In an earlier post entitled No privilege for you! I wrote about how an employee’s attorney-client privilege was not applicable because communication with his attorney took place via his employer’s email and therefore there was no reasonable expectation of privacy. In that case the e-mail communication in question took place on the employer’s internal email system via hardware owned by the employer. The four factors the court set forth for consideration in determining whether an employee has a reasonable expectation of privacy in computer files or email are worth repeating here.

1. does the corporation maintain a policy banning personal or other objectionable use,
2. does the company monitor the use of the employee’s computer or email,
3. do third parties have a right of access to the computer or e-mails, and
4. did the corporation notify the employee, or was the employee aware, of the use and monitoring policies?

Recently a similar case, with a subtly different twist received a completely different ruling from the Supreme Court of New Jersey. This entry in Electronic Discovery Law blog reports it as follows.

Stengart v. Loving Care Agency, Inc., 2010 WL 1189458 (N.J. Mar. 30, 2010)

In this employment litigation, the Supreme Court of New Jersey addressed whether employees have a reasonable expectation of privacy as to attorney-client privileged emails sent and received on a work computer. The court held that under the circumstances presented, the employee/plaintiff did have a reasonable expectation of privacy as to emails with her attorney. Additionally, the court remanded the case to the trial court to determine what, if any, sanctions should be imposed upon defense counsel for reading and utilizing the emails at issue, despite indications that they were protected as privileged.

So what makes the circumstances of this case different from the first case wherein the court ruled that the email in question was not protected by the attorney-client privilege because the defendant had no reasonable expectation of privacy? Well, it turns out there was at least one major difference. Ellen Messmer in this article in Network World describes the circumstances of this case.

[The employee's] lawyers and [employer's] own team of lawyers had been squabbling over whether [employer], which had collected [employee's] e-mail after she filed suit against the company, had to turn over to [employee's] lawyers the half-dozen or so Webmail-based e-mails the company had managed to capture as forensic evidence.
These were e-mails [employee] had sent via her personal password-protected Yahoo account to her lawyers before her resignation; [employee's] lawyers also wanted [employer's] lawyers disqualified in the case. [Employer's] lawyers argued [employee] had no reasonable expectation of privacy in files on a company-owned computer in light of the company’s electronic communications policy.
[Employee] had sent the e-mail via her Yahoo account via her work computer at the office, not her corporate e-mail account. [Employer's] lawyers argued that [employee] “had no reasonable expectation of privacy in files on a company-owned computer in light of the company’s policies on electronic communications,” a court document states. [Employee] argued she had been given no warning that e-mail sent from a personal account would be monitored or stored.
According to a court document, [Employer's] policy states the home care services firm may review, access, and disclose “all matters on the company’s media systems and services at any time,” and also stated that e-mail, Internet communications and computer files are the company’s business records and are “not to be considered private and personal” to employees. It also stated “occasional personal use is permitted.”

So the key difference was that in this case the employee, while utilizing the employer’s computer at the employer’s site was communicating via her personal e-mail account – not the corporate e-mail system. So this certainly sets aside the prevailing notion that there is no reasonable expectation of privacy when using your employer’s computer. Unfortunately it’s not that clear. Not yet anyway. As this summary of the history of the case shows.

Upon leaving her position and filing her complaint, [her] former employer hired experts to create a forensic image of [her] laptop. The emails, which had been stored in the laptop’s temporary files, were recovered, passed on to counsel, and eventually utilized in the course of discovery. Upon learning of defense counsel’s possession of the emails, [employee’s] counsel demanded their immediate return. Defense counsel refused, and the issue went before the court. The superior court decided in favor of [employer] and held that there was no breach of attorney-client privilege “because policy placed [employee] on sufficient notice that her emails would be considered company property”. The appellate court held that the policy upon which the trial court relied could allow an objective reader to conclude that not all personal emails were company property and reversed the trial court. The issue was then appealed to the Supreme Court. The Supreme Court found in favor of [employee].

There is another key issue here related to the use of Webmail: The employer had to resort to extraordinary means – a forensic analysis of the computer – to actually retrieve the e-mail in question. This also figured in the court’s analysis of the case.

Beginning its analysis with an evaluation of the policy addressing an employee’s personal computer use, the Supreme Court determined that the scope of [employer's] written policy was “not entirely clear.”  The ambiguity resulted from the policy’s failure to specifically address personal emails, from the lack of warning that the contents of all emails were stored on the users’ computers and could be forensically retrieved and read later, and from the policy’s explicit statement that “occasional personal use [of email] is permitted.”

The court found that “[employee] had a reasonable expectation of privacy in the emails she exchanged with her attorney on [employer’s] laptop.” Specifically, the court noted that [employee] “took steps to protect the privacy of those emails” by using a personal, password-protected email account and by not saving the password on her computer. “In other words, she had a subjective expectation of privacy in messages to and from her lawyer discussing the subject of the future lawsuit.” The court also cited the ambiguity of the policy, as explained above, in support of her “objectively reasonable” expectation of privacy and also that noted the emails were neither illegal nor inappropriate and that the emails were marked as privileged.

But don’t start celebrating this new reasonable expectation of privacy on personal communications from your employer’s equipment too soon. The court concluded that your employer still has the right to enforce electronic communication policies that you might consider quite invasive of your privacy. In other words your expectation of privacy with respect to your work laptop is not reasonable in light of a well written policy.

Regarding the effect of their conclusion, the court stated:

Our conclusion that [employee] had an expectation of privacy in e-mails with her lawyer does not mean that employers cannot monitor or regulate the use of workplace computers. Companies can adopt lawful policies relating to computer use to protect the assets, reputation, and productivity of a business and to ensure compliance with legitimate corporate policies. And employers can enforce such policies. They may discipline employees and, when appropriate, terminate them, for violating proper workplace rules that are not inconsistent with a clear mandate of public policy. But employers have no need or basis to read the specific contents of personal, privileged, attorney-client communications in order to enforce corporate policy. Because of the important public policy concerns underlying the attorney-client privilege, even a more clearly written company manual–that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee’s attorney-client communications, if accessed on a personal, password-protected e-mail account using the company’s computer system–would not be enforceable.

So there you have it. Maybe some privilege for you after all.