13.5 Email and Database Concerns

• Library: Civil Discovery in Virginia (Virginia CLE) (2021 Ed.)

13.5 EMAIL AND DATABASE CONCERNS

13.501 Communication Confidentiality and Privilege Concerns.

A. Email Generally. Any written communication that is not made and maintained in confidence threatens the protection normally afforded to attorney-client communications or work product materials. Many attorneys use email for communicating privileged material on the assumption that email communication is as secure as fax or regular "snail mail" communication. This assumption may not be correct. Because email has become so pervasive and casual, it may be difficult to maintain a proper level of confidentiality to preserve the protected status of its contents. Email users who transmit or receive protected information should be reminded regularly of their duty to preserve confidentiality.

²³⁰ 18 U.S.C. § 2510.

The interception of email is a felony under the Electronic Communications Privacy Act (ECPA).²³⁰ Nonetheless, there have been countless stories of hackers invading email and computer systems. In addition, the ECPA itself allows certain individuals to access private (and potentially confidential) email messages. For example, internet service providers and telephone services may access email communications if necessary for the operations of the server, including regular system maintenance and monitoring to prevent the illegal use of the system. The ECPA also allows access to private email communications for law enforcement, administrative, and national security reasons.

Encrypted email is email that is readable only by authorized individuals. It has been described as the only way to "virtually guarantee" email privacy.²³¹ Encryption "involves the application of complex mathematical transformations to email messages through special bit patterns called keys. Users without the proper key, such as unauthorized recipients or browsers, cannot read encrypted messages."²³² Both the sender and the recipient must have the same encryption technology to encrypt and decrypt their messages. The possibility exists, however, that highly skilled hackers may break the key and access even encrypted messages.

B. Employee Privacy of Electronic Communications and Other Computer Data. Today, along with all of the other challenges of responding to litigation, counsel must ensure that any necessary collection of employee communications in response to discovery requests does not violate that employee's privacy. While privacy normally exists at the federal level, through, for example, the ECPA and the Stored Communications Act (SCA), some states specifically restrict an employer's right to monitor employee email or otherwise provide remedy through the common law tort of invasion of privacy.

Some decisions, however, indicate a focus on policies and reasonable expectations. When a current or former employee uses the company's internet to communicate with an attorney, that communication might be privileged from disclosure. Case law suggests that use of the employer's computer system may not serve as the third-party presence to eliminate the privilege if the employee reasonably expected the communication to remain confidential.²³³ In City of Ontario v. Quon,²³⁴ the United States Supreme Court declined to issue a "broad holding concerning employees' privacy expectations vis-à-vis employer-provided technological equipment," but still found a government employer's search of an employee's text messages reasonable under the Fourth Amendment because "there were 'reasonable grounds for suspecting the search [was] necessary for a noninvestigatory work-related purpose,'" because the search as designed was "efficient and expedient" to the purpose, and because the review of the employee's text messages was not "excessively intrusive."²³⁵ Although the Supreme Court avoided analyzing the reasonableness of Quon's privacy expectations, it provided dicta that the employee's expectation of privacy should have been limited. The Court stated that "employer policies concerning communications will of course shape the reasonable expectations of their employees, especially to the extent that such policies are clearly communicated."²³⁶

Courts, including those in the Fourth Circuit, have been clear that a company may intercept and read its employees' emails when authorized by a clear company policy that is regularly enforced.²³⁷ However, before advocating a blanket right for the collection and review of employees' email, counsel should consider these principles: (i) employees generally do not have a reasonable expectation of privacy in the addresses of websites visited using employer-owned computers and the employer's internet access; (ii) employees might have a reasonable expectation of privacy in emails sent through private accounts, but that expectation may be "nullified by explicit employer policies on computer use and monitoring;" and (iii) in order for the policy to be effective in nullifying any expectation of privacy or privilege, the employer must provide employees with an appropriately specific notice of its monitoring practices and properly enforce the policy.²³⁸

An effective electronic communications policy will prohibit the use of employer systems for personal purposes, specify that employees have no right of personal privacy in any matter stored in, created, or sent over email or internet systems, and provide notice that the employer has the right to monitor all data that flows through its systems. If all three are met, a court is likely to conclude that the employee's expectation of privacy is not reasonable, perhaps even if the communication is sent through a password-protected personal account. Without a reasonable expectation of privacy, the company would not likely be held liable for a common tort of invasion of privacy. However, lack of adequate and regular enforcement of a communications and use policy would negate the notice provided by the policy.

Similar issues regarding privacy arise as to social networking pages. If a company allows access to social networking sites through its network connection or on its devices, or if...