|
|
Supreme Court Justice Louis Brandeis wrote that privacy, the right to be let alone, is "the right most valued by civilized men." Olmstead v. United States, 277 U.S. 478 (1928) (dissenting). Justice Brandeis' words, unsuccessfully opposing the Government's use of phone taps to convict a liquor smuggler during the time of Prohibition, later became the rallying cry for the "right of privacy." The right of privacy is not mentioned in the Constitution or Bill of Rights, but it is fundamental to many of the Court's rulings which most directly affect the lives of ordinary citizens--including such controversial matters as the Roe v. Wade abortion ruling.
One must wonder how Justice Brandeis would view today's workplace, where it is possible to track and record every keystroke made by a secretary; to electronically monitor whether the cook washed his hands after using the restroom; or to follow any employee's trail through the World Wide Web.
Employees have certain expectations of privacy. For employers, though, those expectations cannot be allowed to create liabilities for the business, nor should they take undue precedence over the efficiency and profitability of the business. "Minding your business" is not limited to respecting the legitimate privacy interests of employees. It also means protecting the legitimate interests of the employer. Unfortunately, this tension between the legitimate expectations of employer and employee can result in hard feelings
or, worse, litigation.
I. THE GENERAL RIGHT OF PRIVACY.
Perhaps surprisingly, given its progressive perspective on legal issues, Minnesota only recently recognized a private cause of action (right to sue) for invasion of privacy. Lake v. Wal-Mart, 566 N.W.2d 376 (Minn.App. 1997) reversed, 582 N.W.2d 231 (Minn. 1998). Minnesota steadfastly rejected the claim in its legislature and its courts until the Lake case was decided in July of 1998. Perhaps surprisingly, Minnesota courts will now consider claims for invasion of privacy even for conduct that occurred before the decision. Summers v. R & D Agency, Inc., 593 N.W.2d 241 (Minn.App. 1999). Wisconsin's courts similarly refused to recognize a right of privacy for decades until its legislature adopted a privacy statute, § 895.50 Wis.Stats., in 1977.
Although the law varies from state to state, privacy rights generally fall into three categories:
1. Intrusion upon Seclusion. One who intentionally intrudes upon the seclusion or solitude of another or his private concerns may be liable for invasion of privacy if the intrusion would be highly offensive to a reasonable person. For example, the installation of video surveillance in a private locker area or restroom in most circumstances would be considered an intrusion upon seclusion.
Under Wisconsin's privacy statute, the intrusion must be into a place, such as an office or home. In this regard, the intrusion is similar to the wrongful entry under trespass law. It is not an intrusion under the Wisconsin privacy statute's intrusion provision to peruse a person's private papers. Hillman v. Columbia County, 474 N.W.2d 913 (Wis. App. 1993). However, the holding in Hillman did not apply to an email account, where an action for intrusion upon seclusion could lie if accessing an individual's email account is considered highly offensive to a reasonable person and where plaintiff's email account is a place that a reasonable person would consider private. Fischer v. Mount Olive Lutheran Church, 207 F. Supp. 2d 914 (W.D. Wis. 2002).
2. Appropriation of Name or Likeness. One who appropriates to his own use or benefit the name or likeness of another without consent may be liable for invasion of privacy.
For example, an employer who uses a photograph of an employee for advertising or other commercial purposes without the employee's permission may be liable for invasion of privacy. Colgate-Palmolive Co. v. Tullos, 219 F.2d 617 (5th Cir. 1955). Continuing to use a former employee's name on business documents and forms may also constitute an appropriation. Alonso v. Parfet, 325 S.E.2d 152 (Ga. 1985).
3. Public Disclosure of Private Facts. One who publicizes matters concerning the private life of another is subject to an invasion of privacy claim if the matter is of the kind that public disclosure would be highly offensive to a reasonable person and is not of legitimate concern to the public. Several elements must be shown in order for the employer to be liable:
- Publication
- Private facts
- Lack of legitimate concern to the public.
The extent of publication required has been debated in the courts. Some courts hold that it must be widespread in order to constitute a violation. This differs from publication in cases of libel and slander that may be to a single person.
