Finders/Keepers

Recent Case Law

Alamar Ranch

One recent case considering whether the privilege attaches to an e-mail sent by an employee from a work computer is Alamar Ranch, L.L.C. v. County of Boise, 2009 U.S. Dist. LEXIS 101866 (D. Idaho Nov. 2, 2009). That case involved a land use and permit dispute in which the plaintiff subpoenaed records from Jeri Kirkpatrick, a non-party to the action, as well as Kirkpatrick's lawyer and Kirkpatrick's employer. In response to its subpoena of Kirkpatrick's employer, the plaintiff received various e-mails between Kirkpatrick and her lawyer that Kirkpatrick had sent from her work e-mail account. Kirkpatrick's lawyer moved for the return of the e-mails, but the court held that they were not protected by the attorney-client privilege.

The court based its decision on the employer's policy providing that all e-mails are property of the employer, would be monitored, and should not be assumed to be confidential. According to the court, it is “unreasonable for any employee in this technological age ' to believe that her e-mails, sent directly from her company's e-mail address ' would not be stored by the company,” particularly when the employee has been placed on notice that e-mails are not confidential. As for the e-mails from Kirkpatrick's lawyer, the court held that the e-mail address Kirkpatrick used in her communications with her lawyer clearly put the lawyer on notice that she was using her work e-mail address, and thus the confidentiality of his reply e-mails could not be guaranteed. The court noted that “[e]mployer monitoring of work-based e-mails is so ubiquitous that [Kirkpatrick's lawyer] should have been aware that [her employer] would be monitoring, accessing and retrieving e-mails sent to that address.” Importantly, the court noted that Kirkpatrick had failed to take any measures calculated to safeguard the confidentiality of the e-mails, such as using a Web-based password-protected e-mail account.

Stengart

Another very recent case reached the opposite conclusion, finding that the e-mails at issue retained the privilege. In Stengart v. Loving Care Agency, Inc., 973 A.2d 390 (N.J. Super. Ct. App. Div. July 29, 2009), Marina Stengart used her company-issued laptop to exchange e-mails with her attorney through her personal e-mail account. These e-mails were stored in the laptop's cache memory, which is not easily accessed. Stengart then resigned from the company and sued for discrimination. After Stengart filed her lawsuit, Loving Care's computer forensic expert recovered the cached e-mails that Stengart had exchanged with her attorney. During discovery, Loving Care's counsel referenced some of these e-mails, and Stengart demanded their return. The trial court ruled that Stengart had waived the attorney-client privilege with respect to the e-mails because Loving Care's computer use policy expressly provided that employee Internet use is not private.

The Stengart decision, however, was soon reversed by a New Jersey appellate court. According to the appellate court, Loving Care failed to show that Stengart had ever received the computer use policy. In addition, the court found that the policy was ambiguous and failed to adequately warn Stengart that Loving Care might read e-mails sent through her personal e-mail account. Specifically, while the company's policy reserved its right to “review, audit, intercept, access, and disclose all matters on the company's media systems and services,” the policy did not define what was meant by “media systems and services.” Further, while Loving Care's policy clearly provided that e-mail and Internet use are part of the company's business and should not be considered private, the policy also expressly permitted “occasional personal use.” The court reasoned, therefore, that an “objective reader” could conclude that not all personal e-mails necessarily become company property because the policy expressly permits some personal use. Significantly, the issues surrounding the employer's policy were not the basis for the court's conclusion that the e-mails were privileged. Instead, the court based its decision on public policy grounds, holding that the policy rationale underlying the privilege “substantially outweighed” the employer's interest in enforcing its computer use policy. The Stengart decision is not yet final, as the matter has been appealed to the New Jersey Supreme Court.

