High Technology and the Law
A Legal Perspective on the Open Systems Industry
E-Mail Privacy: What Are Your Rights?
Courts are muddling along with the issue of privacy rights on company
electronic mail systems.
By Jonathan Wallace
Michael Smyth, a former employee of food products giant, Pillsbury,
sent his manager e-mail that was sarcastic and critical of the company.
Angry about sales management, he threatened to "kill the back-stabbing
bastards" and referred to an upcoming holiday party as the "Jim
Jones Kool-Aid Affair." According to Terry Thompson, a spokesperson
for Pillsbury, another worker saw a printed copy of the message in a pile
of papers slated to be recycled and brought it to the attention of his supervisors;
up the chain of command it went.
Smyth, however, alleges that Pillsbury accessed his messages without his
knowledge or consent and retrieved the message directly from the computer
system. Because the case was dismissed prior to a jury trial, the facts
as to how Pillsbury executives actually found out about the message will
remain a mystery.
The result is not a mystery. On Jan. 17, 1995, Pillsbury notified Smyth
that his employment would be terminated, effective Feb. 1. The employer
specifically stated that the reason was transmitting inappropriate and unprofessional
comments over the company's e-mail system. Smyth subsequently brought suit
in Philadelphia Federal District Court, alleging wrongful discharge. Although
most employment is considered "at will," meaning that most of
us can be fired at any time for any reason, there are narrow exceptions.
Under Pennsylvania law, the exceptions precluding an employer from terminating
an "at-will" employee are serving on jury duty, blowing the whistle
on illegal activities conducted by the company or prior convictions, as
these actions violate "a clear mandate of public policy." Such
a clear mandate of public policy must be of a type that "strikes at
the heart of a citizen's social rights, duties and responsibilities."
Smyth claimed that his discharge also violated public policy and should
become a fourth exception to be held illegal by the court. He argued that
his rights of privacy under Pennsylvania law were violated by Pillsbury
reading his e-mail and that he had a reasonable expectation of privacy,
which precludes employers from snooping on their employees and then taking
disciplinary action against them. The court disagreed. It said:
We do not find a reasonable expectation of privacy in the contents
of [Smyth's] e-mail communications voluntarily made by an employee to his
supervisor over the company e-mail system, notwithstanding any assurances
that such communications would not be intercepted by management. Once plaintiff
communicated the alleged unprofessional comments to a second person (his
supervisor) over an e-mail system which was apparently utilized by the entire
company, any reasonable expectation of privacy was lost.
Smyth further argued that Pillsbury had assured its employees--including
him--that e-mail communications could not be intercepted and used against
its employees as grounds for termination or reprimand. Pillsbury countered
by claiming that every time a user (such as Smyth) logged onto its terminal,
he or she received a message stating that their e-mail was not secure
and that management reserved the right to view any message at any time.
The court didn't seem to care about this either. It held that "even
if we found that an employee had a reasonable expectation of privacy in
the contents of his e-mail communications over the company e-mail system,
we do not find that a reasonable person would consider [Pillsbury's] interception
of these communications to be a substantial and highly offensive invasion
of his privacy."
Smyth didn't even get a trial on his claim. The court held that even if
it viewed the facts in a light most favorable to him, he simply hadn't been
damaged under the applicable laws by Pillsbury's actions. Nevertheless,
just prior to the court's official decision, Smyth and Pillsbury settled
their dispute.
Courts Lack Technical Expertise
Reading the decision, one gets the sense that the judges were not familiar
with e-mail. Indeed, the excerpt quoted above seems to state that no one
should have any expectation of privacy in mails sent via a system "utilized
by the entire company." This is tantamount to saying that one shouldn't
assume the privacy of mail sent through the U.S. Postal Service because
it is a system "utilized by the entire country." In fact, the
court could have easily disposed of this case by simply stating that no
public policy issue was involved, without discussing or alluding to the
question of whether e-mail is private.
Moreover, the court never mentions the Electronic Communications Privacy
Act (ECPA), a law passed by Congress in 1986 dealing specifically with this
issue. The ECPA is a confusing patchwork of provisions relating to the interception
of electronic and voice communications. In general, it outlaws the interception
or disclosure of electronic mail by anyone not a party to the communication.
However, it contains numerous exceptions, including one allowing the owner
of the computer system to inspect or disclose mail as a "necessary
incident to the rendition of his service or to the protection of the rights
or property of the provider of that service." In other words, if a
necessary feature of systems administration involved inspecting the contents
of messages, there is no ECPA violation. Of course, there is also an exception
allowing disclosure of e-mail communications to an authorized government
agency. Nevertheless, any discussion, particularly a judicial opinion dealing
with privacy rights in electronic communication, should at least make some
reference to this important federal statute.
Lance Rose writes in his treatise on online legal rights, Netlaw
(McGraw-Hill, 1995), "Most lawyers agree that under current law, workers
do not have privacy rights on in-house computer systems unless their employer
gives them those rights." Rose observes that employers can affirm employees'
privacy rights either explicitly, through a statement in an employee manual
or computer system user's guide, or implicitly, through a course of conduct
over the years.
It is not in anyone's interest, employer or employee, to leave the e-mail
privacy issue ambiguous. Employers can avoid misunderstandings similar to
the Pillsbury case described above simply by clarifying their position on
their employees' use of e-mail from the beginning. Smyth probably would
not have sent his e-mail if he knew Pillsbury management would read it.
Even though his employer might never have learned of his anger, it also
would have avoided such an expensive lawsuit, and he might still be employed
at Pillsbury.
This case strikes a serious blow to the world of telecommunications. It
has changed the view of electronic communications from "sealed envelopes
to postcards." Perhaps as time goes on, society's understanding of
technology will become clearer and our judicial system will catch up to
these ever-increasing technological advances.
Jonathan Wallace is vice president and general counsel
of Pencom Systems in New York City. He can be reached at jw@pencom.com.