Monitoring technology in the American workplace: Would adopting English privacy standards better balance employee privacy and productivity?

California Law Review

Volumn 95, Issue 4, 2007, Pages 1115-1149

  Evans, Laura ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 36048940122     PISSN: 00081221     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (109)

1. Matthew W. Finkin, Information Technology and Workers ' Privacy: The United States Law, 23 COMP. LAB. L. & POL'Y J. 471, 474 (2002) [hereinafter Finkin, Information Technology].
2. Id.
3. (citing AMA, SURVEY: WORKPLACE MONITORING & SURVEILLANCE, SUMMARY OF KEY FINDINGS 1 (2001)).
4. Id.
5. (citing Privacy Foundation, The Extent of Systematic Monitoring of Employee E-Mail and Internet Use (July 1, 2001), http://www. privacyfoundation.org/workplace/technology/extentpf.html).
6. Id. (citing Surf Watch (June 4, 1999)). The situation facing employers has grown increasingly complex as modem advances in information technology have revolutionized the workplace, introducing a plethora of new opportunities for employee misbehavior. See, e.g., Vivien K. G. Lim, The IT way of Loafing on the Job: Cyberloafing, Neutralizing, and Organizational Justice, 23 J. ORGANIZATIONAL BEHAV. 675 (2002).
7. 18 U.S.C. §§2510-2521 (2006). Such a privilege is currently available both as a common law defense and under the ECPA, and would likely be available under other proposed legislation. See, e.g., Garrity v. John Hancock Mut. Life Ins. Co., 2002 U.S. Dist. LEXIS 8343, at *3-6 (D. Mass. May 7, 2002); Fischer v. Mt. Olive Lutheran Church, 207 F. Supp. 2d 914, 922-923 (W.D. Wis. 2002).
8. These Standards come from the Data Protection Act, 1998, c. 29, sched. 1, part I (Eng.): "Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. 2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. 3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4. Personal data shall be accurate and, where necessary, kept up to date. 5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. 6. Personal data shall be processed in accordance with the rights of data subjects under this Act. 7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. 8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data." See infra Part II.A.2 for a full discussion.
9. For further discussion of technology-related threats to employee privacy, see Michael Baroni, Employee Privacy in the High-tech World, 48 ORANGE COUNTY LAWYER 18 (May 2006) (discussing, for example, "spy-cams" and bugging).
10. See Reidenberg, infra note 26, at 1320.
11. Id.
12. Id. at 1322.
13. Id. at 1323.
14. Ben Chamy, Big Boss is Watching, CNET NEWS.COM, Sept. 24, 2004, http://news.com.com/Big+boss+is+watching/2100-1036_3-5379953. html.
15. See, e.g., STEVEN L. WILLBORN ET AL., EMPLOYMENT LAW: CASES AND MATERIALS 343 (3d ed. 2002) (discussing reluctance of employers to give references); Elizabeth Millard, Online Background Checks, 93 A.B.A. J. 37, 37 (2007) (discussing how employers search "profiles, blogs, and visible chat sessions" as part of employee background checks).
16. See Bologna, infra note 53, at 186-87.
17. Id. at 187.
18. See, e.g., Erin Binns, What Does the Web Say About You?, 35 STUDENT LAW. 16, 16 (2007) ("In a recent poll conducted by the National Association for Law Placement, 85 percent of respondent employers admitted to using search engines and social networking sites like MySpace and Facebook to research candidates.").
19. For a more complete discussion of the potential employer concerns and employee privacy issues with blogs, see William H. Floyd III & James T. Hedgepath, The Electronic Workplace: Blogs, Cybersmears, and Similar Challenges, 17 S. CAROLINA LAWYER 36, (May, 2006); Rafael Gely & Leonard Bierman Summer, Workplace Blogs and Workers ' Privacy, 66 LA. L. REV. 1079 (2006);
20. and Henry Hoang Pham, Note & Comment: Bloggers and the Workplace: The Search for a Legal Solution to the Conflict Between Employee Blogging and Employers, 26 LOY. L.A. ENT. L. REV. 207 (2005/2006). For a discussion of employees breaching the duty of loyalty to employers,
21. see Konrad Lee, Anti-Employer Blogging: Employee Breach of the Duty of Loyalty and the Procedure for Allowing Discovery of a Blogger's Identity before Service of Process is Effected, DUKE L. & TECH. REV. 2, 9714 (2006).
