What are the US Employee Monitoring laws? The 101 FAQ [Up to date]

Is employee monitoring legal?

Broadly, in the US, employee monitoring is legal and mostly unregulated. As an employer-provided computer system is property of the employer, they may listen to, watch, and read employees’ workplace communication and, in some cases, personal messages. What’s more, an employer’s stated policy on workplace monitoring might not be legally binding.

Digital privacy is covered by the Electronic Communications Privacy Act (ECPA), which protects against the interception (in transit) of digital and electronic communications. It also includes the Stored Communications Act (SCA), which, as the name suggests, covers the disclosure of stored communications and records. The ECPA includes a business exception that allows employers to intercept communications on systems provided by the employer, and when it is done in the “ordinary course of business”. The SCA has a broader exception, allowing employers to access stored information outside of the ordinary course of business.

On a state level, only Connecticut and Delaware require that employers notify employees about monitoring of email or internet beforehand. These laws apply to the specific cases covered below.

Can you track an employee’s phone?

In most cases, employers may track the use of a company provided phone, including mobile phones. The Electronic Communications Privacy Act stipulates that employers can intercept calls in the ordinary course of business, and when equipment furnished by a communication services provider is used.

Under the ECPA, an employer must stop monitoring a call once they’ve determined it’s personal. Employers can protect themselves by prohibiting personal phone calls and/or clearly identifying lines where calls will be monitored (as seen in James v. Newspaper Agency Corp. and Simmons v. Southwestern Bell Telephone Co.). However, the court ruled against the employer in Watkins v. L.M. Berry & Co. because employees had been told personal calls would only be monitored up to the point necessary to determine if they were personal. Other rulings against employers include cases where monitoring equipment was not furnished by a communication services provider, but was privately purchased or homemade.

Regardless, most Americans use their personal mobile phone for work. It’s therefore important for employers to create a clear “Bring Your Own Device” policy. This will help protect employers not only with monitoring, but also in cases of data breaches, legal discovery, and liability for employee actions.

Can you monitor employees’ computers?

Generally, an employer can monitor any activity on a company owned computer or network. This includes laptops or other devices outside the workplace, but provided by an employer. Monitoring software can take screenshots, access hard disks, and monitor keystrokes and internet usage of employees.

Case law on computer monitoring is well established and certainly favors the employer. However, some union contracts may include exceptions, and there are small differences in certain state laws. The 4th amendment protection against unlawful search and seizure may cover certain public employees. Therefore, it’s best to establish a clear company policy and get employee consent.

Can you monitor employee email?

An employer can review the contents of a company owned email system. This is true even if an employee has marked emails as “private”. If employees are notified that computers are monitored, or are not for personal use, it’s understood that personal email used at work may be checked.

With regards to work email, case law stipulates that neither password protected personal folders, nor at home computers are protected if they are company owned (McLauren v. Microsoft and TBG Insurance v. Superior Ct., respectively). Case law for personal email is more ambiguous.

The case Stengart v. Loving Care showed a “reasonable expectation of privacy” because company policy on personal email use was ambiguous. Moreover, the emails in question were between the plaintiff and her attorney. The court ruled that a company cannot enact a policy that forces employees to give up rights like attorney-client privilege.

The court also found a reasonable expectation of privacy in Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC because of ambiguous policy. Furthermore, it couldn’t be proven that emails sent via a third party provider (e.g. Hotmail or Gmail) were in fact sent from or read on company equipment.

Is it legal for an employer to track an employee using GPS?

GPS tracking of an employer owned vehicle is legal in all states, and tracking using company owned property (like a smartphone) is legal in most. Tracking employees using their own property is a legal grey area. In all cases, employers must be cautious about tracking employees outside work hours.

In the most notable case, Arias v. Intermex Wire Transfer, the plaintiff claimed she was fired after uninstalling a GPS tracking app on a company-issued smartphone. She was told the phone needed to be left on 24/7 to receive client calls, and that it would continue to track her during off-work hours. While the case settled out of court, it’s a tale of caution for employers.

In most cases, location tracking is allowed whenever the employee is aware of it. Sufficient notice, or awareness, indicates implied consent. In other words, an employee usually doesn’t need to give signed consent. Nevertheless, employers should err on the side of caution and communicate clear company policies.

Can an employer monitor employee social media?

Employer “monitoring” of social media use is difficult to define, as content shared on social media is willingly made public by the poster. California, Illinois, Maryland, Michigan, Nebraska, New Mexico, New Jersey, Utah, Washington, and Wisconsin do have laws prohibiting employers from requiring employees to supply social media login information.

Regardless, the National Labor Relations Act (section 7) gives employees the right to discuss the terms and conditions of their employment with their co-workers or anyone outside the company. In other words, an employee generally cannot be fired for complaining about work conditions via social media. Nearly 30 states also have laws protecting employees from termination based on legal activities outside the workplace. This could include use of alcohol and tobacco, or political activism.

Companies should consult state law when creating policies on social media use.

How does GDPR impact employee monitoring in the US?

The General Data Protection Regulation (GDPR) applies to United States companies with employees in the European Union. GDPR strengthens existing laws on employee monitoring in the European Union, which require necessity, awareness, and agreement.

In other words, all of the above mentioned cases change if you are dealing with employees in the EU. Companies must inform these employees in clear, concise language about data collected. This includes the means of collection, how data will be used, what will be stored, for how long, and who will have access to it. If a company can legally monitor employees, they must ensure that only necessary data is collected, that it is used for the purpose for which it was collected, and that it is properly secured.

Stay tuned for a future post that will cover employee monitoring in the European Union in more detail.

Is “time tracking” employee monitoring?

Employee time tracking could certainly fall under the umbrella of “monitoring”, but with some important differences. For one, usually employees themselves perform time tracking, with full transparency. Employees clock themselves in and out and record their own time. They are in control. Collected information is limited to the amount of time and/or money spent on a task or client. No personal information, conversations, or correspondence are monitored.

Another key distinction is in the ultimate objective of time tracking versus monitoring. Targeted monitoring of employees is usually meant to clamp down on theft, fraud, harassment, or some other unprofessional or even illegal behavior. The main goal of task and time tracking is to collect business intelligence. Effective time tracking can not only save companies time and administrative costs, but also offer valuable data and insights. Companies can better allocate resources, more accurately forecast budgets, analyze trends, and identify opportunities and challenges.

Employees will be far more receptive to time tracking if they understand the value of it, so companies should strive to clearly communicate the means and objectives.

So what does it all mean?

Employee privacy laws can be vague, which means that all parties should err on the side of caution. Companies are understandably eager to control costs and employee performance. However, they should be aware of the legal consequences, as well as the impact on employee morale and workplace culture.

To fully understand your rights and obligations, refer to state and federal laws, like the Electronic Communications Privacy Act, the Stored Communications Act, and the General Data Protection Regulation. Companies should also consider implementing or reviewing the following policies: an Electronic Communication Policy, Social Media Policy, Bring Your Own Device (BYOD) Policy, Sexual Harassment Policy, Confidentiality and Non-Disclosure Policy, and a Written Information Security Program (WISP).

And last but not least, if you found this post helpful, you won’t want to miss our FAQs on U.S. employee breaks.

—

Photo by Rishabh Varshney on Unsplash