When an employee quits, many employers hire computer forensic experts to create an image of the hard drive in any computer used by the employee. That image is then searched for evidence of improper conduct. The employer can look at the employees’ emails on the company email system, for example, and see if the employee was improperly soliciting customers for his new employer.
To the surprise of many employees, these experts also can recover emails sent on an employee’s password protected, private email account when the email is sent from a company computer. Employees often believe that they have privacy rights and that these rights should preclude their employers from reviewing their private emails. Employers, on the other hand, claim that their policies grant them the right to review anything on their computers.
Colorado courts have not provided any guidance about when and how an employer can search computers and electronic devices. In a 2010 decision with national implications, however, the New Jersey Supreme Court generally recognized that employers had the right to search a former employee’s computer.
In Stengart v. Loving Care Agency, the employee used her company issued laptop to access her personal, password protected email account on Yahoo and sent emails to her lawyer about her situation at work. After the employee left, the employer created an image of the hard drive on the laptop and was able to retrieve the contents of the emails that the employee had sent to her lawyer. The employee’s counsel later learned about these recovered emails and demanded that they be returned. Employer’s counsel declined to return the emails and denied that the emails were protected by the attorney client privilege.
The New Jersey Supreme Court held that the employee had not waived her attorney client privilege for the communications because the employee had a reasonable expectation of privacy in sending the emails. There are important public policy concerns underlying the attorney client privilege and those concerns drove the court’s decision. The court concluded that the privilege would not be waived even if the employer’s had a policy that banned all personal computer use and provided unambiguous notice that the employer could retrieve an employee’s communications so long as the communications were sent on a password protected account.
More importantly, however, the court approved the practice of enlisting consultants to create a forensic image of computers and other electronic devices. In creating such an image, the New Jersey court concluded that the employer was “legitimately attempting to preserve evidence”. Most employee emails or communications will not be protected by a privilege. The implication in Loving is that an employer is free to search for, and recreate, non-privileged emails even if they are sent on a private, password protected account.
The Loving holding is, of course, limited to the facts presented. Different decisions might result depending on an employer’s electronic communications policies or unique state privacy laws. Nonetheless, the lesson for employees is clear. You should assume that your employer can review any email sent on a company computer even if the emails is sent on a password protected, private account. Certain communications might be privileged but most communications will not be.