Company laptops, privacy and you

Court ruling shows that employees may occasionally expect their communications to be private, says attorney Eric Sinrod.

4 min read
Yes, it is true, the great weight of law holds that employees generally should not have privacy expectations when it comes to their work-related electronic communications, especially when they have signed computer policies that explicitly state this to be the case.

However, in a recent twist, a federal court has held that employees may be able to assert that the attorney-client privilege applies to their communications with their attorneys on company laptops under certain circumstances.

In the case Lara Curto v. Medical World Communications, a federal trial judge in New York affirmed the holding of a magistrate that a particular employee had not waived the attorney-client privilege concerning documents retrieved from company laptops she had used during the course of her employment.

The plaintiff employee had been employed by Medical World Communications (MWC) from August 1995 to October 2003. In connection with her work, the plaintiff signed MWC's "E-mail/Computer Privacy Policy" that was contained within the company employee handbook. The policy specifically states that employees do not have any expectations of privacy in their communications on MWC's computer system; the computer system belongs to MWC; the computer system only can be used for business purposes; and MWC is entitled to access and review communications on the computer system.

Starting in May 2002, the plaintiff worked primarily out of her home office. She was assigned two company laptops in succession for work-related purposes. The plaintiff used the laptops to create, send and retrieve electronic communications with her own private attorney. She deleted these communications before she returned the laptops to MWC.

Almost two years later, MWC hired a forensic consultant who was able to restore and retrieve some of the deleted communications between the plaintiff and her private attorney. The plaintiff claimed that these restored and retrieved communications were governed by the attorney-client privilege, and had to be returned and not kept by MWC. MWC, on the other hand, argued that the plaintiff had no expectation of privacy in these communications, as reflected in the policy that she had signed, and thus she had waived any potential privilege. The matter came to a head for resolution by the magistrate by the trial judge assigned to the case.

The magistrate ultimately ruled that the plaintiff had not waived her right to assert the attorney-client privilege with respect to the communications with her private attorney, notwithstanding the policy. The magistrate found significant, among other factors, that MWC had not actively enforced the policy previously, other than on just a few prior occasions, and thus had created a "false sense of security" which "lull(ed) employees into believing that the policy would not be enforced."

Moreover, the magistrate found that the plaintiff had taken reasonable precautions to prevent inadvertent disclosure of her communications with her attorney by sending the subject e-mails through her own personal AOL account, which did not go through MWC's servers, and because she had deleted the communications before returning the laptops (she did not know that those e-mails would be restored and retrieved).

Finally, the magistrate resolved that the "overarching issue of fairness" weighed in favor of the plaintiff because clients should be encouraged to provide full disclosure to their attorneys without fear that their disclosure will be invaded.

Thus, the magistrate directed MWC to return to the plaintiff her communications with her attorney that had been restored and retrieved from the company laptops she had used. MWC chose to appeal the decision for consideration by the federal trial judge in charge of the case. The trial judge affirmed the magistrate's decision in its entirety.

A narrow decision on privacy
A primary issue on appeal had to do with the magistrate's decision to take into account the fact that MWC had not previously enforced its policy to a great degree. MWC argued that to consider such a factor would be to require employers on a regular basis to actively monitor their employees. The trial judge was not swayed to reverse the decision of the magistrate.

Specifically, the trial judge held that whether a company enforces its monitoring policies or not "goes right to the heart" of whether the plaintiff's conduct was such that she waived the protection of the attorney-client privilege. Because she was using an AOL account, deleted her communications, and the company before did not regularly enforce its policy, the plaintiff's conduct did not rise to the level of waiver.

Accordingly, the trial judge found that the magistrate's analysis of prior policy enforcement, as one among other factors, was not legal error. In affirming the magistrate's decision, the plaintiff won the battle on privilege and the return of her attorney-client communications.

This represents a narrow circumstance where an employee has effectively beaten a company's computer usage policy. Generally speaking, once employees sign away their privacy, the courts will side with the position of employers that electronic communications via company equipment are not private and can be used by employers.

Therefore, employees should not take from this case that all of a sudden their electronic communications on company equipment are private or privileged. By the same token, it appears that employers can strengthen their position by actually enforcing their computer usage policies on a somewhat regular basis.