Communication Monitoring in Quon v. Arch Wireless

Last month, the Ninth Circuit Court of Appeals held that employees have a reasonable expectation of privacy in the content of text messages received or sent via employer-issued pagers.  (Quon v. ArchWireless Operating Co., Inc. 529 F.3d 892 (9th Cir. 2008).)  The Ninth Circuit also ruled that the employer’s text message provider, Arch Wireless, violated the Federal Stored Communications Act, finding that it was an electronic communications service, and thus, it could not release the private data without the lawful consent of either the sender or the recipient of the communications. The employer-subscriber, did not have the right to consent to the release of the text-message transcripts.

The Quon decision clarifies, but does not create new limits on an employer’s ability to control and monitor its electronic communications resources. Quon serves to remind employers that it is important that they formally adopt, effectively communicate, and consistently enforce their policies to protect their right to monitor all electronic communication resources, including communication services outsourced to third-party service providers. 

In Quon v. Arch Wireless, the City of Ontario Police Department issued its police officers alpha numeric text-messaging pagers.  Under the contract, Arch Wireless provided the City with 2500 characters per month for each pager it issued to its employees.

Sergeant Quon went over the character limit amount three or four times.  The lieutenant responsible for collecting payment from the employees for overage charges informed Sergeant Quon that if he paid the overage charges, the City would not audit his text messages to confirm they were work related, as required by Department policy.  Sergeant Quon paid the City the overage charges each time he was requested to do so.  His text messages included personal and sexually explicit messages to other employees and his wife. 

Eventually, the City became concerned about the overage charges.  The City conducted an investigation to determine whether it needed to increase the character amount under its contract, assuming the overage charges were due to work related communications.  As part of the investigation, the City obtained the transcripts of Sergeant Quon’s text messages from Arch Wireless.  The electronic communications were transmitted via the Arch Wireless computer server and equipment.  Neither the City nor Arch Wireless provided Sergeant Quon or the other senders and recipients of the text messages with notice that the City would be obtaining the transcripts.  

Sergeant Quon, his wife, and other employees filed a complaint against Arch Wireless alleging violation of the Stored Communication Act, 18 U.S.C. §§ 2701-2711 (1986), and against the City, the Police Department, and the Chief, for violation of their right to be free from unreasonable searches and seizures pursuant to the Fourth Amendment to the United States Constitution, and for violation of their privacy rights under California’s Constitution.

What Employers Should Do in the Wake of The Quon Decision

1.         Adopt a Formal Written Policy and Obtain a Signed Acknowledgment from all Employees that the Employer’s Electronic Communication Resources Are Subject to Monitoring

The Court opined, citing to the recent case of United States v. Forrester, 512 F.3d 500, 510 (9th Cir.2008), that text messages are analogues to e-mail and letters, and therefore carry an expectation of privacy in the contents of the communications.  However, as with individuals who mail letters or use e-mail, users of text messaging services do not have a reasonable expectation of privacy in the address (to/from) information nor in the size of the communication, because this information must be communicated to the service responsible for routing and delivering the messages.  Thus, employees have a reasonable expectation that the content of their text messages are private unless they consent to monitoring. 

For employers, this language reinforces their right to monitor electronic communications in the workplace so long as the employee has provided consent. Employers should thus ensure all employees have signed an employer policy or release acknowledging the employer’s right to monitor or audit its electronic communication resources, including, but not limited to computers, the network, equipment, and other electronic devises.  The policy should also inform employees that the electronic communications resources are limited to business related use and thus employees should not have an expectation of privacy or confidentiality in using these resources.

            As indicated above, employees do not have an expectation of privacy in the routing information or in the size of their communications.  Employers have access to this information by simply reviewing the monthly bills.