Hypothetical 1
Prior to beginning work, employer had Jan sign two standardized documents setting forth its policies with regard to various employment matters. Both documents stated, among other things, that the "employer has an Open Door Policy which encourages associates to discuss any matter freely, openly, and in confidence with their store manager or other levels of management. We encourage you to use this at anytime."
At some point during her employment, Jan learned that she was pregnant. She decided to terminate the pregnancy and informed her supervisor that she needed a medical leave of absence for an abortion. Plaintiff alleges that when she returned from leave, three employees of employer knew that she had been pregnant and had an abortion. She sued employer for public disclosure of private facts. What result?
In a case decided by the federal court in Minneapolis, the employee claimed that her supervisor had told her co-workers about her request for medical leave to have an abortion. The employer denied doing that, but also argued that even if the disclosure happened, the facts were not "publicized" to a sufficiently large number of people to constitute an invasion of privacy. The judge agreed and dismissed the claim. C.L.D. v. Wal-Mart Stores, Inc., 79 F. Supp. 2d 1080 (D.Minn. 1999). Discretion remains prudent, however, since other courts have held that disclosure to a small group may still amount to publication if it is foreseeable that the group would spread the facts to a larger audience. Yet other courts have ignored the numerical extent of publication and focused on the people to whom the disclosure was made (customers, co-workers, church) or the degree of embarrassment to the plaintiff.
In the Wal-Mart case, the judge accepted that the employee's request and reasons for medical leave should be considered private facts. Indeed, matters concerning a person's sexual relations, family and medical history should almost always be considered private when learned by the employer. Also, the reason an employee has been terminated may be considered private—at least where the reason could be considered offensive. Zinda v. Louisiana Pacific Corp., 440 N.W.2d 548 (Wis. 1989) (discharge for "falsification of employment form" published in company newsletter).
Facts that generally are not considered private include those things the person leaves open to the public or which are contained in public records. The employee's age or birthday has been found by one court to not be private. Galdauckas v. Interstate Hotels Corp., 901 F.Supp. 454 (D. Mass. 1995).
Even private facts can be of such legitimate public concern that disclosure would be appropriate. For example, publicizing an employee's diagnosis with a seizure disorder usually would be inappropriate. However, there may be a legitimate business interest in calming the fears of co-workers if rumors arose that a seizure episode was related to something to which other employees also were exposed. Young v. Jackson, 572 So.2d 378 (Miss. 1990).
II. COMPUTERS AND OTHER TECHNOLOGIES.
Computers, internal and external electronic messaging systems (e-mail), and telephone voice-mail systems allow businesses the opportunity to greatly increase productivity. They can create efficiencies perhaps unrivaled since the introduction of carbon paper.
Silicon age technologies, however, also present new challenges and potential liabilities for employers. Productivity may actually suffer if employees spend, as some recent studies suggest, up to twenty percent of their workday reading and responding to personal e-mail or visiting web sites unrelated to their work. Moreover, anonymous e-mail (and even e-mail fabricated to appear that it comes from someone other than the true sender) has become a favorite weapon of the harasser. As if this weren't enough, employers also face the potential of discrimination and hostile work environment suits due to some employees' penchant for downloading the pornographic images that pervade the Internet. And if one still needs more nightmares, imagine the ability of a disgruntled employee to leave the premises with thousands of pages of sensitive documents, marketing strategies, secret formulae and customer lists, all in her pocket on a 3˝" disk (or with a mouse click and a modem from her own home!). Stealing the used carbon paper at least left the thief with dirty fingers. Now such corporate espionage can go virtually undetected except by the most savvy and technologically trained investigators. Finally, who envied Bill Gates when he was cross-examined with his own e-mails in the government's anti-trust case? E-mail, like most business records, is discoverable in lawsuits.
These risks of loss of productivity, potential liability for improper use of computer resources, and security concerns prompt many employers to regulate or monitor the use of computers and other technologies by employees. At some point, though, the employer's legitimate interest in monitoring and regulating the use of these technologies may infringe upon the employee's reasonable expectation of privacy in the occasional e-mail to one's distant relative, or the private voice-mail message from one's spouse.
