Company Lawyers Unlawfully Intercept Attorney/Client E-Mails - Lessons For Employers and Their Lawyers
5/26/2010
Loving Care Agency, Inc. (“Loving Care”) is a company that provides home-care nursing and health services in
In December 2007, Stengart used her Loving Care laptop to access a personal, password-protected e-mail account on Yahoo’s website. She used this account to communicate with her attorney about her situation at work. Stengart never saved her Yahoo ID or password on the company laptop.
In a later lawsuit, Stengart alleged, among other things, constructive discharge because of a hostile work environment, retaliation, and harassment based on gender, religion, and national origin, in violation of the New Jersey Law Against Discrimination.
In defending that lawsuit, Loving Care hired computer experts to create a forensic image of Stengart’s laptop’s hard drive. The experts recoverd the temporary Internet files containing the contents of several e-mails Stengart had exchanged with her lawyer via her Yahoo account.
This language appeared at the bottom of the e-mails that Stengart’s lawyer sent:
THE INFORMATION CONTAINED IN THIS EMAIL COMMUNICATION IS INTENDED ONLY FOR THE PERSONAL
Two attorneys from the law firm representing Loving Care reviewed the e-mail communications between Stengart and her attorney. The firm did not advise Stengart’s counsel about the e-mails until months later.
Stengart’s attorney then applied for an order to show cause, seeking return of the e-mails and other relief. The
However, the New Jersey Appellate Division reversed and directed the law firm to turn over all copies of the e-mails and delete any record of them. The matter next went to the New Jersey Supreme Court.
Loving Care argued that its employees had no expectation of privacy in their use of company computers based on its policy. The company also asserted that by accessing e-mails on a personal account through Loving Care’s computer and server, Stengart either prevented any attorney-client privilege from arising or waived the privilege by voluntarily subjecting her e-mails to company scrutiny.
In response, Stengart argued that she intended the e-mails with her lawyer to be confidential and that Loving Care’s policy, even if it applied to her, failed to provide her adequate warning that Loving Care would save or monitor the contents of emails sent from a personal account. Stengart also asserted that the communications with her lawyer were privileged.
The New Jersey Supreme Court’s analysis focused on two principal areas: the adequacy of the notice provided by Loving Care’s policy and the public policy concerns raised by the attorney-client privilege.
In the policy, Loving Care reserved the right to review and access “all matters on the company’s media systems and services at any time.” In addition, e-mails were considered part of the company’s business records.
According to the court, it was not clear whether the use of personal, password-protected, web-based e-mail accounts via company equipment was covered. The policy used general language to refer to its “media systems and services” but did not define those terms. Elsewhere, the policy prohibited certain use of “the e-mail system,” which appeared to be a reference to company e-mail accounts. The policy failed to address personal accounts at all, and employees did not have express notice that messages sent or received on a personal, web-based e-mail account were subject to monitoring if company equipment was used to access the account.
Loving Care’s policy also did not warn employees that the contents of such e-mails were stored on the hard drive and could be forensically retrieved and read by Loving Care.
Loving Care’s policy stated that e-mails “are not to be considered private or personal to any individual employee.” Even so, Loving Care’s policy acknowledged that occasional personal use of e-mail was permitted. As written, the policy created ambiguity about whether personal e-mail was company or private property.
As noted above, Loving Care argued Stengart had no reasonable expectation that her e-mail communications would be private. The reasonable-expectation-of-privacy standard analyzed by the court derives from the common law, in particular, the tort of “intrusion upon seclusion.”
According to the court, the reasonableness of a claim for intrusion on seclusion has both a subjective and objective component, and whether an employee has a reasonable expectation of privacy in her particular work setting must be addressed on a case-by-case basis.
The New Jersey Supreme Court noted that a number of courts have tested an employee’s claim of privacy in files stored on company computers by evaluating the reasonableness of the employee’s expectation.
The court concluded that National Economic Research Associates v. Evans, 21
A company manual governed computer use. The manual permitted personal use of e-mail, to “be kept to a minimum,” but warned that computer resources were the “property of the Company” and that e-mails were “not confidential” and could be read “during routine checks.”
