The Undoing of the Electronic Communications Policy for New Jersey Employers? Appellate Division Rules in Stengart v. Loving Care That Employees May Have Expectation of Privacy in Personal E-mail on Work Computer

In a troubling decision for New Jersey employers, the New Jersey Appellate Division recently ruled in Stengart v. Loving Care, 408 N.J. Super. 54 (App. Div. 2009), that employees may have some expectation of privacy in personal e-mails and transactions conducted using a company-owned computer, even where the employer has an electronic communications policy to the contrary. The Court’s decision specifically focused on whether an employer’s electronic communications policy converted an employee’s e-mails to her attorney — sent via her personal, Internet e-mail account, but using the employer’s computer — into company property. The Court ruled that the public policy underlying the attorney-client privilege substantially outweighed the employer’s interest in enforcing its electronic communications policy, and rejected the employer’s right to review and retain e-mails from the employee to her attorney.

Factual Background

The plaintiff, Marina Stengart, was a former executive with Loving Care, Inc. During Stengart’s employment, Loving Care provided her with a laptop computer to perform her job duties. Before resigning her employment in January 2008, Stengart used her personal Yahoo! email account, which she accessed via the Internet on her work computer, to communicate via e-mail with her attorneys regarding her planned lawsuit against Loving Care.

A month after resigning her employment, Stengart filed suit against Loving Care and several other defendants in the New Jersey Superior Court Law Division, alleging, among other things, violations of the Law Against Discrimination. After Stengart filed suit, Loving Care preserved Stengart’s company laptop for discovery purposes by creating a forensic image of the laptop’s hard drive. The company’s outside counsel later reviewed the contents of the forensic image, including Stengart’s Internet browsing history, and discovered and read numerous e-mails between Stengart and her attorney from the period prior to Stengart’s resignation.

Loving Care’s attorneys did not immediately notify Stengart’s attorneys that they had discovered these e-mails between Stengart and her counsel. Instead, months later, Loving Care’s attorneys referenced and included the e-mails in their answers to interrogatories. Stengart’s attorneys responded by requesting the immediate identification and return of all similar e-mails between Stengart and counsel and the disclosure of the individuals responsible for collecting them. When Loving Care’s attorneys refused the request, Stengart’s counsel applied for an order to show cause and a temporary restraining order. The Law Division denied Stengart’s motion, holding that the e-mails in question were not protected by the attorney-client privilege because Loving Care’s electronic communications policy put Stengart on notice that e-mails sent or received on her company laptop were considered company property. Stengart appealed this ruling to the Appellate Division.

The Appellate Division’s Decision

The Appellate Division reversed and remanded the Law Division’s ruling, holding that Loving Care’s electronic communications policy was outweighed by “the important societal considerations that undergird the attorney-client privilege.” In reaching this decision, the Court first considered the parties’ factual disputes regarding the dissemination and application of Loving Care’s electronic communications policy. In support of its asserted right to review and retain Stengart’s e-mails with her attorneys, Loving Care relied upon language in its electronic communications policy providing that: (1) the company reserved the right to review all matters on the company’s electronic systems, with or without notice; (2) employees had no expectation of privacy in their e-mail messages and Internet use files on the company’s electronic systems; and (3) the principal purpose of the company’s e-mail was company business communications, however, occasional personal use was permitted. Stengart argued in response that Loving Care had failed to demonstrate that it had in fact adopted or distributed an electronic communications policy, that she was not aware of a policy that applied to executives such as herself, and that if the policy indeed existed, it had not been enforced previously. Loving Care responded that it had distributed a handbook containing its electronic communications policy, that the policy had been finalized approximately a year before Stengart sent the e-mails at issue, and that the policy applied equally to all employees. Analyzing the factual dispute, the Appellate Division was persuaded by the fact that the record contained several different versions of Loving Care’s electronic communications policy, causing doubt regarding which, if any, version of the policy applied to Stengart. In addition, the Court noted that Loving Care had not produced a signed acknowledgment of the electronic communications policy from Stengart stating that she received and understood the policy. The Appellate Division concluded based on the uncertainty surrounding the distribution and application of the policy that the threshold factual disputes should not have been resolved on the basis of the parties’ competing certifications, as the trial judge had done, but rather through an evidentiary hearing.

Assuming that the electronic communications policy had been in effect at the time of Stengart’s emails with her counsel and that it in fact applied, the Appellate Division went on question whether the policy covered emails sent to an attorney via an employee’s personal, password-protected Internet email account, when using a company computer. Rejecting the trial judge’s finding that Stengart had been on notice that she had no reasonable expectation of privacy in any communication made using her company computer, the Appellate Division was “not so confident that this is the result an objective reader would derive from the policy’s various terms.” The Court found that the policy was ambiguous in numerous respects, particularly in authorizing employees to engage in “occasional personal use” of the company’s electronic systems while simultaneously maintaining that employees have no expectation of privacy in their personal e-mails. The Court held that an employee could, based on the ambiguous policy language, interpret “occasional personal use” to mean that personal e-mail communications were in fact private and confidential.

