High Technology and the Law

A Legal Perspective on the Open Systems Industry

E-Mail Privacy: What Are Your Rights?

Courts are muddling along with the issue of privacy rights on company electronic mail systems.

By Jonathan Wallace

Michael Smyth, a former employee of food products giant, Pillsbury, sent his manager e-mail that was sarcastic and critical of the company. Angry about sales management, he threatened to "kill the back-stabbing bastards" and referred to an upcoming holiday party as the "Jim Jones Kool-Aid Affair." According to Terry Thompson, a spokesperson for Pillsbury, another worker saw a printed copy of the message in a pile of papers slated to be recycled and brought it to the attention of his supervisors; up the chain of command it went.

Smyth, however, alleges that Pillsbury accessed his messages without his knowledge or consent and retrieved the message directly from the computer system. Because the case was dismissed prior to a jury trial, the facts as to how Pillsbury executives actually found out about the message will remain a mystery.

The result is not a mystery. On Jan. 17, 1995, Pillsbury notified Smyth that his employment would be terminated, effective Feb. 1. The employer specifically stated that the reason was transmitting inappropriate and unprofessional comments over the company's e-mail system. Smyth subsequently brought suit in Philadelphia Federal District Court, alleging wrongful discharge. Although most employment is considered "at will," meaning that most of us can be fired at any time for any reason, there are narrow exceptions. Under Pennsylvania law, the exceptions precluding an employer from terminating an "at-will" employee are serving on jury duty, blowing the whistle on illegal activities conducted by the company or prior convictions, as these actions violate "a clear mandate of public policy." Such a clear mandate of public policy must be of a type that "strikes at the heart of a citizen's social rights, duties and responsibilities."

Smyth claimed that his discharge also violated public policy and should become a fourth exception to be held illegal by the court. He argued that his rights of privacy under Pennsylvania law were violated by Pillsbury reading his e-mail and that he had a reasonable expectation of privacy, which precludes employers from snooping on their employees and then taking disciplinary action against them. The court disagreed. It said:
We do not find a reasonable expectation of privacy in the contents of [Smyth's] e-mail communications voluntarily made by an employee to his supervisor over the company e-mail system, notwithstanding any assurances that such communications would not be intercepted by management. Once plaintiff communicated the alleged unprofessional comments to a second person (his supervisor) over an e-mail system which was apparently utilized by the entire company, any reasonable expectation of privacy was lost.

Smyth further argued that Pillsbury had assured its employees--including him--that e-mail communications could not be intercepted and used against its employees as grounds for termination or reprimand. Pillsbury countered by claiming that every time a user (such as Smyth) logged onto its terminal, he or she received a message stating that their e-mail was not secure and that management reserved the right to view any message at any time. The court didn't seem to care about this either. It held that "even if we found that an employee had a reasonable expectation of privacy in the contents of his e-mail communications over the company e-mail system, we do not find that a reasonable person would consider [Pillsbury's] interception of these communications to be a substantial and highly offensive invasion of his privacy."

Smyth didn't even get a trial on his claim. The court held that even if it viewed the facts in a light most favorable to him, he simply hadn't been damaged under the applicable laws by Pillsbury's actions. Nevertheless, just prior to the court's official decision, Smyth and Pillsbury settled their dispute.

Courts Lack Technical Expertise

Reading the decision, one gets the sense that the judges were not familiar with e-mail. Indeed, the excerpt quoted above seems to state that no one should have any expectation of privacy in mails sent via a system "utilized by the entire company." This is tantamount to saying that one shouldn't assume the privacy of mail sent through the U.S. Postal Service because it is a system "utilized by the entire country." In fact, the court could have easily disposed of this case by simply stating that no public policy issue was involved, without discussing or alluding to the question of whether e-mail is private.

Moreover, the court never mentions the Electronic Communications Privacy Act (ECPA), a law passed by Congress in 1986 dealing specifically with this issue. The ECPA is a confusing patchwork of provisions relating to the interception of electronic and voice communications. In general, it outlaws the interception or disclosure of electronic mail by anyone not a party to the communication.

However, it contains numerous exceptions, including one allowing the owner of the computer system to inspect or disclose mail as a "necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service." In other words, if a necessary feature of systems administration involved inspecting the contents of messages, there is no ECPA violation. Of course, there is also an exception allowing disclosure of e-mail communications to an authorized government agency. Nevertheless, any discussion, particularly a judicial opinion dealing with privacy rights in electronic communication, should at least make some reference to this important federal statute.

Lance Rose writes in his treatise on online legal rights, Netlaw (McGraw-Hill, 1995), "Most lawyers agree that under current law, workers do not have privacy rights on in-house computer systems unless their employer gives them those rights." Rose observes that employers can affirm employees' privacy rights either explicitly, through a statement in an employee manual or computer system user's guide, or implicitly, through a course of conduct over the years.

It is not in anyone's interest, employer or employee, to leave the e-mail privacy issue ambiguous. Employers can avoid misunderstandings similar to the Pillsbury case described above simply by clarifying their position on their employees' use of e-mail from the beginning. Smyth probably would not have sent his e-mail if he knew Pillsbury management would read it. Even though his employer might never have learned of his anger, it also would have avoided such an expensive lawsuit, and he might still be employed at Pillsbury.

This case strikes a serious blow to the world of telecommunications. It has changed the view of electronic communications from "sealed envelopes to postcards." Perhaps as time goes on, society's understanding of technology will become clearer and our judicial system will catch up to these ever-increasing technological advances.

Jonathan Wallace is vice president and general counsel of Pencom Systems in New York City. He can be reached at jw@pencom.com.