Technology and "big data" now make it possible for employers to monitor and record all aspects of what employees may do, say or write in the workplace. Employers have legitimate needs to monitor employees while at work, but the use of monitoring technologies is limited by a variety of federal, state and local laws and legal theories.

Employers need to know about the range of these limits before taking any actions that may lead to litigation and employee issues. This article outlines some of the legal limitations on employers who want to monitor employees and offers a few practical tips for safely navigating this area of the law.

For purposes of this article, "monitoring" includes accessing and reviewing employees' telephone, email and internet usage and/or making audio or video recordings of workplace activities. It also includes the use by employers of GPS, telematics and other technologies that track employer-owned vehicles or equipment.

Federal laws

Contrary to common belief, the United States Constitution does not provide employees with a "right to privacy" against searches or monitoring by private-sector employers. Similarly, no general federal right of privacy exists that prevents an employer from monitoring its employees at work.

The Electronic Communications Privacy Act of 1968 (ECPA), or the Federal Wiretapping Act, governs the interception or acquisition of the contents of electronic communications, such as telephone calls or emails. That Act makes it unlawful, with certain exceptions, to intentionally intercept wire, oral or electronic communications and provides a civil remedy to victims.

To establish liability under the ECPA, a plaintiff must show that a defendant (1) intentionally, (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device. This law applies to the interception of telephone conversations, as well as email that is "in transit" (as opposed to being stored on an employer's computer system).

Under the ECPA, if consent has been obtained, the communication may be lawfully intercepted so long as there is a legitimate purpose for the interception. Accordingly, under the ECPA, employers may generally monitor email and internet usage if the employee consents to such monitoring.

The Stored Communications Act (SCA) addresses unauthorized disclosure of electronic communications and prohibits improper disclosure of information stored by electronic service providers. Under this Act, accessing personal email of an employee without authorization or consent could subject an employer to liability.

Under the National Labor Relations Act (NLRA), monitoring of employees is a mandatory subject of bargaining and cannot be unilaterally implemented or used to discipline or discharge employees who are represented by a union without the union's consent or waiver of the right to bargain on the topic. Further, an Obama-era decision by the National Labor Relations Board gave union-represented and unrepresented employees rights under the NLRA to use their employer's electronic systems for their own personal uses or causes under certain circumstances.

State laws

State restrictions or prohibitions on monitoring vary widely and should be reviewed before an employer conducts any monitoring of employees. State laws can take two forms: statutory or common.

A few states provide private-sector employees with a constitutional right of privacy that comes into play when the subject of monitoring arises. Most states do not have such a state constitutional protection.

Some states have statutes that require all parties to a communication to consent to telephonic or electronic monitoring. California, Florida and more than 10 other states require that all parties consent to the monitoring. Other states only require that one party to the communication consent to the monitoring for it to be lawful.

In addition to statutory protections, state common laws may provide for various rights of privacy in circumstances where employees can reasonably expect privacy. To overcome this common law theory, employers need policies, practices and procedures that inform employees that they should have no expectations of privacy in the workplace. Therefore, all sorts of communications may be accessed, monitored, recorded, copied or shared with third parties without further notice.

Practical guidelines

Written policies are critical if an employer wants to monitor employees in the workplace.

Consent to a policy and monitoring may be express or implied. At a minimum, an employer's employee handbook should contain effective and appropriate policies that address and cover monitoring. However, so that it is clear that an employee has actually consented to the policy, employers should require employees to sign a standalone, separately executed acknowledgement and consent to the policy.

The employer must regularly distribute the applicable policy to employees. Mentioning the policy in memoranda, meetings and training sessions is beneficial is establishing that employees knew about and consented to the monitoring. Actual proof (documentation) of distribution and receipt of policies, consent and training of employees about the policies is essential.

Among other things, a basic policy on monitoring should state that:

• The employer has legitimate business reasons to conduct the monitoring (training, compliance, quality control, detecting misconduct, cooperating with discovery requests in litigation, proof of communications, etc.);
• The employer respects and requires employees to respect copyrights, trademarks and all applicable laws;
• The employer will use any available technology to monitor employees consistent with the law and its policies;
• Monitoring should be broadly defined to include, among others, to read, review, listen to, copy, record, disclose and share with others;
• The scope of devices subject to monitoring is broad and includes, among others, telephones, emails, voicemail, tablets and computers, radios, personal digital assistants, pagers, cameras, GPS or tracking devices, flash, zip or memory drives or other storage devices of any kind;
• Monitoring may occur at any or all times, including unannounced inspections, without cause and for any reason, without further notice;
• Personal, web-based email or other accounts residing in the employer's systems are subject to monitoring;
• Employees have "no expectation of privacy" in any employer-provided devices (such as phones, computers, email systems, etc.) or in employer-owned vehicles, buildings, parking lots or roadways or at any time the employee is working for the employer and all such items are subject to monitoring;
• Only certain uses of the employer's devices, systems, vehicles or other property is permitted and certain activities are expressly prohibited while using such devices, systems, vehicles or property;
• While passwords may be issued, they are intended to prevent outsiders from obtaining access to information on the employer's system, but they do no indicate that an employee has any privacy rights in the contents on the employer's computer or electronic systems;
• Certain individual employer representatives may monitor communications on behalf of the employer, including managers and supervisors; human resources, risk management and legal personnel; or authorized third parties such as lawyers or law enforcement agencies.
• The employer reserves the right to modify or add to the policy from time to time as it deems appropriate.

Conclusion

Even though monitoring of employees is possible and even growing in popularity among employers, employees do have legal rights that employers must respect. Employers who fail to follow established best practices may find themselves with serious legal problems for monitoring employees in the workplace.