The
The Manual, however, did not expressly declare that it would monitor the content of Internet communications. . . . Most importantly, the Manual did not expressly declare, or even implicitly suggest, that NERA would monitor the content of e-mail communications made from an employee’s personal e-mail account via the Internet whenever those communications were viewed on a NERA-issued computer. Nor did NERA warn its employees that the content of such Internet e-mail communications is stored on the hard disk of a NERA-issued computer and therefore capable of being read by NERA.
As a result, the court found the employee’s expectation of privacy in e-mails with his attorney to be reasonable.
In another case, In re Asia Global Crossing Ltd., 322 B.R. 247, 357 (Bankr. S.D.N.Y. 2005), the court developed the following four-part test to evaluate the employee’s reasonable expectation of privacy in his computer files and e-mail:
(1) does the corporation maintain a policy banning personal or other objectionable use,
(2) does the company monitor the use of the employee’s computer or e-mail,
(3) do third parties have a right of access to the computer or e-mails, and;
(4) did the corporation notify the employee, or was the employee aware, of the use and monitoring policies?
The New Jersey Supreme Court concluded that Stengart had a reasonable expectation of privacy in the e-mails she exchanged with her attorney on Loving Care’s laptop.
First, Stengart plainly took steps to protect the privacy of those e-mails and to shield them from her employer. She used a personal, password-protected e-mail account instead of her company e-mail address and did not save the account’s password on her computer. Stengart clearly had a subjective expectation of privacy in messages to and from her lawyer discussing the subject of a future lawsuit.
Second, Stengart’s expectation of privacy was also objectively reasonable. As noted earlier, Loving Care’s policy did not address the use of personal, web-based e-mail accounts accessed through company equipment. Nor did it warn employees that the contents of e-mails sent via personal accounts could be forensically retrieved and read by the company. In acknowledging that occasional personal use of e-mail is permitted, the policy also created doubt about whether those e-mails were company or private property.
Finally, the e-mails warned the reader directly that the e-mails were personal, confidential, and might be attorney-client communications.
As mentioned, Loving Care also argued that Stengart waived the attorney-client privilege, but the New Jersey Supreme Court disagreed. The court noted that a person waives the privilege if she, without coercion and with knowledge of her rights, discloses any part of the privileged matter or consents to such a disclosure made by someone else. In this case, consent was not applicable, since Stengart never consented to any disclosure.
Instead, Stengart took reasonable steps to keep discussions with her attorney confidential. She elected not to use the company e-mail system and relied on a personal, password-protected, web-based account instead. She also did not save the password on her laptop or share it in any way with Loving Care.
Finally, the New Jersey Supreme Court had to deal with Loving Care’s lawyers. New Jersey Rule of Professional Conduct 4.4(b) provides that “[a] lawyer who receives a document and has reasonable cause to believe that the document was inadvertently sent shall not read the document or, if he or she has begun to do so, shall stop reading the document, promptly notify the sender, and return the document to the sender.” The term “document” includes e-mail or other electronic modes of transmission.
Loving Care’s lawyers did not break into Stengart’s personal account or seek attorney-client documents in a clandestine way. Instead, they attempted to preserve evidence to defend a civil lawsuit. According to the court, the law firm’s errors occurred when it did not set aside the arguably privileged messages once the lawyers realized they were attorney-client communications, and in failing either to promptly notify Stengart’s lawyer or to seek court permission before reading further.
The New Jersey Supreme Court remanded the case. In deciding what sanctions to impose, the trial court was directed to evaluate the seriousness of the breach in light of the specific nature of the e-mails, the manner in which they were identified, reviewed, disseminated, and used, and other considerations noted by the Appellate Division.
The Supreme Court left to the trial court to decide whether disqualification of the law firm, screening of attorneys, the imposition of costs, or some other remedy was appropriate.
Conclusion.
It is important for employers to make clear whether their electronic communications policies cover private e-mail or private use of social networking sites. Employers may also want to advise employees that internet use may leave discoverable traces on a hard drive or network.
Stengart v. Loving Care Agency, Inc., et al., 201 NJ. 300, 990 A2d 650 (N.J. 2010).
