilizing it.

C.  Unanswered Legal Questions

Underlying the employer’s power to collect data on employers is the long line of court decisions upholding an employer’s right to monitor.  The Supreme Court’s latest of decision was City of Ontario v. Quon. Although concerning public employees, and the First and Fourth Amendments, the Quon decision raised interesting policy concerns regarding the potential importance of electronic communications as essential means of for self expression.[21]  However, the court also mentioned that these devices are so easily and cheaply available that one could easily purchase a device for personal use, defeating any expectation of privacy.[22]  This decision failed to analyze the basis for which an employee has a reasonable expectation of privacy,[23] so the expectation of privacy regarding digital monitoring is still not clear.[24]

II.  Should There Be a Line Between Work and Private Life Online? If so Where Should We Draw the Line?

A.  Employer’s Perspective

First, from an employer’s perspective, monitoring of employees is within their discretion because of the nature of at-will employment.  Generally, with the exception of Montana, employment is considered at will in the U.S,[25]  meaning employees can be fired, or leave, at any time for whatever or even no reason.[26]  Employers argue that if employees do not want to be monitored they can leave.

Employers also need to protect the integrity of their business and prevent unlawful activity.  Never before has so much damage been accomplished by low level employees through mindless behavior and social media.  One example of this occurred in April 2009 when two Domino’s Pizza employees posted several videos of disgusting, and unsanitary activities in preparation of a customer’s pizza.[27]  The video went viral and was responsible for a steep decline in stock values.[28]

Employers also need to protect against the leaking of confidential data.  In February 2010 the personal information of Shell employees in dangerous parts of the work was leaked to a blogger and published.[29]  This leak posed a great threat to the lives of these individuals; Shell employees have been attacked, and kidnapped in places like Nigeria.[30]  Similarly, the risk of liability is high for leaking of trade secrets and for initial public offerings before they are public.[31]

Productivity concerns also cause many employers to monitor employees. Even minor personal internet use in the workplace can lead to millions in lost profits.[32]  Off-duty, employers can claim fewer interests in monitoring, but in a world where telecommuting is on the rise, the line between office and home is blurring and this means that an employer may need to monitor an employee while working remotely.  Additionally, employers may want to check against irresponsible drinking, and negligent driving as evidenced by traffic tickets, especially if the worker is in a driving profession.[33]

B.  Employee’s perspective

When employers monitor their workers morale can decrease substantially.[34]  Monitoring may also undermine intended purposes of increasing productivity by spurring stress related ailments such as increased illness and absenteeism.[35]  Information gleaned from social media may also be inaccurate, forgeries of facebook accounts are commonplace.  Moreover, monitoring is usually inequitable where employees are not represented by unions, “[b]ecause of the substantial interests individuals have in both employment and in privacy, invasive monitoring puts employees in a ‘catch-22’ situation, forcing them to sacrifice reasonable expectations of privacy because of their need to work.”[36]

Technological advances exacerbate the invasiveness of monitoring and allow employers to know intimate details about an employee’s life, as one commenter notes “what happens when an employer virtually observes the employee stopping during her lunch hour at Planned Parenthood and fires her based on assumptions about her position on family planning methods?”[37]  Further, technology like social networking has become such an integral part of self expression.  Although in the context of cell phones, the Supreme Court acknowledged that it may be that some forms of communication are “essential means or necessary instruments for self expression, even identification.”[38]  This is just as true of social media.[39]

Employer monitoring has already altered the online behavior of many bloggers and social networking users, “29% of employees have become more conservative online because they fear that ‘employers can use anything and everything as an excuse to fire” them in a down economy.”  Social networking and blogging merits protection because not only is it integral to self expression, it serves a socially useful purpose by keeping people connected, and sharing and breaking news in a more effective way than traditional means ever could.[40]  Although First Amendment protection does not extend to workers in the private sphere, employer monitoring can affect speech in ways that would be unconstitutional if done by a government employer.  Most Americans spend nearly a quarter of their lives at work;[41] do we want constitutional protections to extend to only three quarters of a person’s life?  Do we want to allow employers to treat their employees like sex offenders, under constant surveillance?

