Don’t Access My Emails And Tell Me It’s Legal

By Parker E. Thoeni - Shawe Rosenthal LLP

August 3, 2017

Departing employees do a lot of dumb things with email.  Sometimes they use an employer’s systems, which they know are regularly monitored, to ask their attorneys how to set up claims against their employers.  Sometimes, after they email a slew of confidential or trade secret information to themselves on their way out the door, they click delete on the sent messages only to leave all of the evidence in the “deleted” folder.  In today’s blog, we ask employers to leave it to departing employees to do dumb stuff with email.

A good rule of thumb is generally to avoid rifling through a former employee’s personal email account without authorization.  An employer confronted this rule of thumb head-on in a recent case in the Maryland federal district court.  The case, Levin v. ImpactOffice, LLC, started with an allegation by ImpactOffice that a number of former employees breached the restrictive covenant provisions in their employment agreements.  One of the former employees, Melissa Edwards, shot back with an allegation that ImpactOffice confiscated her personal mobile phone, then used the phone to access and view emails stored in her personal Gmail account in violation of the Stored Communications Act (“SCA”).

The SCA generally prohibits unauthorized access to communications in an electronic storage system. Although the technical aspects of the SCA are interesting to a few dorky lawyers like me, the practical implications for employers here are crucial:

• If you plan to confiscate a mobile device, make sure it belongs to the Company before confiscating it.

• Do not request access to personal accounts and applications on the mobile device without a compelling reason for doing so unless you have an order from a court permitting such access.

• Follow typical e-discovery best practices and preserve potentially relevant evidence, i.e., create a forensic image of the mobile device upon a reasonable anticipation of litigation, and advise adverse parties of their preservation obligations.

Employers who feel compelled to view current or former employees’ personal email accounts are not without options.  Employers can, and should, consider the circumstances under which they might have a legitimate need to view a current or former employee’s personal accounts.  In Maryland, there is a law prohibiting an employer from requesting an employee’s personal account usernames and passwords except in limited circumstances.  Those exceptions are for situations involving (a) discovery that an employee was using personal accounts for business purposes and (b) discovery that an employee downloaded without authorization proprietary information to a personal account.  (Notably absent from the Maryland law is an exception for the investigation of a discrimination or harassment claim or a threat of violence.)

Employers should recognize that the Maryland law permits a request for the username and password in these limited circumstances, but not access without authorization from the employee.  Presumably, if the employee provides the username and password, the employee will authorize access.

A couple of practice pointers:

• Employers can fashion agreements and policies that prohibit employees from sending proprietary Company information to personal email accounts absent authorization in writing from a high level Company official (this blunts the common “my boss told me to do it so I could work from home” defense).

• Employers can consider including a provision in employment agreements allowing for a limited forensic examination of an employee’s personal accounts and devices when the Company discovers evidence of misappropriation; just be sure to limit the scope of an examination to account for the privacy interests of the employee because the enforceability of such provisions is not entirely clear.

When it is readily apparent from an employee’s email traffic that the employee has used the employer’s systems to misappropriate confidential information or trade secrets, employers should not underestimate the power of a court to order a forensic examination as part of a request for expedited discovery or a preliminary order from a court requiring a forensic expert to preserve evidence potentially relevant to the employee’s misconduct.  Employers that are reticent to rush into court can use precedent in this area as leverage to arrive at a private agreement with the employee for a forensic examination.  Word to the wise, though: leave the forensic examination to the professionals rather than reviewing emails on your own.  If you rifle through an employee’s email account on your own, you may unwittingly be modifying critical evidence.  You might also get sued.