Workplace Behavior and Privacy

1. Workplace Behavior and Privacy PRESENTED BY Jean Ohman Back October 26, 2017

2. AGENDA • Employee Searches & Monitoring • Off-Duty Behavior & Activities • Recommended Policies

3. Employee Monitoring

4. Employee Monitoring Employers monitor for several reasons, including: • To protect the company’s trade secrets; • To protect the security of the company’s computer systems and data; • To guard against and reduce the risk of liability for sexual harassment; • To prevent a loss of productivity by monitoring whether employees are using the systems for personal non-work activities; and

5. Employee Searches • Can an employer search? • Depends on the particular circumstances, and • Whether the employee has an expectation of privacy in the item being searched. • The more invasive the search (body, clothing, personal items), the greater the privacy interest. • Less invasive searches include desks, lockers, computers, company provided cell phones as long as the employer dispelled any privacy expectation.

6. Employee Searches • Public Employers • The 4th Amendment provides public employees with privacy protections. • Employers can reduce this privacy expectation by providing notice that employer owned property and spaces are subject to search • Searches must be reasonable – i.e., credible evidence of misconduct.

7. Employee Monitoring Employers with an electronic communications policy can monitor telephone calls and emails on their own phone and computer systems

8. Employee Monitoring Recording telephone calls before you record a phone call, you must determine whether you are in a one consent state or a two consent state. • One-party consent State – you can record the conversation if you are a party. If you are not a party, then you can record the call provided one party consents to it with full knowledge and notice that the conversation is being recorded • Two Party Consent State – Must have consent of BOTH parties to record a phone call.

9. Employee Monitoring • One Party Consent • Federal law (18 USC § 2511(2)(d)) requires one party consent. • 38 states and the district of Columbia have one party consent rules. Several of these states have “mixed” statutes, meaning that you can record a phone conversation with one party consent, but you cannot record an in person conversation. • Two Party Consent • 12 states require consent of all parties to a phone conversation. (CA, CN, FL, IL, MD, MA, MI, MN, NV, NH, PA, & WA).

10. Employee Monitoring Electronic Communication Policy Historically employers have been allowed to monitor employee communications sent and received on employer-owned systems as long as the employer dispelled the right of privacy in the system

11. Employee Monitoring Monitoring Emails Employers may generally monitor emails sent and received on company-owned systems

12. Employee Monitoring Monitoring Text Messages City of Ontario v. Quon U.S. Supreme Court held that police officers had no right of privacy with respect to text messages on employer-owned devices.

13. Employee Monitoring Keystroke Monitoring • Nearly half of employers use technology to track keystrokes and to monitor the time that an employee spends on a computer. • Employers may not obtain employee passwords using keystroke monitoring.

14. Employee Monitoring Monitoring Internet Use • Employers are allowed to monitor Internet use on employer-owned systems as long as the employer has a policy that dispels the employee’s expectation of privacy on those systems.

15. Employer Monitoring Purple Communications, Inc., 361 NLRB 126 (2014) – In December 2014, the NLRB held that an employee’s use of an employer’s communications systems during non-work time for “concerted rights” activities (to communicate with coworkers about the terms or conditions of employment) is allowed under Section 7 of the NLRA.

16. Employee Monitoring • Purple Communications, Inc. – An employer who allows an employee to use its computer systems may not prevent the employee from communicating about union activities, including organizing to form a union, as long as such discussions occur during non-working hours.

17. Employee surveillance • Purple Communications, Inc. – Exception • There may be “special circumstances” that would allow an employer to completely ban the non-work use of email in order to maintain production and discipline. • The Board did not articulate what the “special circumstances” might entail and has indicated that they will rarely exist.

18. SOURCES OF PRIVACY RIGHTS Electronic Communications Privacy Act (“ECPA”) • Pertains to interception of the content of a communication contemporaneous with the communication. • Less likely to occur in employment setting.

19. Sources of Privacy Rights Stored Communications Act (“SCA”) • Prohibits third parties from intentionally accessing electronically stored communications. • Includes emails or entries on private websites, without proper authorization

20. Sources of Privacy Rights Stored Communications Act (“SCA”) Allows authorized permission to access stored communications if: • (i) the person is the provider of the service; or • (ii) the person is a user of the service and the communication is from or intended for that user.

21. Sources of Privacy Rights Stored Communications Act (“SCA”) An employer may not intentionally access stored communications that are maintained by a third-party service provider without the user’s authorization

22. Sources of Privacy Rights Stored Communications Act (“SCA”) “User Authorization” Exception is extremely narrow: Employee must actually be a user in order to give authorization – he or she must have actually logged on. Court may not apply the exception where an employee is compelled to give access under threat of termination.