Most social networking users begin using in their teens; because of this many of these users have material from their youth that depicts less than mature behavior.  Young people’s past lawful, but unfortunate conduct should not harm their employment prospects later.[42]  Even those with private profiles, as discussed in Part IV may still be at risk for having their profiles hacked by employers. Without protections we allow employers to be voyeurs and produce a chilling effect to use of online communications.[43]  Finally, the right to adequate livelihood is an international human right; one should not have to waive expression rights to enjoy the right to a livelihood.[44]

C.  Other Policy Considerations Make Line Drawing Difficult.

On one hand the free flow of information should not be impeded to protect what is usually discriminated against: misconduct and unpopular speech.  We should not have to protect people from making public fools of themselves.  Nevertheless, as the lifestyle discrimination statutes and case law discussed in Part IV attest to, employers who monitor off duty scrutinize a great deal of legal and socially important behavior including political speech.

Another issue is that the internet is by definition public, and speech is not being infringed by any unconstitutional means by employers checking social media.  However, off-duty social networking use merits privacy protections because employees have a higher expectation of privacy off the clock.[45]  Although any manager could check out an employee’s Facebook, there is a difference when this action is done with the intention to dig up dirt.  This argument also fails to consider that employers may find ways to view even non public profiles.

Finally, we must also consider whether employers should be punished just because they are using information for actions socially disapproved of.  After all, there are many anti-discrimination and collective bargaining labor laws designed to prevent employers from the really harmful discrimination.  However, anti-discrimination lawsuits are not a simple means of protecting the worst forms of discrimination; they are among the most difficult cases to prove.[46]  Employers who reserve the right to monitor of social network use and GPS location off duty can relatively easily use any information they gather as pretext for more heinous action.  Finally, the low interest the employer has in off-duty behavior, and the high value of privacy in U.S. culture, tips the balance in favor of the employee.  Although when employers suspect serious misconduct that would expose the employer to liability or lost profits, they should be allowed to monitor the employee with proper notice.

III.  Common Law Protections Are Generally Not Available for Digital Off-Duty Monitoring

Private sector privacy actions are typically based in the common law tort of intrusion upon seclusion.[47]  The elements for an intrusion claim are “[1] [intentional] intru[sion], physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . [and] [2] the intrusion would be highly offensive to a reasonable person.”[48] In other words, did an individual have a reasonable expectation of keeping a matter private which the employer intruded upon.  Voluntary disclosure of information is a problem for social networking users.[49]  Some jurisdictions allow for an employer to use “intrusive and even objectionable means to obtain employment-related information about an employee.[50]  Generally, invasion of privacy actions will not be available to bloggers and social network users given the public nature of these activities.[51]  However, invasion of privacy claims may be available for monitoring off-duty personal cell phones,[52] home computer use, and location via GPS.  Still, these claims will probably fail if the employer reserves the right to monitor in an employee handbook.[53]

One recent exception to waiver of a reasonable expectation of privacy via employer notice has been found if the communication is privileged.  In Stengart v. Loving Care Agency, Inc., a home care nursing professional used her employer provided laptop to communicate with her attorney via a web-based yahoo mail account.[54]  The employer collected these emails in preparation for a lawsuit the employee filed against it. Although the employer use policy stated that employees can expect to be monitored, the New Jersey Supreme Court held that the employee had a reasonable expectation of privacy in her attorney-client privileged emails even on a work computer.[55]

IV.  Current Statutory Causes of Action Provide Little Protection.

A.  ECPA Claims Against Off-Duty Monitoring Fail.

The Electronic Communications Privacy Act (ECPA) was enacted “to provide greater protection of an individual's privacy from emerging communication technologies in the private sector.”[56]  The Act “prohibits the intentional or willful interception, accession, disclosure, or use of one's electronic communication.”[57]  It extends the protections of the Wiretap Act to electronic communications; it allows for criminal prosecution as well as civil action.[58]  However, “[c]ase law interpreting ECPA is virtually uniform in finding that employers can monitor with or without consent, even without notice.”[59] Further, courts disagree as to whether the interception of emails stored on a centralized server are prohibited by ECPA.

