Can an employer log in to an employee's personal email account to review his communications?

Question:

We suspect that an employee has been using his personal email account (e.g., Gmail) to communicate confidential company information to a competitor. Our company has a policy that employee use of company computers (including the internet) is subject to monitoring at any time.  Since the employee is using company computers to access his personal email account, can we log in to that employee’s personal account to review his communications?

Answer:

Unless your employee has explicitly authorized you to access his personal web-based email accounts (like Gmail, Yahoo! Mail or Hotmail), accessing such accounts may be a violation of the federal Stored Communications Act (SCA) – even if your employee has saved login and password information to a company-owned computer.  Depending on where your employees are located, unauthorized access of private email accounts may also violate state law.

Under the SCA, it is illegal to intentionally access, without authorization, communications that are stored on computer servers.  This area of law continues to develop, but the courts that have considered this issue have ruled that, in order to access personal web-based email accounts, it is not enough for a company to simply notify employees that usage of company computers will be monitored.  While such notices may be sufficient to allow a company to monitor emails stored on company servers, recent court decisions have found that such notices do not satisfy the “authorization” requirement under the SCA in the case of web-based email services.  These courts reason that communications through these services are not being stored on company-owned computers or networks, but on computer networks owned and maintained by third party companies such as Google, Yahoo! and Microsoft.  As such, compliance with the SCA would likely require that companies obtain explicit authorization from employees before accessing web-based email accounts.

In short, tread carefully: violation of the SCA is a criminal offense and could subject your company to statutory fines, civil liability and, in the case of willful and intentional violations, punitive damages.  Other penalties may result from violations of related state and federal laws, depending on the circumstances.  Be aware that you may also be barred from using information gained through unauthorized access in a later lawsuit – information that, but for such unauthorized access, you could have obtained by subpoena.

The above question and answer on email access were provided by Tina Hsu, a partner in the Employment and Labor Law and Intellectual Property practices at Shulman, Rogers, Gandal, Pordy & Ecker, P.A. in Potomac, Maryland, which regularly addresses employment law issues for The Payroll AnswerMan.

Disclaimer:  The above question and answer are for informational purposes only, and do not constitute legal advice.  Readers are responsible for obtaining the necessary advice about their specific situations from their own counsel.