A ruling by a three-judge panel in the U.S. Ninth Circuit Court of Appeals has established new privacy rights for employees who use employer-issued cell phones, pagers and computers to send personal text messages.
The judges upheld the verdict in Quon v. Arch Wireless, which determined that if an employer contracts with an outside provider for messaging — as most do — it does not have the right to ask the service provider for transcripts of the text messages employees send out. The same concept can be applied to e-mail communications if the employer outsources that service instead of maintaining it on an internal server.
Stampede of Lawsuits?
The ruling touched on other points of contention among law enforcement agencies, defense attorneys and Internet service providers. For instance, it determined that the service provider, Arch Wireless, was an electronic communication service, and thus entitled to more privacy protections than a remote computing service under the 1986 Stored Communications Act. That is a distinction that communications service providers will clearly have to master now.
Still, the ruling’s most significant impact will be felt in the workplace, notes the Electronic Frontier Foundation in a blog post: “Even if your employer pays for your use of third-party text or e-mail services, your boss can’t get copies of your messages from that provider without your permission. Wow.”
It is a win for privacy rights advocates who perhaps had never expected to see employers curtailed in this fashion. Courts have long established that employees should have no expectation of privacy when sending e-mails from employers’ computers. If the e-mails are stored on internal servers, that is still the case.
This new ruling, though, carves out new privacy protection for employees, especially those who use employer-supplied cell phones and pagers. Indeed, it is the first time the Fourth Amendment — protection against unreasonable search — has been applied to electronic communications in a work setting, Charles Baker, a partner with Porter & Hedges, told the E-Commerce Times.
The ruling could open up new lines of attack against the long-established belief that an employer has the right to see anything that is sent out on its e-mail system, he speculated. Even if servers are in-house, he said, “one could argue that this ruling applies.”
This decision will no doubt embolden others to mount similar legal challenges, said Barry Werbin, a partner with Herrick, Feinstein.
“There will be a continuum of decisions we will see on employees’ ‘reasonable’ expectation of privacy in the workplace,” he told the E-Commerce Times. Many will likely focus on technical details specific to each case, he said, such as how a message was sent, what service was used, whose equipment was used to send it, and the wording of the employer’s privacy policies.
Several of these issues are at play in Quon v. Arch Wireless. Jeff Quon, a police sergeant for the city of Ontario, Calif., and three other officers — one of whom was his wife — sued Arch Wireless because it handed over his text messages to his supervisor. The supervisor wanted to find out if Quon was using the pager for personal purposes, because he kept exceeding the 25,000-character limit provided in the contract. Quon had indeed been sending personal messages.
Still, the case was not straightforward, and some small but significant details may limit the ruling’s impact on privacy in the workplace.
The Unofficial Way
Ontario did not have a formal policy about text-messaging, but it did have a general computer, Internet and e-mail policy, according to court documents. It stated that use of such equipment was limited to city business, but that provision was widely ignored.
Under the city’s contract with Arch Wireless, each user was allotted 25,000 characters. Going over that limit meant the city would have to pay overage charges. A lieutenant in charge of the purchasing contract would routinely collect over-limit fees from employees — including Quon on several occasions — without comment.
At one point, however, after the lieutenant said he was “tired of being a bill collector with guys going over the allotted amount of characters on their text pagers,” his chief ordered him to “request the transcripts of those pagers for auditing purposes … to determine if the messages were exclusively work-related, thereby requiring an increase in the number of characters officers were permitted, which had occurred in the past, or if they were using the pagers for personal matters,” according to the appeal. Quon was one of the officers.
Follow Your Policy
It is these facts that will limit the decision’s impact on the workplace, said Evans C. Anyanwu, a principal and Internet attorney with Anyanwu & Associates.
“If the city had followed its stated policy, it would have been fine,” he told the E-Commerce Times, “but it didn’t.” The case is not likely to become a gateway to all kinds of liability-driven suits as some employers fear, Anyanwu said. It’s merely a “warning to employers to not say one thing and then do another.”
The Ontario police department could have proved that its officers were using pagers for personal reasons without violating their privacy, he explained.
“Had … the police department reviewed only the ‘to’ and ‘from’ portion of the text messages to determine if officers were sending texts to official police phones — and not [the messages’] substance — there would be no claim against the department. This is because the Ninth Circuit has recently found that there is no expectation of privacy in the headings of e-mails,” added Anyanwu, citing United States v. Forrester.
Furthermore, the lieutenant in charge of administering the policy declared that he would not audit the messages of officers who did not exceed the 25,000 character allotment, he noted, further complicating the department’s position.
“Quon had exceeded the allotment ‘three or four times’ in the past and paid for the overage absent any review of his text messages,” Anyanwu pointed out.
“Without this waiver on the part of the department, and absent a less intrusive means of deciphering whether texts were personal or official, this matter would only have been tried against Arch Wireless,” he said. “The Court cited numerous cases to support its position that if the department’s Computer Usage Policy — which Quon signed and acknowledged — was ‘operational reality,’ the case would have been held differently.”
The real substance of the case is the determination that Arch Wireless is an electronic communication service, Anyanwu continued.
“If Arch Wireless merely ‘stored’ the data, it would then only need the lawful consent of the city of Ontario for release of the text messages,” he explained. “However, as an ECS, it could only release the data to the addressee or intended recipient. To circumvent this — should they choose to do so — an addendum need only be included in the city’s contracts with its employees and service provider, acknowledging the city of Ontario as the addressee of all text messages on city-owned pagers.”
Loading ...
The Quon case may give employers incentive to broadcast multiple, repetitive privacy disclaimers. –Ben Wright http://hack-igations.blogspot.com/2008/06/employee-imtexte-mailvoicecomputerinter.html