Court rules firms need staff consent to see e-mail

San Francisco’s 9th U.S. Circuit Court of Appeals ruled yesterday that employers who use a third-party to transmit e-mails and text messages can’t access them without an employee’s consent, a judicial move that raises a lot of questions, according to Canadian privacy and employment lawyers.

The case sprang from a lawsuit brought by the Ontario, Calif. police sergeant Jeff Quon and three other officers after wireless provider Arch Wireless turned over to the police department transcripts of Quon’s texts to them. They were used by police execs to determine whether the department-issued pagers were being used outside of work business.

“A lot of case law from the States will be influential in Canada, and doubly so when it comes to technology,” said David Fraser, a privacy lawyer with the Halifax firm of McInnes Cooper. “People previously thought that service providers owed all their duties to the business, but if they have information about individuals…”

Usually, information transmitted through corporate e-mail or phones is thought to belong to the company. “But,” said Fraser, “with the service providers and the individuals, we add a third relationship that might give employees more privacy rights than they previously had.”

The States, however, continue to take a hard-line stance and side with the manager, leading Ottawa-based privacy lawyer Kris Klein to surmise that Quon’s defense was an “artificial distinction factor” to get around the prevailing jurisprudence landscape. “And the result is maybe recognizing that people do have an expectation of privacy,” he said.

Klein feels that, as judges become more aware of the pervasiveness of e-mail, these gray areas could turn even grayer as privacy expectations increase along with the ubiquitousness of e-mail and casual e-communication in the workplace.

Klein said workplace e-mail privacy complaints tend to fall into two camps right now. The first is employees who have been using their internal e-mail for clearly nefarious purposes, such as trafficking in pornography or sharing company secrets. The second is when an employee violates the workplace e-mail use policy, is monitored, and then terminated. Both these variants tend to end with the employer victorious.

In this case especially, said PrivaTech Consulting president Fazila Nurani, the third-party was no different than the employer. “They are working on behalf of the employer. It’s like an agent relationship. Outsourcers are like an arm of the organization, and when it comes to corporate e-mail, you can’t have an expectation of privacy.”

It’s only when the company hasn’t made its policies clear enough that one enters a gray area. Another gray area, said Nurani, is the ever-high expectations of privacy. If an employee strongly believes that an innocent lunch invitation or quick note to a friend is okay, it gets harder to prosecute them, especially once you factor in Klein’s more e-mail-friendly judges of the future.

Even office morale comes into it. Most employees hate the idea of being monitored, leading to lowered morale, according to West Vancouver-based employment lawyer Bob Yeager, who said that the addition of a possible privacy perp in the form of a third party could make things seem even worse. “So it can be unwise to use a third party,” he said.

The Canadian privacy law community didn’t seem to think that the murky gray would be clearing up soon, either, due to the many issues. (Yet another: can an employer mess about with personal communications if they involve personal information about or from a non-employee someone else?) Said Yeager: “Can we find case law on this? No. It’s hard to find so far.”

But, said Fraser, “This will happen more and more. It won’t be long before it comes to Canada.”