All that is necessary for a party to waive their privacy is to give so called consent, which can easily be done by the employer providing a poster or notice in a policy handbook that communications will be monitored.[60]  Further, consent or notice is not required in many federal jurisdictions when equipment is used in the course of business.[61]  Because the EPCA effortlessly allows employers to skirt the statute’s requirements, off-duty monitoring suits do not succeed against employers.[62]

B.  SCA Claims Require Employers to Behave Extremely Irresponsibly.

The Stored Communications Act (SCA) prevents communications companies from turning over communications to the government, but also prohibits hacking and exceeding authorization to view information.[63]  In Konop, an employee of Hawaiian Airlines created a blog, requiring authorization and terms of use that prohibited the airline management from reading and any disclosure of the contents of the blog.[64]  Hawaiian Airlines used the usernames and passwords of other employees to access Konop’s blog.  The company then terminated Konop after reading his critical commentary of the airline's president and labor practices. The court held that because only a website user or provider could authorize a third party's access under SCA, summary judgment should not have been granted for this claim.[65]

Although the employee here was given a cause of action, the remedy was limited because the court decided that “for a website such as Konop's to be ‘intercepted’ in violation of the Wiretap Act, it must be acquired during transmission, not while it is in electronic storage.”[66]  The First Circuit disagreed with this in United States v. Councilman, holding that communications in storage can be intercepted in violation of the ECPA.[67]

Another shortcoming of these statutes is that neither EPCA or SCA would not protect all instances of employer digital snooping.  The following alteration of Konops facts illustrates this.  If Hawaiian Airlines was given the Facebook login information of Konop’s Facebook friend, and used it to login and see Konop’s critical wall posts of the company; the employer would avoid liability under SCA because there is no Facebook policy prohibiting the use of another’s login information.[68]  ECPA and SCA weaknesses points to the need for stronger statutory protections in the area of employee privacy.

C. CFAA Generally Does not Apply to Employers.

The Computer Fraud and Abuse Act (CFAA) is a criminal statute that prohibits the unauthorized access of computers involved in interstate or foreign commerce.[69]   However, unless an employer hacked into an employee’s personal computer, an action would not be possible against a monitoring employer.

D. State Protections, Statutory Privacy and Lifestyle Discrimination Statutes Mostly Miss the Mark.

Though as many as ten state constitutions explicitly provide privacy protections, nine of these provisions are interpreted to require government invasion of privacy.[70]  California is exceptional in that the state constitution provides a remedy for invasion of privacy actionable against private individuals.[71]

Twenty five states protect against employee discrimination for the use of tobacco and other legal products off-duty.[72]  However, these laws would not protect against employer monitoring and adverse action based on political or other lawful expression gleaned from social network use.  Five states prohibit adverse action based on political behavior.[73] Only California, Colorado, New York, and North Dakota protect against discrimination from legal off-duty behavior in general,[74] but these statutes may be limited where an employer declares a policy that prohibits blogging about work.[75]  Limiting employee monitoring is not a popular option even when tailored narrowly; Michigan and Illinois are the only states that prevent an employer from monitoring political activity.[76]  Only eleven states have some form of RFID use restrictions, and none have GPS monitoring restrictions.

V.  “Privacy Protection in Employment Act” a Proposal to Close Privacy Gap

Congress made two attempts to pass employee privacy legislation, the broad Privacy for Consumers and Workers Act in the 1990s and the toothless Notice of Electronic Monitoring Act in 2000.[77]  Though these failed, federal legislation is necessary for several reasons. The courts are too slow and lack the technological expertise to adequately keep privacy up to date with technological changes.  Moreover, “providing protections for employees on a state-by-state basis can cause “a race to the bottom” with states purposefully providing low protections to encourage business.”[78]  To close the gaps in employee privacy law Congress should pass what some have call the “Privacy Protection in Employment Act”.[79]  This Act would generally prevent all off-duty monitoring of employees in the home, and in any secluded area. Employers would only be permitted to monitor off-duty behavior if the employer has “reasonable grounds to believe the employee is engaging in behavior that will cause a significant concrete harm to the employer.”[80]  However, the employer must carry the burden to prove reasonable grounds.  An employer also must put the employee on notice of the scope and duration of any monitoring, and provide them an opportunity to review all information collected. The Department of Labor would also monitor compliance with these provisions, and a violation of the Act would allow a civil action with an allowance for plaintiff’s attorney fees.[81]

VI.  Conclusion

Statutory and common law protections show that there should be a line between work and private life even in this age of diminishing privacy.  However, these protections are inadequate to keep up with monitoring techniques.  Although there are important interests in promoting the free flow of information and the profitability of businesses; the risk for discriminatory use of information is great.  Interests in privacy must be balanced against interests in security of employment and reflect well reasoned normative views of society.  This can be accomplished by enacting legislation like the Privacy Protection in Employment Act.