23. Sources of Privacy Rights Stored Communications Act (“SCA”) Consequences of violation are serious Criminal liability for intentional unauthorized access. Punitive damages and attorneys’ fees even without showing of actual damages.

24. SCA – Employment Decisions with Attendant Risk • Pietrylo v. Hillstone Restaurant Group, 2009 US Dist LEXIS 88702 (D.M.J. Sept. 29, 2009). • Restaurant employee created Myspace page for fellow employees to “vent” about the restaurant; invitation-only user group with a personal and password protected web page. Posts complained about the restaurant, customers and supervisors. A supervisor obtained a user name and password from a hostess who felt coerced into providing the information. Plaintiff was discharged for violating policy requiring professionalism and positive attitude. • Jury awarded $3,403 plus punitive damages of $13,612

25. SCA – Employment Decisions with Attendant Risk • Konop v. Hawaiian Airlines Inc., 302 F.3d 868 (9th Cir. 2002). • Company accessed an employee’s secure website using other employee’s login information (with his permission) even though the site’s terms prohibited access by management and prohibited authorized users from allowing others to access the site. • The website contained vigorous criticisms of the airline’s management and labor concessions. The company disciplined the pilot. • Court found the airline violated the SCA and that the exception to the act (where permission to view is granted by a “user”) did not apply because the authorized employees had not actually “used” the site themselves.

26. SCA – Employment Decisions with Attendant Risk • Pure Power Boot Camp v. Warrior Fitness Boot Camp., 587 F. Supp. 2d 548 (S.D.M.I. 2008). • Employee planned to leave his job to start his own company. When he resigned, his employer was able to access his personal email accounts which he had logged into while at work, using a password that automatically popped up. • Company found damaging evidence related to the employee’s pre-resignation activities. • Court found that the company’s email policy was not specific enough to put employee on notice that personal email viewed over the company’s computers would be accessed by the company. The Court also determined that employee’s leaving of his password on the computer did not create an implied consent to view his personal email accounts. • Court ruled the employer’s conduct violated the SCA and ruled that the damaging emails obtained in violation could not be used against the employee even though they would have been discoverable in the course of litigation.

27. Off The Job Behavior • Moonlighting; • Criminal Activity • Drug & Alcohol Use • Internet Activity • Union Activity • Political Activity • Immoral or Unethical Behavior

28. Off The Job Behavior Three Questions Guide Employer Action: • Is it lawful for me to take action based on the conduct at issue? – Can I regulate the conduct? • Is it wise for me to take action based on the conduct at issue? – Should I regulate the conduct? • Can I be sued if I take adverse action? – Have I followed best practices?

29. Off The Job Behavior Can I regulate the conduct? A proper response to this question involves an inventory of state laws affecting such things as marital status, religion, sexual orientation, concerted activity, off duty tobacco or marijuana use, wage garnishment for child support, pregnancy, military service, association with members of a protected class, or other conduct protected by a substantial public policy – i.e., jury duty.

30. Off The Job Behavior Privacy Considerations • Employers should be particularly cognizant of privacy considerations when investigating off-duty conduct. • General rule – No invasion of privacy occurs when an employer merely observes conduct that is “out in the open.” But employer surveillance using GPS, RFID or other devices may violate an employee’s privacy rights.

31. Off The Job Behavior Is there a legitimate business reason for regulating the conduct? • Conduct damages ER reputation; • Conduct causes workplace disruption; • Conduct harms EE morale; • Conduct prevents EE from performing his or her job functions adequately; • Legal liability to other EEs and third parties related to off duty conduct.

32. Off The Job Behavior Should I regulate the conduct? This goes back to the legitimate business reason – Can the off duty conduct cause the employer harm?

33. OFF THE JOB BEHAVIOR –BEST PRACTICES Create policies that govern risky conduct • Moonlighting policy; • Drug and alcohol policy; • Criminal activity policy; • Internet policy; • Confidentiality policy • Consistently enforce policies

34. Privacy Guidelines • Inform employees in writing of the ways that you plan to monitor them; • Have a comprehensive electronic communication policy • Consistently apply any monitoring policies across all employees; • Justify monitoring in your policies by including the legitimate business interests that support monitoring activities

35. Questions

36. Jean Back “I’m focused on understanding my clients’ businesses and teir industries so we can hit the ground running with solid legal counsel around their business challenges..” “Not every engagement requires the same solution. Creativity, collaboration, resourcefulness, and excellent listening skills can often lead to unique and successful business solutions.” John Smith Managing Partner 503-796-2933 Direct jsmith@schwabe.com Of Counsel 503-796-2960 Direct Jback@schwabe.com INDUSTRY FOCUS Jean’s practice focuses on • Employment advice and litigation, • Trade secret litigation; • Privacy, Data breach, Cybersecurity,and • Employmenttransactional work. Manufacturing & Technology