Similar Rulings

Other recent decisions address similar issues. In Curto v. Medical World Communications, Inc., 2006 U.S. Dist. LEXIS 29387 (E.D.N.Y. May 15, 2006), the court held that the privilege applied to e-mails an employee sent from her home office on a company-issued laptop that was not connected to the company's e-mail server. Similarly, in Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, L.L.C., 587 F. Supp. 2d 548 (S.D.N.Y. Aug. 22, 2008), the court held that the attorney-client privilege applied to e-mails that the company accessed not from its computer systems, but directly from Web-based e-mail providers. The company obtained the e-mails by accessing a former employee's computer after he resigned his employment, and logging into his e-mail service. Because the former employee had accessed the service from his company-provided computer, the login fields were pre-populated with his username and password. Notwithstanding that the company maintained a policy providing that employees have no expectation of privacy even in their personal e-mail accounts when used to transmit messages on company equipment, the court also found that the employer's conduct violated the Stored Communications Act.

The court in Scott v. Beth Israel Medical Center, Inc., 2007 N.Y. Slip Op. 27429 (N.Y. App. Div. Oct. 17, 2007), however, reached a different conclusion. In that case, the court considered whether the attorney-client privilege and the work-product doctrine applied to shield from discovery a former employee's e-mails with his counsel that had been transmitted via the employer's e-mail system. Under the employer's computer use policy, all e-mail systems were the property of the employer and were to be used for business purposes only. The court applied a four-factor test developed in a New York bankruptcy case to conclude that the e-mails were not privileged or protected by the work product doctrine: 1) the company maintained a policy banning personal or other objectionable use; 2) the company monitored (or reserved the right to monitor) e-mail or computer use; 3) third parties have a right of access to the computer or e-mails; and 4) the employer notified the employee or the employee was aware of the computer use policy.

Lessons to Be Learned?

As the cases reviewed in this article demonstrate, the law in this area is evolving. Collectively, however, these decisions suggest a number of steps employers can take to increase the likelihood that they can successfully argue that an employee's communications with his or her counsel are not privileged when those communications are created using the employer's electronic resources:

• Develop a computer-use policy which advises employees that the employer will, at its discretion, access, review and disclose any communication or file stored on any company-owned device.
• The computer-use policy should specifically warn employees that it applies to all copies of e-mail sent through a personal e-mail account that remain on company computers.
• Where a company does not wish to prohibit all personal use of its computer systems, notify employees that their personal use is not private and is subject to the computer-use policy in its entirety and expressly prohibit the use of corporate electronic resources to consult with an attorney, without authorization from an appropriate company official.
• Obtain from each employee (including managers and executives) an executed acknowledgement of receipt of the computer-use policy, and enforce the policy uniformly.

Conclusion

The widespread use of e-mail has challenged the courts to define the boundaries of the attorney-client privilege in the context of electronic communications created by use of corporate resources. Because e-mail is such an integral part of all facets of American life, courts are increasingly willing to find that employees have privacy interests in “personal” communications when they take steps to avoid monitoring by the employer, such as by sending the e-mail through a personal e-mail account. Developing and circulating an unambiguous computer use policy is a necessary step toward defeating an employee's claim of privilege in any information maintained on corporate systems, including personal e-mail. But, given the state of the law in this area, even an iron-clad policy may not be a guarantee that an employer will have unfettered access to an employee's communications with his attorney that are stored on the employer's electronic resources.

Shirley Lerner, a member of this newsletter's Board of Editors, and Reagan Oden are attorneys with Littler Mendelson in its Minneapolis office. Littler provides employer-side employment and labor solutions worldwide.

Assume that your client has been sued by a former employee, and that a post-termination electronic search of the employee's laptop uncovers e-mails to legal counsel. Can the client keep these e-mails for use in its defense? Or, are these attorney-client privileged communications that must be returned to the former employee? Does use of the employer's computer system constitute a waiver of the attorney-client privilege, making all communications discoverable? Does it matter whether the e-mails are sent from a company e-mail account, as opposed to a personal e-mail account accessed via the company's computer system?

The answer to these questions is a resounding “it depends.” In recent years, courts around the country have found themselves grappling with these and other tricky issues at the intersection of technology and the law. The result is a developing body of case law that considers new questions concerning the scope of workplace privacy and the attorney-client privilege.

