Employer Guidelines for Monitoring Employee Communications Under Federal and Illinois Law
Table of Contents:Federal Electronic Communications Privacy Act (the "ECPA")
Illinois Eavesdropping Statute
Illinois Unauthorized Videotaping and Photographing Statute
Suggestions
Inappropriate use of company electronic communications systems such as voicemail, e-mail and the Internet by employees can produce significant liability. Claims of sexual harassment/hostile environment have been based upon receipt of pornographic material sent on company equipment. Inappropriate use of such equipment can seriously undermine a company's ability to protect its trade secrets and other confidential information, and it also contributes to claims for antitrust violations and copyright infringement.
The recent explosion of technological devices capable of recording and monitoring employee conduct come at a time when employers are seeking new methods for trying to prevent the above problems and for avoiding liability based on negligent hiring and employee misconduct. It also comes at a time when social concerns about the erosion of individual privacy have increased, resulting in the enactment of laws designed to significantly restrict the use of such devices in the workplace and elsewhere.
Employers are now faced with a dilemma: using more sophisticated methods for monitoring conduct can lead to claims of violation of privacy rights, thereby negating the beneficial effects intended. Consequently, it is increasingly important for employers to be aware of statutory and other limitations imposed on such monitoring and to comply fully with their legal obligations.
This memorandum examines requirements of various Federal and Illinois[1] laws as they relate to electronic monitoring of employees.
Federal Electronic Communications Privacy Act (the "ECPA")
General Provisions
The ECPA proscribes the interception of “any wire, aural, or electronic communication,” except under certain circumstances. “Interception” is defined as the “aural or other acquisition of the contents of any wire, electronic, or aural communication through the use of any electronic, mechanical, or other device.” Also prohibited is the accessing of stored electronic communications (subject to the exception described below) and disclosing the contents of an electronic communication. Thus, prohibited interception covered by the ECPA includes live monitoring and recording (and likely the mechanical transcription) of telephone conversations, and monitoring of voice mail and e-mail messages.
Exceptions
There are a number of exceptions to the above prohibitions, and many of them govern the type of monitoring most often employed in the workplace.
One-Party Consent
Interception of electronic communications is not prohibited if either the sender or recipient consents to the interception before it occurs. Prior consent must be clear and unequivocal. As the court held in Jandak v. Village of Brookfield, 520 F. Supp. 815, 821-822 (N.D. Ill. 1981):
When considering a statute designed to protect privacy, a court must be reluctant to give expansive reading to the exceptions. In this instance, the difference between consent and implied consent is enormous; application of the consent exception when the victim did not know that the conversation would be recorded would distort the plain requirement of “prior consent.”
In the Jandak case, the employer instituted telephone monitoring to assure that the phones were not being misused for private purposes or in violation of established regulations. Though the court held that such use could properly be considered within the “ordinary course of business,” the monitoring did not fall within the business use exception (described below) because it was not limited to business telephone conversations. The employer's claim that its actions fell within the one-party consent rule were unsuccessful based on the court's conclusion that consent could not be implied.
Business Use Exception
To be exempt from coverage under the business use exception, the interception must be conducted within the ordinary course of an employer's business and the subject matter of the intercepted communication must be one in which the employer has a legal interest. For example, employers engaged in telemarketing may monitor employee telephone conversations with customers for quality control purposes.
Employers must be aware, however, that the exception applies only to business-related communications. Therefore, if and when a conversation becomes personal, the employer may lose its business use exemption, as in the Jandak case described above, because it is no longer authorized to monitor such conversations.
Equipment Exemption
The ECPA also contains an exemption for certain “wiretapping”. It permits the interception of wire, oral or electronic communications by use of any “telephone or telegraph instrument, equipment or facility, or any component thereof . . . furnished by the subscriber or user for connection to the facilities of [a wire or electronic communications service, i.e. a telephone company] and used in the ordinary course of [the subscriber's] business.” This “equipment exemption” or “extension telephone exemption” immunizes telephone interception only if qualifying equipment is used in the ordinary course of business.
A frequently recognized “business purpose” for phone monitoring is to assure that business phones are not misused for private purposes or in violation of established policies. While the “equipment exemption” applies to business call monitoring, like the business use exemption, it does not apply to the monitoring of personal calls because such monitoring is not undertaken in the “ordinary course of business.” Therefore, a personal call may be monitored in the ordinary course of business to determine the nature of the call (i.e., that it is a personal rather than a business call). However, monitoring of the contents of a personal conversation is prohibited by the ECPA.
Liability for Violations
Generally, violations of the ECPA are punishable by fines or imprisonment of up to five years, or both. Additionally, any person whose communication has been intercepted, used or disclosed in violation of the ECPA may bring a civil action for equitable relief, damages, and reasonable attorneys' fees and litigation expenses. Under certain circumstances, a plaintiff can be awarded actual damages, or statutory damages of $100 per day for each day of violation or $10,000, whichever is greater.