22. Paul M. Schwartz, Property, Privacy, and Personal Data, 117 HARV. L. REV. 2055, 2056-57 (2004).
23. See Bologna, infra note 53, at 191.
24. Reidenberg, Resolving Conflicting International Data, infra note 26, at 1324.
25. See, e.g., Nancy J. King et al, Workplace Privacy and Discrimination Issues Related to Genetic Data A Comparative Law Study of the European Union and the United States, A3 AM. BUS. L.J. 79 (2006);
26. Tara L. Rachinsky, Comment, Genetic Testing: Toward a Comprehensive Policy to Prevent Genetic Discrimination in the Workplace, 2 U. PA. J. LAB. & EMP. L. 575 (2000);
27. Lauren J. Sismondo, Note, GINA, What Could You Do for Me One Day?: The Potential of the Genetic Information Nondiscrimination Act to Protect the American Public, 21 WASH. U. J.L. & POL'Y 459 (2006);
28. Kimberly A. Steinforth, Note, Bringing Your DNA to Work: Employers ' Use of Genetic Testing Under the Americans with Disabilities Act, 43 ARIZ. L. REV. 965 (2001);
29. Maureen E. Mulvihill, Note, Karraker v. Rent-A-Center: Testing the Limits of the ADA, Personality Tests, and Employer Preemployment Screening, 37 LOY. U. CHI. L.J. 865 (2006);
30. Eva Lorenz, Comment, Predictive Testing in the Workplace-Could the German Model Serve As a Blueprint for Uniform Legislation in the United States?, 7 N.C J.L. & TECH. 487 (2006).
31. See, e.g., Daniel P. O'Gorman, Looking out for Your Employees: Employers' Surreptitious Physical Surveillance of Employees and the Tort of Invasion of Privacy, 85 NEB. L. REV. 212 (2006);
32. Kelly Gallagher, Note, Rethinking the Fair Credit Reporting Act: When Requesting Credit Reports for "Employment Purposes" Goes Too Far, 91 IOWA L. REV. 1593 (July, 2006);
33. Pauline T. Kim, Collective and Individual Approaches to Protecting Employee Privacy: The Experience with Workplace Drug Testing, 66 LA. L. REV. 1009 (2006).
34. See, e.g., King et al, supra note 21; Mulvihill, supra note 21;
35. Steinforth, supra note 21;
36. Rachinsky, supra note 21;
37. Lorenz, supra note 21;
38. Sismondo, supra note 21;
39. O'Gorman, supra note 22;
40. Gallagher, supra note 22;
41. Kim, supra note 22.
42. Paul Schwartz, Privacy, Participation, and Cyberspace: An American Perspective, in ZUR AUTONOMIE DES INDIVIDUUMS 337-38 (Dieter Simon & Manfred Weiss eds., 2000).
43. See Finkin, Information Technology, supra note 1, at 472.
44. See Joel R. Reidenberg, Resolving Conflicting International Data Privacy Rules in Cyberspace, 52 STAN. L. REV. 1315, 1331 (2000) (arguing that "[1]egal rules are relegated to narrowly targeted sectoral protections," and providing an example of privacy protections in video rental but not in online streaming video) [hereinafter Reidenberg, Resolving Conflicting International Data].
45. See Finkin, Information Technology, supra note 1, at 472.
46. RICHARD A. EPSTEIN, CASES AND MATERIALS ON TORTS 1045 (8th ed. 2004).
47. RESTATEMENT (SECOND) OF TORTS §652B ( 1977).
48. 914 F. Supp, 97, 98 (E.D. Pa. 1996).
49. Id. at 101.
50. Id.
51. Garrity v. John Hancock Mut. Life Ins. Co., 2002 U.S. Dist. LEXIS 8343, at *1 (D. Mass. May 7, 2002).
52. Id. at "3-6.
53. Id.
54. 440 N.W.2d 548, 549-550 (Wis. 1989).
55. Id. at 550.
56. Id. at 550-551.
57. Id. at 555 (The employee asserted that this was "[publicity given to a matter concerning the private life of another, of a kind highly offensive to a reasonable person.").
58. Id. at 553-54.
59. 613 So.2d 646, 648-49 (La. Ct. App. 1993).
60. Id. at 649.
61. Id. at 658.
62. 18 U.S.C. §2710 (2006).
63. 18 U.S.C. §2710(b)-(C) (2006).
64. 42 U.S.C. §1320d-6 (2006).
65. 20 U.S.C. §1232g(b)(2006).
66. 42 U.S.C. §12112(d) (2006).
67. 15 U.S.C. §1681(a)-(b) (2006).
68. See Andrew B. Serwin, Confronting the Legal and Business Realities of Data Security, LAW.COM, Feb. 27, 2006, http://www.law.com/jsp/article.jsp?id=l140775515203.
69. See id. ("[T]he FTC ... claim[ed] that the alleged lack of security constituted an unfair business practice under the FTC Act, which in turn led to the FTC seeking significant sanctions against the company").