2.        Follow Your Written Policy

In Quon, while the City did not have a written policy specifically addressing the use of text-messaging pagers, the City did have a general “Computer Usage, Internet and E-mail Policy” that advised employees that the City reserved the right to monitor all network activity including e-mail and Internet use.  Sergeant Quon signed an acknowledgement of the computer use policy the year before he received the City issued pager.  The City also verbally informed the employees that text-messages on the employer-issued pagers were covered by the City’s policy and were subject to auditing.  So why did the Ninth Circuit find this was not enough to put the employees on notice that their text messages were subject to inspection?

The Court’s finding with regard to Sergeant Quon’s expectation of privacy turned on the Police Department’s informal policy and practice of not auditing text-messages if the overage amounts were paid by the employee who incurred the charges. The Court  found that the “operational reality” at the Department was that the text messages had not been audited for a period of eight months and that for several months, Sergeant Quon had paid the overage costs without anyone auditing his text messages.  The Appellate Court found that through these actions the Police Department created an informal policy.

Quon therefore teaches that employers must consistently apply their written policy.  Employers should train their employees about the electronic communication resources policy, and they must ensure that managers charged with enforcing it do not create exceptions to the rules.  If the employer policy is not enforced, followed or if it is diminished by actions that contradict it, a court may find that employees have an expectation of privacy under those circumstances. 

3.         Limit Communication Resources to Those that are Routed and Stored on the Employer Server and Equipment or Alternatively, Obtain A Specific Releases for Information Stored by a Third Party

The Stored Communications Act prohibits providers of communication services from releasing private communications except under specific circumstances.  The Ninth Circuit’s analysis of whether ArchWireless violated the Stored Communications Act required that it determine whether ArchWireless fell into the category of Electronic Communications Service (ECS) or Remote Computing Service (RCS). 

An ECS provides its clients with wire or electronic communications services, such as e-mail.  The Stored Communications Act prohibits an ECS from releasing the contents of a communication in electronic storage except to the sender or recipient of the communication. 

On the other hand, an RCS provides its clients with computer storage or processing services “by means of an electronic communications system.” For example, subscribers, such as banks or hospitals, may contract with an RCS for computer processing or storage of records. While the information is communicated electronically for storage or processing to an RCS, providing communications services is not the main purpose of an RCS. Under the Stored Communications Act, an RCS may release the contents of a communication with the lawful consent of a subscriber. Thus, for example, if an employer uses an RCS to store certain employee files, the employer as the subscriber has the right to access those employee files without the consent of the employee.

The Ninth Circuit rejected the trial court’s finding that ArchWireless was an RCS.  The Appellate Court found that ArchWireless’ primary function was to send and receive electronic communications (by allowing users of the pagers to receive and send text messages) which fell precisely within the definition of an ECS.  ArchWireless stored the communications temporarily or for backup purposes; this type of storage by an ECS was contemplated under the Act. ArchWireless did not provide the City with either “processing services” or “computer storage services,” the primary functions of an RCS. 

Generally, employers route and store their e-mail on their own servers and equipment.  However, text messages, which are communicated via cellular telephones or pagers, are routed through a wireless communications provider which often only temporarily stores the record of the communication. 

If an employer wishes to avoid the uncertainties that arise when messages are routed through the network of an outside communication service provider, the employer may chose to limit its communication resources to those that are routed through the agency’s server and equipment.  For example, certain cellular telephones have software that allows the employer to route all communications through its network.

Additionally, in light of this ruling, companies in the business of providing electronic communications services will likely require a specific waiver from the end user of an electronic device (such as a pager or cellular telephone) as a condition of releasing information to the employer (the subscriber).  For this reason, employers should obtain a signed release from all employees that allows the employer to receive information pertaining to communications transmitted via ECS providers.   

            4.         When in Doubt, Proceed with Caution

Finally, employers should keep in mind that privacy law in the Internet age is a new and developing area of law.  Accordingly, to the extent employers question whether they have the right to monitor communications via employer owned technology,  employers should proceed with caution and whenever necessary, they should consult with legal counsel.

Pilar Morin is an associate at the Los Angeles Office of Liebert Cassidy Whitmore.  She represents employers in all aspects of employment law, including litigation, advisory work, investigations and training.