Can your employer monitor your browsing history and other personal data of yours? The simple answer is—yes.
And such employer tracking is becoming much more widespread in the era of Covid-19 remote work arrangements, with a plethora of tools available for use by your employer. We will examine how far your employer can go with such monitoring and the legal ramifications of overstepping those bounds.
Your ‘Working’ Assumption
Whether working from the office or home, your assumption should always be that your employer is monitoring you. Everything from your keystrokes to your browsing history and how much time you spend on which sites is all revealed. If you are connected to the internet via your employer’s network, your employer has the right to track your internet activity; and, even if you are not connected to the company network, but are using company-issue equipment, the same employer rights apply. However, the laws get a bit murkier for the remote worker who is connected via a home network while using personal equipment.
What Might Get Tracked?
Some businesses have software installed, either on the company computer or via the company network that you access—even from home—that transmits copies of any emails sent to or from employee accounts, and certain software applications allow your employer to peruse deleted emails or unsent drafts. As to cellphone use, the employer can monitor text messages on a company-owned cellphone but not on your personal cellphone unless connected to the company network. Although using your own mobile data plan to access the internet will not expose your cellular activity to perusal, once your personal cellphone is operated via the company’s network, your cellular activity can indeed be monitored. Think twice before storing passwords on a company cellphone, as even those can be subject to access by your employer’s IT department.
Messaging Platforms Particularly Vulnerable
Essentially, your employer can access anything that you enter on a company messaging platform, and aside from access by the IT department, HR also often times can monitor those platforms, even if your direct manager or supervisor is less likely to have unqualified authorization to do so. Will all communications be checked? As a practical matter, it is highly unlikely that any employer will waste management’s time reading all of your messages, unless there is a specific cause to do so, such as instances of employee theft, compromise of intellectual property, or serious fraud as to time-keeping or expense account charges. However, the fact that an administrator or manager can do so should put you on notice that this particular platform is highly susceptible to employer tracking.
From a Legal Perspective
Almost every court to decide employer data tracking cases has ruled that the employer has the right to read emails that employees have sent using the employer’s company email system, even if the employee intended such messages to be private or confidential. To avoid litigation over such matters, many employers will fully disclose their practices and capabilities up front and have employees sign an acknowledgment or waiver regarding the company’s practices. However, even in the absence of such employee consent, courts have ruled that employers have extensive freedom to monitor the use of their own email systems.
Regarding personal email accounts, the law is less clear: some courts have held that employers may monitor an employee’s personal email if the employee is using the company’s equipment and the employee has been given notice that company-issued equipment is not for personal use. But such rulings are not universal, and variations exist from one jurisdiction to another, as do the fact-specific circumstances of each case.
Employer Rights Under the ECPA
Under the federal Electronic Communications Privacy Act of 1986 (ECPA), employers must demonstrate that they have a legitimate business reason for tracking employee data. While the ECPA contains provisions protecting employee privacy rights, at the same time, it recognizes that there exist legitimate reasons for accessing data created by or exchanged by employees. The Act defines ‘electronic communications’ as any electronic messages currently being transmitted, however, after transmittal, such messages are categorized as ‘electronic storage’, and are then governed by the Stored Communications Act. Furthermore, under the ECPA’s ‘consent exception’, much broader monitoring by employers is permitted, as noted above. The ECPA’s ‘business use exception’ provision further expands monitoring of electronic communication of employees when legitimate business reasons to do so exist.
As the COVID-19 pandemic continues to shift more work to a remote-work model, the need for employers to maintain basic monitoring of employee productivity levels while operating within legitimate privacy limitations will need to be carefully balanced. Greater guidance will assist employers as the law progresses in this area. But in the meantime, both employers and employees will have to openly carve out what employer tracking will mean at any particular business.
Executive Summary
The Issue
Where does employer tracking of employee data stand in both the remote-work and in-office environments?
The Gravamen
Employers enjoy such widespread rights to monitor employee data, that all employees should assume that nothing they communicate over an employer network or at home via employer equipment, is private.
The Path Forward
Employees would be wise to strictly limit any private content they do not want exposed, and employers should craft full disclosure documentation to avoid unwanted legal entanglements.
Action Items
Review:
Conduct a survey of your company’s employee monitoring policies to make sure they comply with federal and applicable state regulations.
Draft:
Once a compliance review has been completed, reduce your company’s monitoring policy to a written document with the assistance of IT, HR, and legal counsel.
Authorizations:
Define who will have access to employee data and for what purposes, in order to avoid illegal intrusions, and have in place a monitoring authorization procedure.
Disclose::
Be transparent with employees as to exactly what the company policy is regarding employer monitoring of data, whether communicated via company network or off-site company equipment.
Further Readings
- https://www.morningbrew.com/hr/stories/2022/01/19/employee-surveil- lance-is-exploding-with-remote-work-and-could-be-the-new-norm
- https://www.brookings.edu/blog/techtank/2021/01/05/how-employ- ers-use-technology-to-surveil-employees/
- https://nanoglobals.com/can-boss-see-my-browsing-history/
- https://www.businessnewsdaily.com/6685-employee-monitoring-priva- cy.html
- https://www.currentware.com/blog/workplace-privacy-employee-moni- toring/