70. No. CV-S-04-0963-RLH-PAL (D. Nev. settlement filed July 13, 2004).
71. Michael Bologna, Pre-Employment Background Screenings Are Prevalent, Exhaustive, Likely Here to Stay, 178 LAB. REL. REP. 186, 188 (2005).
72. Wiretap Act, 18 U.S.C. §§2510-2521 (2006); Stored Communications Act, 18 U.S.C. §2701-2711 (2006).
73. 18 U.S.C. §2511 (2006). One exception exists where a person gives or has given consent to the interception. 18 U.S.C. §2511(d) (2006).
74. 18 U.S.C. §2701 (2006).
75. See Finkin, Information Technology, supra note 1, at 480.
76. 38 F.3d 736, 738, 740 (4th Cir. 1994) (finding that to meet the business-use exception of the EPCA, the business should have had the telephone line installed in the ordinary course of business and have used the line in the ordinary course of business).
77. 250 F.3d 980, 984 (6th Cir. 2001).
78. See, e.g., Berry v. Funk, 146 F.3d 1003 (D.C. Cir. 1998) (allowing a State Department employee to avoid summary judgment for factual development on the business-extension exception and other exceptions); Arias v. Mut. Cent. Alarm Serv., Inc., 202 F.3d 553, 559 (2d Cir. 2000) (finding legitimate business reason for interception because of industry custom of recording all telephone calls to and from business).
79. See discussion infra Part (I)(A)(2)(b) for more on state statutory claims.
80. 207 F. Supp. 2d 914, 922-923 (W.D. Wis. 2002).
81. Id.
82. Id. at 925-926.
83. Id. at 930-31.
84. 302 F.3d 868 (9th Cir. 2002).
85. Id. at 872.
86. Id. at 878, 880.
87. 2004 U.S. Dist. LEXIS 18863, at *2, 10 (D. Or. Sept. 15, 2004).
88. Id. at 72-73.
89. Id. at 74-75.
90. This is not the case elsewhere. For example, in contrast, in England, notice may not suffice if an employer's practices do not reflect written policy. See Mark Jeffery, Information Technology and Workers' Privacy: The English Law, 23 COMP. LAB. L. & POL'Y J. 301, 333 (2002) ("[E]ven where employees have been clearly notified that computer monitoring may occur, if the employer does not carry out such monitoring in practice then the employees will have been led to believe that their privacy will be respected and so a further warning will be necessary before the employer may lawfully start monitoring.").
91. CAL. CONST, art. I, §1 ("All people are by nature free and independent and have inalienable rights. Among these are ... privacy."). For cases interpreting the article, see, e.g., TBG Ins. Servs. Corp. v. Superior Court, 117 Cal. Rptr. 2d 155 (Ct. App. 2002), where the court allowed employer to use evidence of employees' access of pom sites on work computer used at home in wrongful termination suit, and Barbee v. Household Auto. Fin. Corp., 6 Cal. Rptr. 3d (Ct. App. 2003), where the court found an employee did not have a privacy interest with regard to romantic relationships.
92. See Finkin, Information Technology, supra note 1, at 477 note 36.
93. MASS. GEN. LAWS ch. 214, §IB (2005).
94. CONN. GEN. STAT. §31 -48d(b) (2006).
95. CONN. GEN. STAT. §31-48d(c)-(d) (2006).
96. DEL. CODE ANN. tit. 19, §705(b) (2006).
97. Security of Communications Act, FLA. STAT. §934.03 (2007).
98. See Finkin, Information Technology, supra note 1, at 492.
99. MICH. COMP. LAWS §423.508 (2001).
100. 820 ILL. COMP. STAT. 40/9 (2005).
101. Id.
102. A March of 2006 shepardization of the statutes revealed numerous cases interpreting the Massachusetts statute and to a certain extent the Florida statute, but none interpreting the Connecticut, Delaware, Illinois, or Michigan statutes, for example.
103. Finkin, Information Technology, supra note 1, at 503-04.
104. See Jeffery, supra note 72, at 335-37.
105. See id.
106. Christophe Vigneau, Information Technology and Workers' Privacy: Regulatory Techniques, 23 COMP. LAB. L. & POL'Y J. 505, 506 (2002).
107. England is discussed rather than Great Britain because Scottish law is not purely common law.
108. Kaye v. Robertson, [1991] F.S.R. 62 (Eng. CA. 1990) (stating that there was no tort of privacy).
109. Jeffery, supra note 72, at 302 n.3 (citing BASIL MARKESINUS & SIMON DEAKIN, TORT LAW 648 (4th ed. 1999)).