Employers Do Not Violate the ECPA by Accessing Employee E-mails on Company-Provided File Servers

On December 10, 2003, the United States Court of Appeals for the Third Circuit ruled against an employee who sued his employer for accessing his emails without his permission, alleging a violation of his privacy rights under the federal Electronic Communications Privacy Act ("ECPA"). [1] In Fraser v. Nationwide Mut. Ins. Co. [2], the employer (Nationwide) [3] became concerned that an at-will employee [4] (Fraser) might be revealing company trade secrets to its competitors. Nationwide used a systems expert to find and "open email written to or by the employee if the email headers (i.e., the to, from, and re: lines) contained relevant information." The systems expert searched Nationwide's main file server for any emails that exposed improper behavior. Nationwide found emails confirming Fraser's disloyalty and terminated him. Fraser then sued Nationwide, alleging invasion of privacy under the ECPA and violation of several other state laws.

Fraser's invasion of privacy claims involved both Title I and Title II of the ECPA. Title I of the ECPA prohibits unauthorized "intercepts" of electronic communications, such as email. [5] The court agreed with the employer and several other federal circuit courts of appeals in holding that the term "intercept" "can only occur contemporaneously with transmission." [6] The court thus held that Nationwide did not "intercept" Fraser's email because Nationwide did not access Fraser's email at the initial time of transmission; instead, Nationwide searched its own file server for emails that already had been sent or received.

Title II of the ECPA creates civil liability for one who intentionally accesses an email server without permission or intentionally exceeds permission to gain access to an electronic communication while in electronic storage. [7] However, Title II excepts from liability email seizures "authorized 'by the person or entity providing a wire or electronic communications service.'" [8] The court held that because Fraser's email was located on Nationwide's system and Nationwide administered that system, Nationwide fell into the communications service provider exemption of Title II and could not be held civilly liable for searching Fraser's emails on its own system.

In support of his companion state law claims, Fraser argued that the First Amendment of the United States Constitution limited Nationwide's discretion to terminate at-will employees. However, the court held that Pennsylvania courts repeatedly have rejected such claims by private sector employees based on constitutional protection without state action, as well as whistleblower public policy protection for private sector employees when the employee was under no duty to act. The court predicted that the Pennsylvania Supreme Court would decline to find a cause of action for wrongful termination under these circumstances, and affirmed the District Court's summary judgment order against Fraser on these state law claims.

In addition to confirming that the federal Electronic Communications Privacy Act does not prevent employers from searching email maintained on employers' own file servers, this decision illustrates the importance of a well-drafted electronic monitoring policy. Such a policy should put all employees on notice that the computer system is the employer's property, should be used for legitimate business purposes only, and the employer reserves the right to search email sent or received by its employees. Such a policy will defeat an employee's reasonable expectation of privacy in the employer's computer system.

For more information on this issue, please contact a member of the Labor and Employment Practice Group in one of our offices:

To communicate with us regarding protection of your personal information or if you would like to subscribe or unsubscribe to some or all of Bingham McCutchen's marketing mailings, please notify our privacy administrator at privacyUS@bingham.com or privacyUK@bingham.com. Our privacy policy is available at www.bingham.com. Our firm is located at 150 Federal Street, Boston, MA 02110-1726.

Alert is published from time to time as warranted by legal developments of importance; it is not intended to provide legal advice addressed to a particular situation. Alert is circulated to our clients and friends and may be considered advertising.

[1] The ECPA supercedes the Wiretap Act (formerly 18 U.S.C. § 2510 , et seq).
[2] Fraser v. National Mutual Ins. Co., No. 01-2921, 2003 U.S. App. LEXIS 24856 (3d Cir. Dec. 10, 2003).
[3] Although the Third Circuit may have mistakenly referred to the relationship as an employer-employee sort, the relationship was, in fact, that of principal and independent contractor exclusive agent. The analysis is not changed by the difference in status.
[4] The employee was an independent contractor, but was treated as an employee for purposes of this decision.
[5] 18 U.S.C. §§ 2510, 2511.
[6] See United States v. Steiger, 318 F.3d 1039, 1048-49 (11th Cir. 2003); Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002); Steve Jackson Games, Inc. v. U.S. Secret Serv., 36 F.3d 457 (5th Cir. 1994); see also Wesley Coll. v. Pitts, 974 F. Supp. 375 (D. Del. 1997), summarily aff'd, 172 F.3d 861 (3d Cir. 1998).
[7] 18 U.S.C. § 2701 et seq.
[8] 18 U.S.C. § 2701(c).