Illinois Eavesdropping Statute
General Provisions
Illinois law prohibits the use of an “eavesdropping device,” which is defined as “any device capable of being used to hear or record oral conversation or intercept, retain, or transcribe electronic communications whether such conversation or electronic communication[2] is conducted in person, by telephone, or by any other means.” The Act also prohibits disclosure of any information which an individual “knows or reasonably should know was obtained through the use of an eavesdropping device.”
Exemptions
Business Use
There are numerous exemptions to the eavesdropping prohibition. Most relevant for employers is the exemption that allows a corporation or other business entity “engaged in marketing or opinion research” or “telephone solicitation”[3] to record or listen to telephone solicitation conversations or marketing or opinion research conversations by an employee when the monitoring is used for the purpose of “service quality control, education or training of employees,” or “internal research related to marketing or opinion research or telephone solicitation;” and the monitoring is used with the consent of at least one person who is an active party to the marketing, opinion research or telephone solicitation conversation being monitored. This exemption also provides that, “[N]o communication or conversation so recorded may be furnished to any law enforcement agency or used in any administrative, judicial or other proceedings, or divulged to any other person.” Additionally, if any recording or listening authorized by this exemption results in recording or listening to a conversation that does not relate to the specific business purposes allowed, the listening or recording must terminate immediately and be destroyed as soon as practicable.
Finally, businesses that use a telephone monitoring/recording system under the exemption must provide current and prospective employees with notice that the monitoring or recording may occur during the course of their employment. This notice must be in writing and posted in a location prominent within the workplace. Business entities using this exemption must also provide their employees with access to telephone lines designated for personal use only. Pay telephones that are not subject to monitoring or recording will fulfill this requirement.
Consent
The language of the Illinois Eavesdropping Act requires consent from all parties to the conversation. The Illinois courts initially recognized a “one party consent” exception, and the Illinois Supreme Court and Illinois Appellate Courts have ruled that the Act allows the recording of a conversation as long as one party to the conversation consents to the recording.
The Seventh Circuit also discussed the “one-party consent” exception to the Illinois Act. Noting that the Illinois courts' interpretation of the statute was “odd,” the Seventh Circuit nonetheless found that the one-party consent exception is a recognized exception to the statute. Thomas v. Pearl, 998 F.2d 447 (7th Cir. 1993).
Following these decisions, however, the Illinois legislature revised the statute to reconfirm the all party consent requirement.
Penalties
Violation of the Illinois eavesdropping law is a Class Four felony punishable by imprisonment of up to five years. Civil remedy available to individuals whose conversations are subject to prohibited eavesdropping include injunctive relief, actual damages and punitive damages.
Illinois Unauthorized Videotaping and Photographing Statute
General Provisions
Illinois has also enacted a statute that prohibits videotaping, photographing and filming of individuals while they are in restrooms, tanning salons and tanning booths. No other type of visual monitoring is proscribed by this law.
Exceptions
Videotaping, photographing and filming in these locations are allowed when certain types of police activity are involved or when the individual subject consents.
Penalties
Violators are subject to conviction for a Class A misdemeanor.
Suggestions
It is clear employers must walk a fine line between taking steps to protect their valid business interests and avoiding violations of communication monitoring laws. Many of these risks can be mitigated through proactive steps such as the following.
Develop a Written Policy
The most important purpose of a written policy governing employee use of the company's electronic media is to educate employees to the risks such media involve and the proper usage of such electronic messaging. A good policy also can help to insulate the employer from liability based on improper use and confirm the employer's right to take disciplinary action. Further, a clear policy preserving the employer's right to access and monitor internal and external employee electronic communications sent will help to dispel any expectation of privacy and undermine any claim by the employee that such monitoring violates rights of privacy.
What constitutes an appropriate policy with respect to electronic communications will depend on various environmental factors such as the nature of the business, the type of employees who have access to these systems, and the company's culture. The following should be considered:
Policy Scope
The scope of any policy may be limited or expansive, depending on individual considerations.
A “maximum” protection policy emphasizes the employer's ownership of electronic messaging systems and stored messages and its resulting right to monitor and disclose any messages stored on its system. Such a policy also emphasizes that there should be no expectation of any privacy in any such messages, stresses that the employer's electronic communications media can be used only for business purposes and forbids personal use at any time.
At the other end of the spectrum, some employers choose to adopt a pro-privacy policy providing that the employer will not access or disclose electronic communications without employee consent or with limited exceptions, such as to investigate criminal activity or breaches of security and disclosures required by law. Such policies emphasize mutual trust and respect and may even encourage the inception of internal messages.
An intermediate course is to reserve the employer's right to access and disclose such messages for legitimate business purposes, such as preventing misuse, identifying and correcting software or hardware problems, investigating illegal or unethical conduct, and assuring compliance with company policies. A middle ground entails stating that the employer will access and disclose messages only when there is a legitimate business need to do so and the necessary information cannot be obtained with the employee's consent or from a less intrusive source. This middle course recognizes the inevitability of occasional personal use of e-mail and voicemail, but preserves the employer's access rights in the face of overriding business considerations.