While the court decisions in this area can be viewed as inconsistent in some ways, these cases highlight an area of increasing concern for employers and provide valuable guidance. No longer should companies, or their lawyers, assume that the mere existence of an employer's policy reserving its right to monitor electronic communications strips those communications of any privilege that would otherwise attach. Instead, motivated by growing concerns surrounding privacy in the Internet age, some courts are subjecting electronic use policies to rigorous analysis. Before those policies can be applied to permit access to personal, privileged e-mails, these courts are now requiring that the policy unambiguously notify employees of the risk that the employer will read their non-business e-mail.

Recent Case Law

Alamar Ranch

One recent case considering whether the privilege attaches to an e-mail sent by an employee from a work computer is Alamar Ranch, L.L.C. v. County of Boise, 2009 U.S. Dist. LEXIS 101866 (D. Idaho Nov. 2, 2009). That case involved a land use and permit dispute in which the plaintiff subpoenaed records from Jeri Kirkpatrick, a non-party to the action, as well as Kirkpatrick's lawyer and Kirkpatrick's employer. In response to its subpoena of Kirkpatrick's employer, the plaintiff received various e-mails between Kirkpatrick and her lawyer that Kirkpatrick had sent from her work e-mail account. Kirkpatrick's lawyer moved for the return of the e-mails, but the court held that they were not protected by the attorney-client privilege.

The court based its decision on the employer's policy providing that all e-mails are property of the employer, would be monitored, and should not be assumed to be confidential. According to the court, it is “unreasonable for any employee in this technological age ' to believe that her e-mails, sent directly from her company's e-mail address ' would not be stored by the company,” particularly when the employee has been placed on notice that e-mails are not confidential. As for the e-mails from Kirkpatrick's lawyer, the court held that the e-mail address Kirkpatrick used in her communications with her lawyer clearly put the lawyer on notice that she was using her work e-mail address, and thus the confidentiality of his reply e-mails could not be guaranteed. The court noted that “[e]mployer monitoring of work-based e-mails is so ubiquitous that [Kirkpatrick's lawyer] should have been aware that [her employer] would be monitoring, accessing and retrieving e-mails sent to that address.” Importantly, the court noted that Kirkpatrick had failed to take any measures calculated to safeguard the confidentiality of the e-mails, such as using a Web-based password-protected e-mail account.

Stengart

Another very recent case reached the opposite conclusion, finding that the e-mails at issue retained the privilege. In Stengart v. Loving Care Agency, Inc. , 973 A.2d 390 (N.J. Super. Ct. App. Div. July 29, 2009), Marina Stengart used her company-issued laptop to exchange e-mails with her attorney through her personal e-mail account. These e-mails were stored in the laptop's cache memory, which is not easily accessed. Stengart then resigned from the company and sued for discrimination. After Stengart filed her lawsuit, Loving Care's computer forensic expert recovered the cached e-mails that Stengart had exchanged with her attorney. During discovery, Loving Care's counsel referenced some of these e-mails, and Stengart demanded their return. The trial court ruled that Stengart had waived the attorney-client privilege with respect to the e-mails because Loving Care's computer use policy expressly provided that employee Internet use is not private.

The Stengart decision, however, was soon reversed by a New Jersey appellate court. According to the appellate court, Loving Care failed to show that Stengart had ever received the computer use policy. In addition, the court found that the policy was ambiguous and failed to adequately warn Stengart that Loving Care might read e-mails sent through her personal e-mail account. Specifically, while the company's policy reserved its right to “review, audit, intercept, access, and disclose all matters on the company's media systems and services,” the policy did not define what was meant by “media systems and services.” Further, while Loving Care's policy clearly provided that e-mail and Internet use are part of the company's business and should not be considered private, the policy also expressly permitted “occasional personal use.” The court reasoned, therefore, that an “objective reader” could conclude that not all personal e-mails necessarily become company property because the policy expressly permits some personal use. Significantly, the issues surrounding the employer's policy were not the basis for the court's conclusion that the e-mails were privileged. Instead, the court based its decision on public policy grounds, holding that the policy rationale underlying the privilege “substantially outweighed” the employer's interest in enforcing its computer use policy. The Stengart decision is not yet final, as the matter has been appealed to the New Jersey Supreme Court.

