Corporate Law Article

Employer Access of an Employee’s Personal Information on a Work-Device

Clark, Campbell, Lancaster & Munson, P.A.

Question: What information may an employer access from an employee’s employer-issued mobile device?

Answer: If proper procedures are followed, employers are entitled to recover any information an employee has stored on an employer-issued device.

Interception of Electronic Communications and the Cloud
As technology advances, sometimes the law is painfully slow in keeping up with it. While many people still don’t quite understand how “the cloud” works, it has been a way for people to store their information without having to plug a phone into a computer to keep it backed up. This process ensures users that should a phone become lost, damaged, or replaced, the cloud allows customers to easily access old information and provides a seamless transition to a different device that includes all of the messages, photos, contacts, and music that was on the previous device. While most people frequently use this type of technology with regards to cell phones, it is equally common to connect laptops and tablets to the cloud.

The cloud becomes complicated when it comes to employer-issued devices because the line between what is work and what is personal to the employee begins to blur. If an employee sets up a cloud account on an employer-issued device and receives personal text messages on that device, can an employer use that information in any future lawsuit stemming from the employer- employee relationship? If certain procedures are followed, then the answer is probably yes.

The federal government has enacted the Electronic Communications Privacy Act (commonly referred to as the “Wiretap Act”) which prohibits the unauthorized interception or access to electronic communications. The Wiretap Act imposes civil and criminal penalties on any potential offender. Similarly, the federal government has enacted the Stored Communications Act, which prohibits the unauthorized access of stored wire and electronic communications and transactional records held by third-party internet service providers (ISPs). The State of Florida has adopted provisions that mirror its federal counterparts.

Collectively, these laws would seem to hinder employers from accessing information that is received by, or is stored on, an employer-issued device. While the law is not fully up to date with regards to cloud technology, there two critical trends in the law that allow employers to access information on a employer-issued device.

First, the Wiretap Act has an intentionality requirement that means it will not apply to many employers. This means that if an employee downloads his or her cloud account onto an employer-issued device, the employee is the one who caused that information to be stored on that device, not the employer. In a recent federal case, an employer sued a former employee for violating the employee’s contractual non-compete clause, using texts the employer had received on a work iPhone because the employee set up an Apple iCloud account. The court ruled that the employee was at fault for setting up the cloud account, and the employer did not violate the Wiretap Act because the employer did not intercept the communications intentionally.

Second, both the Wiretap Act and Stored Communications Act have consent provisions that exempt certain parties from the law. While most employees don’t realize it, employment policy handbooks or manuals that are given to new employees may contain a consent provision that allows an employer to store and monitor communications on an employer-issued device. Several courts have found that these consent provisions, with regards to using an employer-issued device, are enough to overcome liability that may be imposed by the Wiretap Act and Stored Communications Act.

Conclusion
Provisions in employer-issued employee manuals may address what information the employer is entitled to access and monitor on employer-owned devices. As long as the employer is not taking proactive steps to confiscate personal messages from an employee, it is unlikely that any criminal or civil liability will arise. The employer may be able to use information stored on an employer-issued device in a dispute should an employee or former employee decide to initiate litigation against them. In any case, consulting with an attorney is the best course of action before using any information on an employer-issued device.

Questions can be submitted to thelaw@cclmlaw.com.

CCLM Law
Latest posts by CCLM Law (see all)