For your eyes only? More companies are monitoring their employees' e-mail and Internet usage. As a result, more invasion of privacy lawsuits are being filed. Is your company exposed to possible litigation?

Risk & Insurance, April 1, 2002 by Lori Widmer

The buzz of security experts in the last decade has been the same: companies should be monitoring their employees' technology usage. The reason: fears of employee theft of company information as well as concerns about exposure to lawsuits stemming from harassment or other ills.

Nearly 74 percent of employers are using some form of electronic surveillance of employee technological activity, according to a survey conducted by the American Management Association. Sales of monitoring software are increasing. In fact, the International Data Corporation (IDC), a global technology data analysis corporation with headquarters in Framingham, Mass., estimates that corporations will spend $561 million on Internet filtering and monitoring software by 2005.

Even employees of troubled corporate giant Enron are being watched. Two former Enron employees used the company Internet connection to access an online message board and post company's information as well as complain bitterly about their employer. The result: both were fired. Experts argue that their first amendment rights were not violated since they used company property during work hours to leak sensitive and damaging information.

Could those employees sue for invasion of privacy? Not likely, say the experts. Since Enron had a written technology policy, and the employees were given notice of that policy before the incidents, the company was well within its rights to monitor the employees' activities.

Why Monitor?

One need look no further than the headlines to understand the need to monitor employees' activities.--"We've seen lots of noteworthy cases lately: Enron executives, as well as Microsoft executives, all being pinned to the wall with e-mails they've written," says Michael Overly, a partner with Foley & Lardner, a Los Angeles-based law firm. "Confidential company information is being accidentally disclosed by employees. Companies are taking a hard look at e-mail or Internet policies."

That's just one of many ills that could befall a company if employees are left to use the company network freely. Viruses, opening the system to security breaches, or employees stealing sensitive company information could all cause major exposure to employers through the company's network.

"If an employee uses the e-mail at work to commit a federal crime, send a racial threat, etc., the employer's entire computer system can be subject to seizure under the federal computer seizure guidelines," says Overly. "Say, for example, an employee downloads an MP3 file and puts it on his computer at work. That file violates the copyright of the owner of the song. The employer is immediately liable and there's no possibility of defense."

It happened to Chevron Corp. in 1995. Employees brought a $2.2 million lawsuit against the company, and Chevron paid the settlement, when an offensive e-mail was circulated to employees through the company e-mail system.

Yet it's not just harassment or illegal acts that companies need to guard against. According to Computer Economics, a California-based research firm, more than $5.3 billion was lost to recreational surfing at work during 1999.

Chrys Martin, attorney and shareholder with Bullivant Rouser Bailey, Portland, Ore., says, "You need to be looking for an employee downloading a customer list because that employee is about to go to a competitor. You need to be looking for people downloading porn or sending around racist or sexist information. And you need to be looking at people who are spending so much time on the Internet that they couldn't possibly be working, which is called theft of services."

Good News for Employers

The Electronics Communications Privacy Act of 1986 was passed to protect against unauthorized interception of an employee's e-mail communications. It's the only federal law regarding e-mail that could result in a lawsuit against an employer. "In summary, if you have an unauthorized interception of an electronic message or you retrieve an e-mail from a storage medium, if that's done without authorization, the employee would have the right to sue the employer for damages," says Overly. "This has been the subject of a number of lawsuits."

An attempt was made by the federal government to require notification of monitoring. In 1999, Congress entertained the notion of a federal Notice of Electronic Monitoring Act, which would have required employers to give "clear and conspicuous notice" to employees before monitoring their activities. The bill has since stalled in committee and has not been reintroduced at this writing.

In one case, Bourke v. Nissan, an employee's e-mail was opened during a demonstration and found to hold personal information of a sexual nature. The employee was fired and she subsequently sued for invasion of privacy and wrongful termination. The court found in favor of Nissan Motor Corp. Another lawsuit brought against an employer is the 1994 case of Smyth v. Pillsbury, in which an employee unsuccessfully sued the Pillsbury Co. for firing him over alleged e-mail misuse.