The misuse and mismanagement of emails is much more than an annoyance in today's workplace. Prompting employee terminations and sometimes litigation, employee email abuse has become an Achilles heel in corporate America.

But how can you tell the difference between an employee preparing a monthly revenue report and an employee sending pornographic pictures via email? To the casual observer, both activities appear identical, and unless looking over an employee's shoulder is an option, many employers may have no idea what their workforce is doing as they peck away at their keyboards. To help solve this problem, employers are increasingly initiating more stringent email policies, monitoring email usage, and punishing those who abuse their organization's electronic communications system.

Such a plan of attack appears to be a necessity in today's wired workplace, where employees are using the Internet and email ever more frequently. According to the Bureau of Labor Statistics (BLR) of the United States Department of Labor, approximately 77 million people, or more than 55 percent of the employed population, use a computer at work. Two of every five employed individuals connected to the Internet or used email while on the job, higher proportions than those measured in previous BLR surveys.

However, this increase in connectivity has not been accompanied by a commensurate increase in productivity. Multiple studies show that a significant number of employees admitted to using their workplace Internet and email for personal reasons, with some employees citing it as their number one distraction at work. Such “cyber-slacking” can cost employers millions, or by some estimates, billions in lost revenue resulting from decreased productivity.

Aside from lower productivity, employers have plenty of other reasons to restrict unlimited email use by employees, such as preventing the unauthorized disclosure of trade secrets or other confidential/proprietary information; preventing discriminatory, hateful, harassing behavior or cyber-stalking through the email system; and preventing potential defamation or copyright infringement liability.

Given the potentially ruinous downside of email abuse, employers are increasingly monitoring their employees' email communications. According to the Electronic Monitoring & Surveillance Survey performed by the American Management Association, 55 percent of employers monitor email to combat what has been called the leading electronic risk facing U.S. employers.

But, while the justifications for the increase in email monitoring are compelling, where does employee privacy fit into the equation? Given the predominance of technology in the workplace, striking a balance between an employer's right to control what goes on in the workplace with employees' right to privacy has become the question of the day. Clearly, the courts have struggled to keep pace with the legal issues stemming from rapid technological advancement; nonetheless, in the absence of clear and contemporaneous legal guidance, employers must make sure their email monitoring programs do not violate the law.

Although private employers are typically not subject to the prohibitions imposed by the federal Constitution (because constitutional rights operate primarily to protect citizens from the government, not from their employers), they do need to comply with the federal Electronic Communications Privacy Act (ECPA), which prohibits the intentional or willful interception of electronic communications.

In practice, however, the ECPA's prohibitions appear to have had little impact on an employer's right to monitor employee emails. This is because of three exceptions contained in the law: the provider exception, the ordinary course of business exception, and the consent exception. These exceptions have been, or can be, interpreted as allowing employers to monitor emails in the workplace. Nevertheless, employers should not consider this tacit approval of email monitoring in the workplace as absolute. The reality is that the ECPA was enacted prior to the proliferation of workplace email systems, with the result being that its provisions have not been fully tested in the courts.

Aggrieved employees have also sought a remedy under various common-law invasion of privacy claims. Despite the substantive variations of these claims across the country, an employee typically needs to prove that his or her expectation of privacy was “reasonable,” which means that the employee exhibited an actual expectation of privacy and that such privacy expectation is one that society is prepared to recognize as reasonable.

To be protected under this approach, it is incumbent upon employers to eliminate any reasonable expectation of privacy, or, at the very least, reduce the expectation so much that it is no longer reasonable for employees to expect privacy in their email communications. Employers can do this by creating a detailed and clearly written electronic communications policy that is distributed to, and signed-off by, all affected employees. The existence of such a policy severely, if not fatally, undermines employees' reasonable expectation of privacy in their email communications.

Email policies should state, in no uncertain terms, that:

• computer systems are company property and shall be used for company business only;
• employees do not have, and should not expect, any privacy rights in any email communications generated, received, uploaded, or viewed while at work; and
• all such emails become the property of the company and are subject to the company's absolute right to monitor, intercept, copy, print, delete, read, view, use, or save such emails.

An organization's policy also needs to clearly outline, in as much detail as possible, permissible and impermissible uses of its email system, such as a specific prohibition against foul, offensive, defamatory, pornographic, or other inappropriate communication. The consequences for violations of the email policy should also be specified and adhered to; moreover, employers must remember not to punish employees for exercising their protected rights under the National Labor Relations Act, which regulates union activities.

A well-crafted email policy should also differentiate between the content and frequency of email communications. An employee who spends a considerable amount of time sending friendly “hellos” to friends can be every bit as harmful to a company's bottom line as an employee who sends pornographic images via email. Both instances are problematic, and both should be addressed in a policy.

An email policy needs to be distributed and explained to all current and new employees, preferably before monitoring begins. As an extra precaution, the policy should be reiterated and confirmed upon logging on to the email server, if feasible.

Finally, and perhaps most importantly, employers should obtain written consents from all employees acknowledging receipt and understanding of the email policy. The likelihood that an employee will convince a judge or jury that email privacy was expected is greatly reduced when rebutted by a consent and acknowledgment form signed by the employee in question.

Employers should consult with a licensed professional before implementing an email monitoring policy to ensure compliance with all federal, state, and local laws. The existence of employment contracts and union agreements should also be considered. However, in the context of email usage policies, as in most employment-related contexts, the relatively minor cost incurred by employers doing it right can be a great defense against employees who do it wrong.