Similar Rulings

Other recent decisions address similar issues. In Curto v. Medical World Communications, Inc., 2006 U.S. Dist. LEXIS 29387 (E.D.N.Y. May 15, 2006), the court held that the privilege applied to e-mails an employee sent from her home office on a company-issued laptop that was not connected to the company's e-mail server. Similarly, in Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, L.L.C. , 587 F. Supp. 2d 548 (S.D.N.Y. Aug. 22, 2008), the court held that the attorney-client privilege applied to e-mails that the company accessed not from its computer systems, but directly from Web-based e-mail providers. The company obtained the e-mails by accessing a former employee's computer after he resigned his employment, and logging into his e-mail service. Because the former employee had accessed the service from his company-provided computer, the login fields were pre-populated with his username and password. Notwithstanding that the company maintained a policy providing that employees have no expectation of privacy even in their personal e-mail accounts when used to transmit messages on company equipment, the court also found that the employer's conduct violated the Stored Communications Act.

The court in Scott v. Beth Israel Medical Center, Inc. , 2007 N.Y. Slip Op. 27429 (N.Y. App. Div. Oct. 17, 2007), however, reached a different conclusion. In that case, the court considered whether the attorney-client privilege and the work-product doctrine applied to shield from discovery a former employee's e-mails with his counsel that had been transmitted via the employer's e-mail system. Under the employer's computer use policy, all e-mail systems were the property of the employer and were to be used for business purposes only. The court applied a four-factor test developed in a New York bankruptcy case to conclude that the e-mails were not privileged or protected by the work product doctrine: 1) the company maintained a policy banning personal or other objectionable use; 2) the company monitored (or reserved the right to monitor) e-mail or computer use; 3) third parties have a right of access to the computer or e-mails; and 4) the employer notified the employee or the employee was aware of the computer use policy.

Lessons to Be Learned?

As the cases reviewed in this article demonstrate, the law in this area is evolving. Collectively, however, these decisions suggest a number of steps employers can take to increase the likelihood that they can successfully argue that an employee's communications with his or her counsel are not privileged when those communications are created using the employer's electronic resources:

• Develop a computer-use policy which advises employees that the employer will, at its discretion, access, review and disclose any communication or file stored on any company-owned device.
• The computer-use policy should specifically warn employees that it applies to all copies of e-mail sent through a personal e-mail account that remain on company computers.
• Where a company does not wish to prohibit all personal use of its computer systems, notify employees that their personal use is not private and is subject to the computer-use policy in its entirety and expressly prohibit the use of corporate electronic resources to consult with an attorney, without authorization from an appropriate company official.
• Obtain from each employee (including managers and executives) an executed acknowledgement of receipt of the computer-use policy, and enforce the policy uniformly.

Conclusion

The widespread use of e-mail has challenged the courts to define the boundaries of the attorney-client privilege in the context of electronic communications created by use of corporate resources. Because e-mail is such an integral part of all facets of American life, courts are increasingly willing to find that employees have privacy interests in “personal” communications when they take steps to avoid monitoring by the employer, such as by sending the e-mail through a personal e-mail account. Developing and circulating an unambiguous computer use policy is a necessary step toward defeating an employee's claim of privilege in any information maintained on corporate systems, including personal e-mail. But, given the state of the law in this area, even an iron-clad policy may not be a guarantee that an employer will have unfettered access to an employee's communications with his attorney that are stored on the employer's electronic resources.

Shirley Lerner, a member of this newsletter's Board of Editors, and Reagan Oden are attorneys with Littler Mendelson in its Minneapolis office. Littler provides employer-side employment and labor solutions worldwide.