A. ELECTRONIC COMMUNICATIONS PRIVACY.
The employer's efforts to balance these concerns may implicate federal laws including the Electronic Communications Privacy Act (18 U.S.C. § 2510 et seq. ) and the Stored Wire and Electronic Communications and Transactional Records Act (18 U.S.C. § 2701 et seq. ), collectively referred to as the ECPA. Most states have parallel statutes. Minnesota's Privacy of Communications Act (Minn.Stat.§ 626A.01 et seq. ) and Wisconsin's Electronic Surveillance Control Law (Wis.Stats.§ 968.27 et seq.) essentially mirror the federal statute.
The ECPA and similar state laws generally prohibit the interception, use or disclosure of electronic transmissions or accessing stored electronic messages (voice-mail). These laws originally focused on wire-tapping, but have been broadened more recently to include voice-mail, pagers, and all manner of electronic communications (although there remains some debate over the precise reach of the laws).
B. EXCEPTIONS.
There are at least three major exceptions, however, which will allow employers to monitor and regulate the use of their equipment and facilities.
1. Consent. Employees using telephone or computer equipment may consent to the monitoring and regulation of their communications. Under the federal, Minnesota and Wisconsin statutes, e-mail may legally be intercepted, and telephone conversations monitored or recorded, so long as one of the parties to the communication has consented. Moreover, consent need not always be expressly given, but may be implied. For example, if an employer issues policy statements that the company prohibits the personal use of telephones and monitor telephone calls to enforce the policy, such interceptions will be considered consensual. However, some courts have held that the employer can only monitor a personal call long enough to determine that it is personal, and may not continue to monitor or record after that point.
2. Business Use. The business use exception permits employers to monitor and record electronic communications where that interception is accomplished with a piece of equipment provided by the service provider and routinely installable as part of the communication system (such as an additional telephone extension) while used in the "ordinary course of business." Such monitoring in the ordinary course of business does not require the consent or authorization of the employees. Thus, an employer may install a monitoring system to allow supervisors to give employees training or instruction in their telephone skills. While there is some dispute in the courts, it appears that the "business use" exception does not apply, however, when such devices are used secretly or surreptitiously to intercept or record conversations. Similarly, such a system cannot be used to monitor personal telephone calls beyond what is needed to determine that the call is personal (since monitoring personal calls presumably is not in the ordinary course of business). Watkins v. L.M.Berry & Co., 704 F.2d 577 (11th Cir. 1993). At least one court has allowed, however, the monitoring of a personal call in which the employee made disparaging remarks about the supervisor. The court decided that the employer had a legitimate business interest in "the potential contamination of a working environment" such that the monitoring was with the ordinary course of business. Epps v. St. Mary's Hospital of Athens, 802 F.2d 412 (11th Cir. 1986). Similarly, a employer who has reason to believe that an employee is divulging trade secrets to a competitor may be within the ordinary course of business when listening to a suspected call, at least for so long as is needed to determine whether in fact such divulging is occurring. Briggs v. American Air Filter Co., 630 F.2d 414 (5th Cir. 1980).
3. Service Provider. The third major exception permits "service providers" to access electronic communications. Both federal and state law exempt the providers of electronic communications systems from the prohibitions of interception and monitoring where that is necessary to the rendition of the service or to protect the rights or property of the provider. This language appears broad enough to permit employers wide latitude in the monitoring of internal email systems. In terms of an internal e-mail system on a local area network, the employer is the "service provider" and should be permitted to access messages stored in the system. Bohach v. City of Reno, 932 F.Supp. 1232 (D. Nev. 1996). However, there is little judicial interpretation of this section to date. The prudent employer concerned about personal e-mail clogging the system, or improper messages being sent (harassment, pornography, etc.) may wish to limit the monitoring to "directory" information (sender, recipient, length of message, and the like) rather than monitoring the content of the messages themselves. If such directory monitoring reveals an unusual or unexplained number of messages, messages to or from unknown sources, unusually large messages, etc., then greater scrutiny may be warranted and more easily justified under this exception.
Hypothetical 8
Employer had no policy against using its e-mail system for personal messages although there was a policy against excessive chatting. Supervisors had the ability to access employees' computer files by using supervisory passwords. Employees were not specifically told that supervisors had access to their systems.
