The New York Law Journal recently published an article by Michell Boyarsky and Jason Zoldessy on the issue of employer liability for accessing and reviewing their employee’s private email accounts. 

The article cites two decisions from the Federal District Court for the Southern District of New York: Pure Power Boot Camp v. Warrior Fitness Boot Camp and Rozell v. Ross-Holst. In Rozell, the Plaintiff sued her employer for amongst other things, violating the Electronic Communications Privacy Act (“ECPA”) for reviewing personal emails saved to her AOL email account. There was a dispute as to who owned the AOL account, her employer, who paid for it, or the Plaintiff who initially opened it. The employer moved for summary judgment on the ECPA claim, arguing that because it owned the AOL account it was expressly or impliedly authorized to review any emails stored on that account. The court overturned the motion for summary judgment, because of the dispute as to who owned the account. For those of you who are not familiar with the ECPA, I blawged about it on May 24.    

The question of who owns an email account, employer or employee, is key to an analysis of whether an employer is liable under the ECPA for reviewing employee email. The cases from other circuits, including the Third Circuit of which Pennsylvania is a part, unanimously agree that it is illegal for an employer to access a private employee owned email account, e.g. Google or Hotmail. Conversely, the courts are in accord that it is not illegal for an employer to access an email account that it owns and maintains, such as interoffice email accounts.

The authors to the article contend that it is unclear whether private employee owned email accounts are covered under the ECPA if those accounts are accessed by the employee on a work computer. If the authors of the article are asking if and employer is liable under the ECPA if it re reviews emails from such accounts which are saved to an employer computer, the answer is no. Anything an employee saves to a computer owned by its employer is subject to employer review and is not protected by the ECPA. However, if the authors’ question is: under the ECPA can an employer access its employees personal email account because they have reviewed email from that account over a work computer, the answer is likely no.

The ECPA prohibits, amongst other things, the unauthorized access by another to a computer over which electronic communications are stored. With private email accounts like Google, a person’s email is stored on a computer server owned by Google. So long as the employee does not save the email to its work computer its email remains stored on the off-site Google computer. If an employer accesses that account and reviews emails saved thereto, he or she is literally accessing and reviewing information stored on another computer.

It would work an absurd result if the ECPA covered private email accounts which are accessed by an employee over an employee’s work computer.  Ask yourself this, does the fact that I review personal snail mail at the office give my employer the right to access my mailbox at home? Of course not! Why should the result be any different when the employee accesses its personal email account over its work computer? This does not mean that an employee is free to do whatever they want over their work computer. The employer can always fire his or her employee for accessing personal email accounts while on work time. 

The complexities of the ECPA are such that employers should consult with their attorneys to ensure that they have not violated any of its provisions. Violating the ECPA subjects a person to statutory penalties, attorney fees, and in some circumstances punitive damages.