It's a given that employees in the United States don't usually have a legitimate expectation of privacy in e-mail sent and received via a company account on company machines or hand-helds. But what about e-mail sent and received via a personal account but on a company machine?
Personally, I would err on the side of caution and not expect anything done on company equipment to remain private, but others think because it's a personal account, there should be at least some expectation of privacy. No one is exactly sure. But as Network World writer Ellen Messmer points out, a recent ruling from the New Jersey Supreme Court suggests employers might not have as much access as they thought.
Here's the backstory, courtesy of Network World:
Marina Stengart...filed a legal suit against her former employer, Loving Care Agency, a home-care services firm, alleging discrimination.[L]awyers had been squabbling over whether Loving Care, which had collected Stengart's e-mail after she filed suit against the company, had to turn over the half-dozen or so Webmail-based e-mails the company had managed to capture as forensic evidence.These were e-mails Stengart had sent via her personal password-protected Yahoo account to her lawyers before her resignation.
Ultimately, the court decided that because the company's e-mail and equipment policy did not specifically address personal e-mail, and because the personal account the employee accessed was password protected, she did have a reasonable expectation of privacy in e-mail sent and received via that account, from company equipment. Whether the e-mails were sent or received during business hours was irrelevant. And though this case might be instructive or provide support in other jurisdictions, it is only binding precedent in New Jersey.
The most important thing to note here is that the court did not say employees always have an expectation of privacy in personal accounts. Nor did it say employees should never have an expectation of privacy in e-mail sent or received on company equipment. The case turned on what the employer's policy addressed and what it did not.
The lesson? Make sure your company's policies are thorough and clearly articulate what you expect regarding employee use of e-mail - be it personal, corporate, on company equipment, not on company equipment, during business hours or outside of business hours.
Otherwise, like Loving Care Agency, you could find yourself on the wrong side of a court ruling.