Workplace Privacy, Data Management & Security Report : Privacy Lawyers & Attorneys : Jackson Lewis Law Firm : Data Security, HIPAA & Confidentiality Issues

A U.S. District Court in Indiana has ruled that a company's use of keylogger software to access an employee's personal e-mail account may have violated the Stored Communications Act (“SCA”).  

Keylogging or keystroke logging is the tracking of the keys struck on a keyboard, typically in a covert manner.  

In Rene v. G.F. Fishers, Inc.,the company utilized keylogger software and was sued by one of its employees for violations of the SCA, the Indiana Wiretap Act (“IWA”), and the Federal Wiretap Act.  The company generally prohibited personal use of its computers, however, it permitted the employee to access her personal checking account and personal e-mail account from the company computer.  The employee was later notified that the company had installed keylogger software on the computer.  Utilizing the keylogger software, the company accessed the employee’s personal e-mail account and personal checking account (acquiring the passwords utilizing the keylogger software), and reviewed and discussed the messages and contents. 

The employee was fired for “poor performance” after complaining about the access. She sued her former employer, alleging the company violated the SCA, IWA, and the Federal Wiretap Act.  While the court did not address certain factual issues under the SCA (e.g., whether the company accessed the employee’s e-mail messages before the employee opened them), it held that by alleging that the employer accessed her e-mail messages the employee had satisfied the burden of asserting a violation of the SCA.  The court also denied the company’s motion to dismiss the former employee’s IWA claim, but it did dismiss the Federal Wiretap Act claim. 

As we have previously discussed, jurisdictions are at odds over the use of keylogger software in the employment context.  Employers should carefully consider their use of keylogger or monitoring technology and consult counsel as to best practices for the jurisdiction in which you are located.   

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Employers need to exercise care when accessing employees’ e-mails, particularly e-mails on personal e-mail accounts. In Pure Power Boot Camp Inc. v. Warrior Fitness Boot Camp LLC, a non-compete case that turned into a case about the privacy of stored e-mails and violations of the federal Stored Communications Act (SCA), the court held:

1. SCA statutory damages can be recovered by plaintiffs, even if they suffered no actual damages, and
2. the calculation of statutory damages ($1,000 per violation), generally is based on the number of times the “electronic communications facility” (or personal e-mail account, e.g., Hotmail) is accessed, not the number of emails accessed.

The dispute arose when two employees of a fitness facility, Pure Power Boot Camp Inc., left to start their own fitness facility, Warrior Fitness Boot Camp LLC. A non-compete action followed because Pure Power learned through 546 mails it had accessed over a nine-day period that its former employees had taken customer lists, training and instruction materials, and solicited Pure Power customers. The e-mails were from four personal accounts belonging to the former employees’  – Hotmail, Gmail, Warrior Fitness, and an unrelated corporate account. Pure Power was able to access these accounts because the former employees stored their usernames and passwords on its computers; when Pure Power accessed the particular site, the username and password automatically populated.

The former employees learned of Pure Power’s accessing their personal e-mail accounts and filed counterclaims, including allegations of violations of the Stored Communications Act.

The court ruled in the non-compete action that accessing the former employees’ four accounts violated the SCA. Two of the issues before Judge Theodore H. Katz were whether statutory damages could be recovered in the absence of actual damages and, if so, how to calculate those damages. The SCA provides that “in no case shall a person entitled to recover receive less than the sum of $1,000,” but there is little guidance as to whether this minimum should be awarded for each violation, or what constitutes distinct and independent violations as opposed to a single continuous violation.

SCA Statutory Damages Without Actual Damages. Judge Katz disagreed with a ruling by the Fourth Circuit of the U.S. Court of Appeal, Van Alstyne v. Elec. Scriptorium, Ltd. 560 F.3d 199 (4th Cir. 2009), which held that statutory damages under the SCA can be recovered only where the plaintiff also has suffered actual damages.

Van Alstyne based its holding (i) on a decision by the U.S. Supreme Court in Doe v. Chao, 540 U.S. 614 (2004), which reached a similar conclusion for statutory damages under the Privacy Act of 1974, and (2) on the fact that the language concerning damages in these two statutes (SCA and Privacy Act) were nearly identical.

However, Judge Katz cited a number of other federal court decisions holding that while the language in the two statutes are similar, they are different statutes with different purposes and penalize different behaviors. Rejecting the Doe analysis, he concluded statutory damages were recoverable for SCA violations in the absence of actual damages.

Calculating Statutory Damages. Judge Katz said the SCA punishes anyone who “intentionally accesses without authorization a facility through which an electronic communication service is provided . . . and thereby obtains . . . access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. Section 2701(a). Based on this language, he rejected the two former employees’ argument that the number of violations should be measured by the number of e-mails accessed, 546, adopting Pure Power’s argument, instead. Accordingly, when an account is accessed multiple times over a short period of time, it should constitute only a single violation of the SCA. Noting the SCA targets the unauthorized access of an electronic communication facility (not the e-mails themselves), and because there was nothing to indicate the number of times each of the four accounts were accessed over the short nine-day period, the court found four violations.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

A New Jersey restaurant has been hit with a jury verdict in favor of two waiters who were fired after the restaurant’s managers accessed a private social networking site where the waiters were criticizing management.

As the social networking (e.g., MySpace and Facebook) “craze” continues to expand, employers must be more mindful of privacy concerns relating to content made available in these media by applicants and employees. Hiring and other job decisions often seem based on information obtained from employees’ or applicants’ social interactions on the Internet, at least to some degree. Generally, employment decisions are more supportable where there is a social networking policy that has been communicated to employees. 

In Brian Pietrylo, et al. v. Hillstone Restaurant Group d/b/a Houston’s, a federal court in New Jersey rejected the employer’s attempt to throw out the jury verdict that managers at a Houston's restaurant intentionally and without authorization accessed a private, invitation-only chat group on MySpace in violation of the federal Stored Communications Act (SCA). The SCA prohibits unauthorized access of stored communications such as e-mail and Internet accounts. The Court also upheld the jury’s award of compensatory and punitive damages against Hillstone. 

This case reminds employers to consider carefully any decision to monitor employees’ use of social networking sites.  Mistakes may be costly.

• Email This
• Print
• Comments
• Trackbacks
• Share Link