Employers may be tempted to access an employee’s or former employee’s personal email account (an email account used by the employee that was not provided by the employer), particularly after an employee accessed the personal account on a device provided by an employer.
In a recent federal case, Levin v. ImpactOffice LLC, 2017 U.S. Dist. LEXIS 106480 (D. Md. July 10, 2017), a federal district court held that a former employer may be liable to a former employee for accessing that employee’s personal email account in violation of a federal law, the Stored Communications Act or the SCA. Accordingly, employers should refrain from accessing their employee’s personal email accounts, even if their employee has accessed the account on devices provided by the employer.
In Levin v. ImpactOffice LLC, Melissa Edwards purchased her mobile phone through her employer, Impact, and paid the cost of the phone through deductions from her paycheck. After Edwards resigned, Impact demanded that she return the phone. Before returning the phone, Edwards deleted all emails on it, including emails she received on her personal Gmail account. After Edwards returned the phone, Impact used the phone to access emails in Edward’s Gmail account, which were stored on Google’s servers.
Edwards filed a lawsuit against Impact, asserting multiple claims against Impact, including an SCA claim for intentionally accessing her emails without her permission. A person violates the Stored Communications Act by accessing “without authorization a facility through which an electronic communication service is provided” and “thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.”
Impact filed a motion to dismiss the Stored Communications Act claim, claiming Edwards failed to assert a claim because she did not allege that the emails were unopened and could not prove that the emails were in “electronic storage” as required by the SCA.
The court denied the motion, finding that Edwards did not need to allege that the emails were unopened to state a claim under the SCA. The court found that both opened and unopened emails are in “electronic storage” for purposes of the SCA because they are stored for backup purposes, in case Edwards wanted to access the emails again. The court’s decision does not indicate that Impact is liable to Edwards, but that Impact may be liable to Edwards because she has alleged the necessary elements to support an SCA claim.
Because the Levin case is ongoing, it is unknown whether Impact will be held liable under the SCA for accessing Edward’s emails. Because this decision demonstrates an employer may be subject to liability under federal laws for accessing their employees’ personal email accounts, employers should refrain from accessing personal email accounts of their employees or former employees, even if the accounts were accessed on electronic devices provided by the employer.
The Stored Communications Act was enacted in 1986, long before many technological devices were introduced into the workplace. As courts continue to try to apply the Stored Communications Act to the current business environment, the law in this area may continue to change.
While employers may want to access any emails an employee opened on a device provided by the employer, employers should obtain advice from an attorney before accessing any personal email accounts of employees or former employees to ensure the employer does not violate the Stored Communications Act or other privacy laws.