Policy Content
Regardless of the scope of the policy, most policies should contain provisions such as the following:
- A statement that e-mail and voicemail should be used with the same level of care used for hard copy communications, emphasizing that even after messages have been “deleted” or “erased” they can often be recovered.
- A warning that e-mail and voicemail are not secure means of communication, that sensitive information should be conveyed in person, or, if electronically, only with the use of company-approved encryption technology.
- A prohibition against the use of the employer's systems to engage in illegal or immoral conduct to send offensive or harassing material, to send chain letters or to conduct job searches.
- A limitation on posting information to bulletin boards, chat groups, list serves and the like, or a requirement that such postings be cleared by a specified department. (Such limitations should apply to all messages sent from the employer's equipment, since they can be attributed to the employer.) The policy should also emphasize that, while the employer is not seeking to control the employee's personal communications from his or her own equipment or messages sent on his or her own time, the employee should not identify himself or herself as an employee of the company without the prior permission of appropriate company management.
Information concerning an electronic record destruction policy (if one has been adopted), warning of automatic deletions and encouraging periodic “cleanout” of electronic files. - An unequivocal statement that failure to comply with the policy may result in suspension of use privileges and/or disciplinary action up to and including termination of employment.
External Disclosure
Some companies also require personal e-mail usage external to the company to carry a disclaimer that such messages are purely personal and are not to be attributed to the employer. Such a disclaimer may provide a defense to inappropriate messages. At a minimum, it may help to distance the employer from illegal or offensive messages that may be sent.
Policy Communication
Any policy will be effective only to the extent it is communicated effectively. Accordingly, any policy should be distributed in writing to existing employees and new hires and it should be readily available on-line. Inclusion in employee handbooks, manuals and stand-alone policies also is appropriate. The policy may also be incorporated into any employee training on use of the electronic systems, and personnel who will administer the policy should also be trained in order to ensure consistent application.
Consistency
Policies on electronic communications should be consistent with an employer's other policies, such as those concerning computer network usage, use of the company's name, telephone monitoring, antitrust, searches of office space, discrimination and discipline. They should also be in compliance with applicable federal and state laws regarding electronic monitoring.
Obtain Consent to Monitoring
In order to be exempt from the eavesdropping prohibitions of federal and Illinois law, employers should require all new and existing employees to sign written consent forms with respect to monitoring of their telephone conversations and voicemail and e-mail messages. To be effective, such forms should give explicit consent to conduct such monitoring, and not merely provide an acknowledgment that such monitoring will occur during the course of employment.
Compliance with Dual Consent Requirements
There are a number of states which require two-party consent to monitoring, and employers who fail to notify incoming callers from Illinois and other dual-consent states that their calls may be monitored could be accused of violating the law. Therefore, employers who monitor telephone conversations should introduce all calls with a recorded message, or have their employees advise callers at the beginning of each conversation, that all calls may be subject to telephone monitoring and/or recording for purposes of quality control.
Minimize Negative Impact
Regardless of the specifics of the program, it should be presented to employees with an eye toward maintaining positive employer-employee relations. Monitoring of conversations may foster an atmosphere of distrust and resentment. Therefore, employers should present the monitoring program as part of an overall security program, advising employees that monitoring activities are being instituted as a necessary tool aimed at helping them in their jobs and responding efficiently and effectively to business needs.
If you have any questions regarding the above, you may contact any partner in Wildman Harrold's Employment and Labor Practice.
[1] Many states have enacted laws prohibiting or limiting various types of electronic monitoring, and those laws vary from state to state. Any employer having facilities in more than one jurisdiction, therefore, must be aware of the laws in those jurisdictions and adopt policies complying with the specific requirements imposed. Such activities may lead to liability based on common law invasion of privacy as well and appropriate safeguards should be established to avoid liability.
[2] The Act defines the term “electronic communications” as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or part by a wire, radio, pager, computer, photo electronic or photo optical system, where the sending and receiving parties intend the electronic communication to be private and the interception, recording, or transcription of the electronic communication is accomplished by a device in a surreptitious manner contrary to the provisions of this Article. Electronic communication does not include any communication from a tracking device.”
[3] "Telephone solicitation" is defined as use of a telephone by live operators for (1) soliciting the sale of goods or services, (2) receiving orders for the sale of goods or services, (3) assisting in the use of goods or services, or (4) engaging in the solicitation, administration or collection of bank or retail credit accounts. “Marketing or opinion research” is further defined as “a marketing or opinion research interview conducted by a live telephone interviewer engaged by a business whose principal business is the design, conduct and analysis of polls and surveys measuring opinions, attitudes and responses toward products, services or social or political issues.”