Employer informed employees that a new break-time policy was being implemented so that all employees would take their breaks at the same time. Scott protested at the meeting addressing this policy change. That evening, Scott's supervisor used his supervisory password and read his employee's e-mail. The e-mails between Scott and another employee included nicknames for the supervisor and referenced his extra-marital affair with another employee. Scott was fired the next day. He sued employer for invasion of privacy. What result?
The Massachusetts Superior Court ruled for the employer and dismissed the employee's claim that the employer had violated Massachusetts' version of the ECPA. Restuccia v. Burk Technology, Inc., 1996 WL 1329386 (Mass. 1996). The Court held that the employer was acting in the ordinary course of business in that it routinely stored computer information in backup files for security purposes and that its system, which included plaintiff's email messages, did not constitute an unlawful wire interception. The employer's case would have been even stronger had it had a policy prohibiting personal e-mail use in the workplace and informing the employee that his e-mails would be monitored.
III. PERSONNEL AND MEDICAL RECORDS.
Effective personnel management requires record-keeping. Employers are legally required to maintain personal data and other records on their employees. For example, the Immigration and Naturalization Service requires employers to verify every employee's identity and employment eligibility. The EEOC requires employers (with 100 or more employees) to collect information on race, gender, and national origin. Employers must maintain worker's compensation records, including first reports of injuries and logs of work-related injuries showing the name, age, wage, extent of injury, etc. Federal W-4 forms maintained by employers also contain information which some employees may consider private. Although generally not required, employers typically also maintain records such as employee applications, performance appraisals, discipline records, and the like.
The laws of both Minnesota and Wisconsin recognize some degree of privacy in an employee's personnel file. The exact nature, extent and consequences of that degree of privacy, however, remain undefined. Minnesota law precludes access to information in an employee's personnel file or "written comments or data of a personal nature about a person other than the employee, if disclosure of the information would constitute an intrusion upon the other person's privacy." Minn.Stat. § 181.960. Wisconsin law contains a similar exclusion from the mandatory disclosure of a personnel file to the employee. § 103.13 Wis.Stats. These provisions, particularly in Minnesota, which does not recognize the right of privacy, raise the as yet unanswered question: what information contained in personnel records constitutes private information?
Clearly, however, any employee medical records created or received by the employer must be considered private and be treated with the utmost confidentiality. Employers may come into possession of such records in the course of injury claims or attempts to accommodate disabilities.
Any medical records in the possession of the employer should be kept in separate, confidential files, and never disclosed without the employee's express, written permission. The Americans with Disabilities Act so requires. 42 U.S.C. 12112(d). As exceptions to this strict rule of confidentiality, managers and supervisors may be informed of medically imposed work restrictions and necessary accommodations, and first aid personnel may be informed of medical conditions if emergency treatment may be required.
IV. SURVEILLANCE OF EMPLOYEES.
There are many legitimate, business-related reasons that employers may wish to conduct on-duty or off-duty surveillance of employees. On-duty, the employer has an interest in quality control, prevention of theft or other misconduct, and safety concerns. Off-duty surveillance may be justified to prevent abuse of the worker's compensation system. Video cameras are often installed in the workplace to promote these interests. Similarly, more than a few worker's compensation claimants have been caught cheating the system by investigators armed with videotapes of the employee's softball league championship game.
The use of silent videotaping is not prohibited by federal or state versions of the Electronic Communications Privacy Act. U.S. v. Falls, 34 F.3d 674 (8th Cir. 1994). In fact, there are few, if any, restrictions on the use of silent videotaping when a legitimate business reason exists for the taping. Videotaping with sound recording, however, may implicate the ECPA and similar state laws.
While there are few legal restrictions on the use of surveillance, employers should be cautious and judicious in its use. A review of the relevant case law reveals a general aversion to the surreptitious videotaping of employees. Indeed, the Minnesota Supreme Court once remarked, "The idea of surveillance seems distasteful and it may be ill-advised, but that is not to say it would be illegal." Nordling v. NSP, 478 N.W.2d 498 (Minn. 1991). Generally, however, where a legitimate business reason exists, and the surveillance is narrowly tailored to that purpose, courts have not declared an invasion into the employee's privacy. Conversely, where the surveillance occurs in places where the employee has a strong privacy interest, such as a bathroom or changing area, the courts have been more willing to find violations of privacy. Clearly, for off-duty surveillance, videotaping should be limited to public areas, and not into the employee's home.
