Even with a strong written policy that all computer use, including employee e-mails, was subject to its review, a New Jersey company acted unlawfully in accessing and reading e-mails written on a company computer and sent to an ex-employee's attorney. In Stengart v. Loving Care Agency, Inc., the New Jersey Supreme Court unanimously concluded that the company and its attorneys violated a former employee's rights of privacy, and interfered with her attorney-client relationship, when it accessed and read e-mails she sent to her attorney concerning her employment concerns.
Loving Care, a home care nursing and health services agency, employed Maria Stengart as Executive Director of Nursing. Loving Care provided Stengart a laptop computer to conduct company business. From that laptop she could access the Internet and send e-mails using both her company e-mail and a private "Yahoo" address.
Unbeknownst to Stengart, browser software automatically copied each webpage she viewed which was then saved on the computer's hard drive. Unless deleted and overwritten with new data, those temporary Internet files remained on the hard drive.
The company had a written computer use policy, which stated the company's right to review, audit, intercept and access and disclose all matters on the company's media systems at any time with or without notice, including e-mail and voicemail messages, Internet use and computer files. These were considered part of the company's business and such communications were not to be considered private or personal to any individual employee. The policy stated that the principal purpose of e-mail was for company business, but occasional personal use was allowed.
Stengart used her company laptop to send Yahoo e-mails to her attorney about her situation at work. Soon thereafter she left Loving Care and returned the laptop. She then sued Loving Care for, among other things, constructive discharge, retaliation, and harassment based on gender, religion and national origin.
In anticipation of discovery, Loving Care hired a computer forensic expert to recover all files stored on the laptop including the e-mails that were automatically saved on the hard drive. Loving Care's attorneys reviewed the e-mails and used information culled from them in the course of discovery. In response, Stengart's lawyer demanded that communications between him and Stengart, which he considered privileged, be identified and returned. The company's attorney disclosed the documents but maintained that the company had the right to review them. Stengart sought relief in court, alleging that Loving Care and its attorneys invaded Stengart's privacy and attorney-client relationship by reading and using the documents. Ultimately, the New Jersey Supreme Court held that Loving Care's attorneys violated a state rule by failing to alert Stengart's attorneys that it possessed the e-mails before reading them. The case was returned to the trial court to determine if Loving Care's attorneys should be disqualified or sanctioned.
The Supreme Court decided that the company's policy, even though seemingly strongly worded, left sufficient ambiguity that Stengart could have developed a reasonable expectation of privacy in her Yahoo even though sent using the company's laptop. The Court referenced language in the company policy that allowed "occasional personal use" and did not define "media systems and services" as company property. The policy, according to the Court, "does not warn employees that the contents of such e-mails are stored on a hard drive and can be forensically retrieved and read by Loving Care." The Court approved language from the appellate panel, which stated "an objective reader could reasonably conclude that not all personal e-mails are necessarily company property. In other words an employee could retain an expectation of privacy in personal e-mails sent on a company computer given the language of the policy."
The Court rejected the notion that the ownership of the computer was the sole determinative factor and instead explained that there must be a nexus between company policies and the employer's legitimate business interests. Of great significance to the Supreme Court was the fact that the e-mails in question were between Stengart and the attorney who represented her in the subsequent employment based litigation. The Court noted "society's important interest in shielding communications with an attorney from disclosure" and held that this interest "outweighed the company's interest in upholding the policy."
The Court pointed out that two attorneys from the firm representing Loving Care reviewed the e-mail communications between Stengart and her attorney but did not advise Stengart's attorney until months later. When Stengart's attorney sent a letter demanding that the e-mails be identified and returned, Loving Care's attorneys responded by identifying the e-mails but asserting that Stengart had no reasonable expectation of privacy in light of the company's policy on electronic communications.
The Supreme Court found two principal areas of analysis, first the adequacy of the company's policy and second the important public policy concerns raised by the attorney-client privilege. First, the Court concluded that ambiguity in the company's computer use policy did not adequately prevent Stengart from obtaining a reasonable expectation in the privacy of the Yahoo e-mails. "The policy does not address personal accounts at all. In other words, employees do not have express notice that messages sent and received on a personal, Web-based e-mail account are subject to monitoring if the company equipment is used to access the account. The policy does not warn employees that the contents of such e-mails are stored on a hard drive and can be forensically retrieved and read by Loving Care." Further, the policy's acknowledgment that occasional personal use of e-mail was permitted, "creates ambiguity about whether personal e-mail use is company or private property."
The discussion of the attorney-client privilege seems to indicate that this was the Court's main focus and that the result might have been different if Stengart's e-mail exchange was with someone other than her lawyer.
The Court concluded that Stengart had a reasonable expectation of privacy in the e-mails she exchanged with her attorney on Loving Care's laptop. She took steps to protect the privacy of those e-mails and shield them from her employer by using a personal password protected e-mail account instead of her company e-mail address and did not save the account's password on her computer.
The conclusion of the Court's opinion was somewhat astounding. The Court first stated that the decision "does not mean that employers cannot monitor or regulate the use of workplace computers" and that companies can adopt lawful policies relating to computer use. However, the Court stated, "employers have no need or basis to read the specific contents of personal, privileged, attorney-client communications in order to enforce corporate policy." The Court concluded this discussion by stating gratuitously: "Even a more clearly written company manual - that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee's attorney-client communications, if accessed on a personal, password-protected e-mail account using the company's computer system - would not be enforceable."
Employers may adopt and enforce computer use policies that are strongly and clearly worded and leave no room for ambiguity. If an employer wishes to retain the prerogative to review all use made by employees on company owned electronic devices, the policy should be worded in such a manner as to leave no possible chance of doubt as to coverage. In the Stengart case, the Court concluded that there was ambiguity in terms of whether the employer could review e-mails sent and received by employees on personal e-mail accounts. The Court also was impressed that the employer had in explicit words allowed employees to make modest use of the company computer for personal purposes. Employers might find it difficult to issue a total prohibition on employee personal use of computers. However, unless personal use is totally prohibited, an employer runs the risk of encountering a situation similar to that which occurred in Stengart.
This case was decided by the New Jersey Supreme Court and thus is not binding in California. To our knowledge, neither the California Supreme Court nor the Court of Appeal has yet dealt with this specific issue. California, like New Jersey, has a strong public policy favoring the sanctity of attorney-client communications. A California court might reach the same result under similar facts, but it might not conclude that an employer is prohibited from enforcing an across the board prohibition on use of company electronic devices even for the purpose of communicating with legal counsel.
Jeffrey Freedman is a partner in the management law firm of Liebert Cassidy
Reprinted and/or posted with the permission of Daily Journal Corp. (2010).