While more and more people use social media to communicate in their personal lives, email remains one of the main ways people communicate at work. Indeed, many employees receive a company email address to use for work-related purposes.
Sometimes the line between work-related and personal email use can be blurry, with people sending personal messages while at work or through their work email. This situation raises important questions about employee privacy, and the extent to which employers can monitor or review their employees’ email activity.
Businesses have an interest in monitoring the use of their computers, computer networks, and email servers in order to protect their proprietary information and prevent data breaches. Keeping track of employee activities involving company computers and email is one part of this process. As a result, courts have held that employers generally have the right to monitor and access the email accounts they provide to their employees.
Depending on how an employer monitors its computer equipment, it might be capable of accessing personal email accounts used at work, or on company equipment. Whether it is legal for them to do so is a question that remains at least somewhat unresolved. The best advice for employees who want to keep their personal email private is to keep it on their own devices, and do it on their own time.
A company email account, meaning one that is provided to an employee when they are hired, and which might use the employer’s top-level domain name in the address, is the property of the employer. The employer retains control over the servers that process emails. This means that the contents of an employee’s email account, including their contacts and all sent and received emails, are the employer’s property. As long as an employer can show a valid business reason, it can monitor work email accounts.
Employees therefore have no legal expectation of privacy in their work email. Some employers even set up their email accounts to archive copies of all emails automatically. A federal court in Massachusetts ruled that not only did employees have no reasonable expectation of privacy, their employer was legally obligated to search their email as part of an investigation of alleged sexual harassment (Garrity v. John Hancock Mut. Life Ins. Co., No. 00-12143-RWZ (D. Mass., May 7, 2002)).
A company’s employee handbook should include policies that address the use of company email and employee privacy. The federal Electronic Communications Privacy Act states that employers can monitor employees’ email use on the employer’s system if it has a written policy notifying its employees. Regardless of whether an employer has a written policy, employees should assume that the employer will see what they are sending and receiving if they use their work email for personal messages.
Employees who don't want their employers to read their emails should only use their own email accounts for personal emails. Employers cannot legally access an employee’s private email account without permission, but it's possible that personal email could become accessible to employers if information is stored on a device owned by the employer.
Just as a work email account is the employer’s property, so are devices provided by the employer to an employee. These may include desktop or laptop computers, smartphones, and tablets. Employers allow their employees to use these devices for work purposes, and they have a right to monitor how employees are using them. Information like browser history and internet caches can provide a great deal of information about an employee’s activities, possibly including personal emails.
Some employers use software that logs keystrokes on their computers, in order to keep an eye on employee productivity. This software keeps a record of everything an employee has typed, even things they deleted. An employer who uses a keystroke logger will have a complete copy of any personal email written, or written and then deleted, by an employee on a company-owned computer.
Employers do not have the legal right to monitor personal email use on a personal device, on an employee’s personal time, away from the workplace. Attempts to do so by an employer might violate the federal Stored Communications Act. Many states also restrict an employer's ability to request email or social media passwords from employees and job applicants.
Keep in mind that private, off-the-clock email or social media communications aren't necessarily free from all employment consequences. While an employer can't access an employee's personal email account on a personal device, it can still fire or discipline an employee who posts content on social media that harms the employer.
Employers must have a valid business reason for monitoring employee activity on company email. Unacceptable reasons include those that violate the law, such as monitoring email with the intent of interfering with employee efforts to organize and form a union, or gathering information to use in a discriminatory manner.
Employers who are planning on digging into their employees' personal email accounts, even on company devices, should consider consulting legal counsel before doing so.