The Appellate Division next examined the extent to which courts will enforce employer handbook policies. Noting that the enforcement of employer policies by courts is of “relatively recent vintage,” the Court held that the scope of employee handbooks has “never been limitless” and that to be enforced, the conduct regulated by an employer’s policy must “concern the terms of employment and ‘reasonably further the legitimate business interest of the employer.’” While holding that certain aspects of Loving Care’s electronic communications policy furthered the company’s legitimate business interests, the Appellate Division rejected the company’s right to “reach into the employee’s personal life” based on the company’s ownership of the computer used to engage in the communications at issue. Although it recognized that there may be certain occasions when an employer has a legitimate business reason for accessing an employee’s personal e-mails, the Court simultaneously held that individuals possess a reasonable expectation of privacy in certain “highly personal and confidential transactions [that] are commonly conducted via the Internet,” among them, accessing medical records, examining bank account and phone records, filing income tax returns, and communicating with an attorney. Accordingly, the Court held that Loving Care’s policy “purporting to transform all private communications into company property” based on the company’s ownership of the computer furthered no legitimate business interest. The Court went on to find that an employer has a legitimate interest in whether an employee is engaging in personal matters while on company time, but did not fully reconcile how an employer may monitor employee use of the company’s electronic systems and take appropriate disciplinary action without reviewing communications and transactions viewed by the Court to be within the employee’s zone of privacy.

Turning to the specific facts at issue, the Appellate Division held that the e-mails Stengart exchanged with her counsel via her company laptop were unquestionably protected by the attorney-client privilege. Weighing the privilege against the company’s claimed interest based on it electronic communications policy, the Court concluded that the company’s policy “must give way.” Even giving Loving Care the benefit of the doubt with respect to the contested factual issues discussed above, the Court held that the company’s electronic communications policy was clearly outweighed by the attorney-client privilege. Accordingly, the Court reversed the Law Division’s order and ruled that the emails exchanged by Stengart and her attorneys through her personal Yahoo! account remained protected by the attorney-client privilege.

Finally, the Appellate Division addressed the conduct of Loving Care’s counsel. The Court held that the attorneys’ actions were inconsistent with the dictates of RPC 4.4(b), which states that “[a] lawyer who receives a document and has reasonable cause to believe that the document was inadvertently send shall not read the document or, if he or she has begun to do so, shall stop reading the document, promptly notify the sender, and return the document to the sender.” Finding that Loving Care’s outside counsel improperly made use of the attorney-client emails without following the proper procedure, the Appellate Division remanded this matter for a hearing to determine whether Loving Care’s attorneys should be disqualified, or whether any other sanction should be imposed. The Appellate Division also reversed the Law Division’s order and remanded for entry of an order: (1) compelling Loving Care’s counsel to turn out all emails between Stengart and her attorneys that were in possession of Loving Care, its counsel, their agents or employees and (2) requiring the deletion of all these emails from any hard drive upon which they are stored. Loving Care moved for leave to appeal and to stay the Appellate Division’s decision. These motions were granted by the New Jersey Supreme Court on July 29, 2009, and the appeal is now pending.

Recommendations for New Jersey Employers

The Stengart decision represents a significant departure from prior case law discussing the enforceability of electronic communications policies. In the wake of the decision, New Jersey employers may need to reexamine their electronic communications policies and e-discovery practices.

Despite the Appellate Division’s questioning of the legitimacy of the business interests supporting electronic communications policies, every employer should have an electronic communications policy in place. Although the law in this area is unsettled, in light of the Appellate Division’s focus on ambiguities in the Loving Care policy, employers should carefully review their electronic communications policies to ensure that the policy language is clear and understandable to the average employee, and that the policy has been recently updated to account for the current state of technology. When possible, the electronic communications policy should specifically enumerate prohibited uses to avoid ambiguity regarding what constitutes permissible employee conduct. In addition, the policy should ideally articulate its rationale to make clear the company’s legitimate business interests in restricting personal usage and in reviewing employees’ personal e-mails and Internet usage.

Although having a comprehensive electronic communications policy is a critical first step, it may no longer be sufficient to protect the employer’s interests in every situation. Employers also need to ensure that employees are aware of and fully understand the policy to avoid the sort of factual dispute at issue in Stengart. Employers should periodically reissue their electronic communications policies to employees and require employees to sign an acknowledgement stating that they have received and understand the policy. To maximize the effectiveness of the acknowledgment, employers may wish to incorporate specific language stating that the employee understands that he/she has no expectation of privacy or confidentiality in any electronic communications sent, received or viewed from the company’s systems, including personal e-mails and Internet usage, even if occasional personal use is permitted. Employers should also seriously consider training their employees on the company’s electronic communications policy.

When engaged in litigation, employers should exercise particular caution when reviewing a plaintiff’s e-mail and Internet usage. At least until the New Jersey Supreme Court rules on the issue, defense counsel reviewing a plaintiff’s e-mails and Internet files should avoid reviewing privileged e-mails. If privileged communications are identified, defense counsel should immediately segregate them, disclose the e-mails to the plaintiff’s attorneys and seek a judicial determination regarding the legal “ownership” of the e-mails and whether the attorney-client privilege applies.

We will report on the New Jersey Supreme Court’s decision and any additional guidance for employers when a ruling is issued by the Court