A recent American Management Association (AMA) survey showed that 38.1 percent of major U.S. firms store and review their employee's e-mail messages and 54.1 percent of such firms monitor their employee's Internet connections at work. Such employer monitoring and surveillance of their employees is likely to increase as the availability and usage of e-mail and the Internet continue to grow and as advances in technology make surveillance capabilities more available to employers.

When implementing or modifying policies regarding monitoring employee e-mail and Internet use, companies should consider the numerous business and practical issues for employers and employees. For example, many employers understandably are concerned about employee productivity. When employees are constantly surfing the Web to check out the stock market, sport scores, and the latest item for auction on eBay or something to buy from Amazon.com, productivity obviously can suffer. On the other hand, if employees can handle routine personal matters via e-mail or the Internet while at work, rather than having to leave the premises, employee morale and even productivity can be boosted.

In addition to such business and practical issues, monitoring raises several legal issues those employers must consider in deciding whether to implement a new policy or change an existing one. Among the primary legal issues are privacy and potential liability.

Privacy

The law regarding monitoring of employee e-mail and Internet usage is ambiguous and still evolving. What is clear is that constitutional privacy provisions do not govern most actions of most employers with respect to monitoring. The United States Constitution and many state constitutions guarantee the right to freedom from unreasonable searches and seizures and, more generally, the right of privacy. However, for the most part these ordinarily will not apply to actions by private persons or entities, such as private companies monitoring their employee's e-mail. In some states, however, such as California, the right of privacy is heightened and does apply even to nongovernmental actions.

The lack of clarity in the law regarding monitoring stems from the fact that there are no federal or state statutes specifically addressing employer monitoring of employee e-mail and Internet usage and from the absence of any U.S. Supreme Court decisions directly addressing this issue. There are, however, numerous laws that may be applicable, including the federal Electronic Communications Privacy Act of 1986 (the ECPA), the laws of many states that are modeled on the ECPA, and other statutory and non-statutory laws (such as non-statutory law regarding invasion of privacy). Of these laws, the ECPA is the most salient.

The ECPA expanded the scope of the federal wiretapping statute to protect electronic communications from interception, use and disclosure and to protect wire and electronic communications in electronic storage. Thus, the ECPA generally prohibits intercepting messages in transit and unauthorized access of stored messages. However, the interaction between the various provisions of the ECPA is "a complex, often convoluted, area of the law." Indeed, the complexity extends even to the definition of terms such as "intercepted", "electronic communication" and "wire communication."

There are several loopholes in and exceptions to the ECPA relevant to the issue of employer monitoring. For example, while the ECPA generally appears to prohibit monitoring of e-mail while in transit, there appears to be a broad exception for an e-mail provider (presumably including an employer providing such services in-house), or messages. Similarly, interception of electronic communications and access to stored communications generally are not prohibited by the ECPA if prior consent is obtained explicitly or implicitly from one of the parties to the communication.

The above discussion merely scratches the surface of the potential privacy issues raised by the ECPA and other laws concerning monitoring of employee e-mail and Internet usage. Other issues beyond the scope of this article include, but are by no means limited to, the following:

• What restrictions, if any, are imposed on a company's use or disclosure of information obtained through monitoring employee e-mail and Internet activities?
• What notice and consent requirements apply to employer monitoring?
• What civil and criminal penalties apply to violations of law in conducting such monitoring?
• Under what circumstances might a company's monitoring and recording activities give rise to non-statutory claims?
• What law governs, in whole or in part, when a communication that is monitored involves parties in different states or activities conducted in different states? In formulating or revising their monitoring policies, employers should be aware of the intricacies of the various applicable laws and seek to avoid any potential pitfalls.