An extra word of caution for union employers is in order. First, surveillance of employees engaged in union organizing activities is prohibited. Consolidated S & Co. v. N.L.R.B., 305 U.S. 197 (1938). The employer may, however, surveil non-employee union organizers on the employer's premises. Oakwood Hospital v. N.L.R.B., 983 F.2d 698 (6th Cir. 1993). Similarly, the Collective Bargaining Agreement typically will place limitations on the employer's monitoring and surveillance of employees. That contract (as well as non-union contracts) should be reviewed before instituting any sort of surveillance.
Hypothetical
Employer set aside a locker room for its female employees to change before and after shifts. Employer received complaints that a male supervisor and female employee were leaving their workstations during the night shift and going into the locker room. In response, employer installed a video camera inside the locker room. The camera pointed toward the entrance and not toward the inside of the locker room. The lovebirds were caught on videotape entering and leaving the locker room. Several female employees brought suit for invasion of privacy alleging that the camera caught them in a state of undress. What result?
The 7th Circuit Court of Appeals dismissed the employees' claim. Brazinski v. Amoco Petroleum Additives Co., 6 F.3d 1176 (7th Cir. 1993). It reasoned that they had no standing to sue because the surveillance was not set up to monitor them. More importantly, it held that the employer had a legitimate business concern in setting up the surveillance. Namely, that the couple's conduct could open the door for a sexual harassment suit. Also, the employer had a legitimate business concern in discovering that the employee and supervisor were performing their duties on the job.
The Court held that the business concerns of the employer outweighed the employees' legitimate expectations of privacy. The Court also commented that the surveillance was narrowly tailored to address the employer's business concerns. In other words, had the video camera been pointed toward the inside of the changing room, the outcome may have been different.
V. OTHER PRIVACY-RELATED LAWS.
Other laws beyond the scope of this brief overview also have privacy implications. While this list is not intended be exhaustive, the employer should be aware of the following:
Drug and Alcohol Testing. Drug and alcohol addictions (although not current use of illegal drugs) may be considered "disabilities" under the Americans with Disabilities Act. Additionally, state laws closely regulate drug and alcohol testing of employees. Minn.Stat. § 181.951. Results of drug tests have been found to be private facts. Veilleux v. NBC, 8 F.Supp.2d 23, 37 (D.Me. 1998). Drug and alcohol test results should be treated as confidential medical records.
Honesty Testing. Both federal and state laws regulate the use of polygraph and other means of honesty testing. 29 U.S.C. § 2001; Wis.Stats. § 111.37; Minn.Stat. § 181.75. These laws may also form the basis of privacy complaints.
Credit Checks. Some employers perform checks on the credit-worthiness of applicants for employment. Federal law now requires that employers give prior notice to applicants and obtain their consent. Additionally, the employer is required to provide a copy of report when employment is denied. Such records should be considered private. 15 U.S.C. § 1681.
Off-Duty Use of Legal Products. Both Minnesota and Wisconsin have laws prohibiting adverse employment action based upon the employee's off-duty use of legal products (e.g. cigarettes and alcohol). Violations of these statutes may also implicate privacy issues. Wis.Stats. 111.321; Minn.Stat. 181.938.
Practical Advice
All of the laws discussed in these materials can be distilled into several simple questions. While the details of each case will vary, and the need for legal advice for specific situations should be considered, the law of privacy essentially comes down to this:
- Does the employee have a reasonable expectation of privacy?
- Does the employer have a legitimate, business-related reason for the action or disclosure of information?
- Is the action narrowly tailored to accomplish the legitimate interest of the employer (is the information given only to those with a need to know)?
Keeping these questions in mind will help employers avoid invasion of privacy claims, while not sacrificing productivity or exposing them to liability for misconduct that shouldn't remain private. A clearly written privacy policy also will help define what the employee can reasonably expect to remain private. The policy should inform employees about any monitoring of e-mail, internet, voice mail, or other communications, and the consequences of inappropriate use. Supervisory personnel should have guidelines limiting disclosure of personal, as well as personnel, information to those with a need to know.
|
