RPJ Partner Deena R. Merlen Discusses Employee Monitoring in the Digital Age
Attorneys are fielding a lot of questions from employers that wish to electronically monitor their employees. With remote and hybrid work models far more prevalent since the pandemic, and with employees increasingly blessed (or cursed) with the ability to log on from anywhere, at any time, employers presumably feel a heightened need to maintain greater oversight and control remotely. Additionally, the current labor landscape is marked by a surge in layoffs across both federal and private sectors, prompting widespread job shifts as employees move from one employer to another. Employers worry about departing employees taking company assets or sensitive information with them. Add to that the growing reliance on cloud computing, mobile devices, and emerging technologies like generative AI, and it becomes even more clear why so many employers are turning to digital monitoring tools to protect and safeguard company assets, ensure employee compliance with company policies, and maintain productivity.
However, deploying employee monitoring software is far from a straightforward process. Employers must navigate a complex and evolving web of federal, state, and local laws designed to protect worker privacy. Missteps can result in significant legal exposure, including financial penalties and injunctive relief.
Employers must comply with several federal statutes that place limits on workplace monitoring. For example, an employer should be mindful of whether its monitoring of employee phone calls or electronic communications constitutes unlawful interception in violation of the Federal Wiretap Act or whether one of the statutory exceptions applies. An employer also should be careful not to violate the National Labor Relations Act, which, among other things, prohibits employers from surveilling employees’ union organizing efforts and also protects covered employees’ rights to engage in concerted activities with co-workers for mutual aid or protection.
Another federal law to bear in mind is the federal Stored Communications Act (the “SCA”). Under the SCA, employers are not prohibited from reviewing employee communications if authorized by the employer’s written policies and the communications are stored or recorded on the employer’s electronic information and communications systems. However, the SCA generally prohibits employers from reviewing an employee’s private communications without the employee’s consent if it is stored elsewhere, such as in the employee’s personal email account or on the employee’s own private social media account – even if the employer has the tracking and monitoring technology to crack the employee’s personal password and login.
Additionally, local, state and federal anti-discrimination laws may be implicated if employees in a protected category appear to be disproportionally subjected to monitoring or if their monitored activity leads to disciplinary measures inconsistently applied as compared to employees not in that protected category who engage in the same activities.
Employers also should be aware of state and common law protections concerning privacy, data security, wiretapping, and off-duty conduct. At the forefront of legal compliance is the obligation to provide advance notice to employees regarding monitoring practices. In Connecticut, for example, state wiretapping laws generally require employers to provide prior written notice to employees and to notify employees at the time of hire if electronic monitoring will occur. The notice must identify all the types of electronic monitoring that may be used, and the notice must be conspicuously posted. Similarly, in New York, employers are required to notify employees at the time of hire if electronic monitoring will occur. The law also mandates that this notice be posted conspicuously and acknowledged in writing or electronically by the employee.
Employee privacy rights vary from jurisdiction to jurisdiction. There is not always consistency, even within a jurisdiction, and each case is quite specific to its facts. While the laws vary from state to state, a common denominator tends to be a consideration of whether the employee had a reasonable expectation of privacy and whether the employer had a legitimate business interest that outweighed it. And indeed, employers have many legitimate reasons for wanting to monitor their employees, such as protecting against disclosure of trade secrets and confidential information and the misappropriation of company intellectual property or other assets, ensuring employee compliance with laws and company policies, investigating complaints, and tracking productivity, efficiency and quality of employee services.
To mitigate legal risks, employers considering employee monitoring should develop clear, written policies outlining the scope and purpose of monitoring, notify employees in advance, and obtain written or electronic acknowledgment of the policy, clearly stating that employees should have no expectation of privacy when using company-owned devices or systems, and ensure that all monitoring has a legitimate business purpose, especially when reviewing content that appears to be personal in nature. In regard to emerging technologies like generative AI, technologies often develop ahead of the laws and then legislation scrambles to catch up. The law is still racing to catch up with AI in many respects, even as companies excitedly launch and market to employers new AI-powered data security, tracking and monitoring solutions. All of this naturally adds to the complexity and challenges faced by employers seeking to monitor their employees with minimal risk of liability.
As employee monitoring becomes more prevalent, employers must tread carefully. Implementing surveillance tools without a full understanding of the legal landscape can expose businesses to significant liability. A thoughtful, transparent approach, grounded in legal compliance and respect for employee rights, is essential for any employer seeking to monitor the modern workforce responsibly.
(For information on the flip side, namely, employees wishing to record workplace conversations, please see this article by Ethan Krasnoo and Lucia Mead.)
Note: This article is intended as a general discussion of legal issues and is not intended to provide legal advice or be relied upon as such.
This article is intended as a general discussion of these issues only and is not to be considered legal advice or relied upon. For more information, please contact RPJ Partner Deena R. Merlen, who counsels clients in areas of employment and labor law, intellectual property, media and entertainment, general business law, commercial transactions and dispute resolution. Ms. Merlen is admitted to practice law in Connecticut and New York.