Employer May Not Access Employee’s Emails to Her Attorney Sent from Her Personal Email Account Using Employer’s Computer

Stengart v. Loving Care Agency, Inc., No. A-16-09 (N.J.,  March 30, 2010) – In a case of first impression, the New Jersey Supreme Court analyzed the extent to which an employee can expect privacy and confidentiality in emails with her attorney, which were sent and received through her personal, password-protected, web-based (Yahoo) email account using an employer-issued computer. The employee had emailed her attorney during business hours prior to resigning and filing suit for hostile work environment. The employer’s forensic examiners uncovered temporary Internet files containing the contents of her emails while imaging her laptop’s hard drive to preserve evidence for discovery. When the emails were produced to the employee, she moved for sanctions and to disqualify the employer’s attorneys for ethical violations. Despite the employer’s argument that it had in place a broad electronic communications policy that permitted employer monitoring of emails, and that the employee had therefore waived the attorney client privilege by using company-issued equipment to communicate with her lawyer, the Supreme Court held that the employee had a reasonable expectation of privacy and that an employer’s monitoring policy cannot trump the attorney-client privilege.

To determine the reasonableness of the employee’s expectation of privacy, the Supreme Court first examined the meaning and scope of the company’s electronic communications policy. The policy did not give express notice to employees that messages exchanged on a personal, password-protected, web-based email account were subject to monitoring if company equipment was used. Although the policy stated that the employer may review matters on “the company’s media systems and services,” those terms were not defined. The prohibition in the policy of certain uses of “the email system” appeared to refer to company email accounts, not personal accounts. Further, the policy did not warn employees that the contents of personal, web-based emails were stored on a hard drive that could be forensically retrieved and read. The Supreme Court also found the policy created ambiguity by declaring that emails “are not to be considered private or personal,” while also permitting “occasional personal use” of email.

Under all of the circumstances, the employee could reasonably expect that the emails exchanged with her attorney on her personal, password-protected, web-based email account, accessed on a company laptop, would remain private. By using a personal email account and not saving the password, the employee had a subjective expectation of privacy. The employee’s expectation also was found to be objectively reasonable in light of the ambiguous language of the policy and the attorney-client nature of the communications.

The Supreme Court also rejected the employer’s claim that the attorney-client privilege either did not attach or was waived. The policy did not give the employee cause to anticipate that the employer would be watching over her shoulder as she opened emails from her lawyer on her personal, password-protected account. Similarly, the employee did not waive the privilege as she took reasonable steps to keep the messages confidential.

Despite holding that the attorney-client emails here were not subject to review by the employer, the Supreme Court also held that employers can adopt and enforce lawful policies relating to computer use to protect the assets and productivity of a business:

“Our conclusion that Stengart had an expectation of privacy in emails with her lawyer does not mean that employers cannot monitor or regulate the use of workplace computers. Companies can adopt lawful policies relating to computer use to protect the assets, reputation, and productivity of a business and to ensure compliance with legitimate corporate policies. And employers can enforce such policies. They may discipline employees and, when appropriate, terminate them, for violating proper workplace rules that are not inconsistent with a clear mandate of public policy. For example, an employee who spends long stretches of the workday getting personal, confidential legal advice from a private lawyer may be disciplined for violating a policy permitting only occasional personal use of the Internet. But employers have no need or basis to read the specific contents of personal, privileged, attorney-client communications in order to enforce corporate policy. Because of the important public policy concerns underlying the attorney-client privilege, even a more clearly written company manual – that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee’s attorney-client communications, if accessed on a personal, password-protected email account using the company’s computer system – would not be enforceable.”

The Stengart decision underscores the need for employers to implement and disseminate a comprehensive electronic communications policy that complies with the Supreme Court’s new ruling. Although an electronic communications policy will not permit an employer to review an employee’s emails with his or her lawyer sent from a personal, password-protected account, a properly-worded policy that permits monitoring of emails and other computer usage can be enforced in other circumstances. All employers should take this opportunity to review and update their current policies or to implement one if needed.