Employer Liability for Employee’s Internet Misconduct – Or When Surfing the Web can Wipe out your Business.

Generally, the Internet is a tremendous asset in the workplace, except when it is a liability. And   liability generally involves employee misconduct. A common example of such liability was recently reported on by the Wall Street Journal (click here for the story). This story discusses repeat instances of employees (in this case U.S. government employees at the Securities and Exchange Commission) accessing Internet pornography. The WSJ’s story notes that one regional supervisor for the SEC had made more than 1,800 attempts to look up pornography in a 17-day span (if you’re doing the math, that is 105.88 times a day!).

Unfortunately, holding employers liable for damages arising out of Internet misconduct by employees is not a novel concept. Common scenarios where employers may be exposed to liability include tort, contract, copyright, and for crimes arising out of an employee’s misuse of a workplace computer.

For example, a case dealing with viewing child pornography resulted in the New Jersey Appellate Division ruling that the company could be liable for damages suffered by innocent third parties where the company failed to investigate reports that an employee was viewing child pornography online at work. Doe v. XYC Corp., (2005). In that case, the Court ruled that when an employer has actual or imputed knowledge that an employee is viewing child porn on a company computer the employer has a duty to act, either by terminating the employee or reporting such activities to law enforcement authorities. In regard to such knowledge, the court noted the following facts.

• The employee’s immediate supervisor, a manager, and the director of network and PC services were all aware of the suspicion that the employee used a company computer to visit sexually explicit websites.
• Co-workers complained about the employee’s computer habits.
• An investigation into these complaints uncovered that he visited child porn sites. The company’s response was to tell the employee to stop. The employee did not and he eventually downloaded more than 1,000 pornographic images on his work computer. He also sent three nude or semi-nude photos of his 10-year-old stepdaughter to a child porn site from his work computer.

It is also worth noting that the employer actually had an Internet usage policy in place (a must for every company) that provided employees were only permitted to “access sites, which are of a business nature only,” and reserved the right to inspect computers. But having such a policy in place does no good if it is not enforced. In this regard, a high-ranking IT executive warned a supervisor against monitoring the employee’s computer use, as it was the IT exec’s belief that the company policy prohibited such monitoring.

The other common scenarios where employers may find themselves exposed to Internet misconduct include:

• Intentional and negligent infliction of emotional distress – In Delfino v. Agilent Technologies, Inc., an employer was not liable under a negligent supervision theory to threat recipients who claimed infliction of emotional distress. This distress arose out of an employee who transmitted Internet threats using employer’s computer system. The court noted that the employer owed the recipients no duty in absence of business relationship or close connection with recipients’ injuries, and employer did not breach any duty as it was unaware of employee’s conduct.
• Harassment / Hostile Work Environment – Even though employers do not have a duty to monitor the private communications of their employees for comments which harass co-employees, employers do have a duty to take effective measures to stop co-employee harassment when the employer knows or has reason to know that the harassment is part of a pattern of harassment that is taking place in the workplace and in settings that are related to the workplace. Effective remedial steps reflecting a lack of tolerance for the harassment will be relevant to an employer’s affirmative defense that its actions absolve it from all liability. For example, in 2007 case, Avery v. Idleaire Technologies Corp., the Court of Appeals allowed a plaintiff’s hostile work environment claim case to go to a jury (it reversed a trial court’s order dismissing the case). In doing so, the Court noted that a jury “could find it to be objectively offensive for an employer to permit employees to use a company computer terminal on company time to actively seek pornographic material, whether for sexual gratification, entertainment, or in the words of one of the plaintiff’s co-workers, simply out of boredom, and for the evidence of this activity (pop-up adds, printouts, internet history, etc.), to be left for the plaintiff and other employees to see.” Similarly, in Gallagher v. C.H. Robinson Worldwide, Inc., (6th Cir. 2009) the decision to dismiss a sexual harassment claim by the trial court was reversed.  The court noted that Plaintiff testified that co-workers used Internet to view sexually explicit pictures on their computers, along with other conduct compared to a “guy’s locker room” (I don’t know about you, but I didn’t want to spend any more time than I had to in the locker room).
• Defamation, libel and slander – In Gavrilovic v. Worldwide Language Resources, Inc., the Court held that a coworker’s e-mail statement that an employee of a military contractor was the military base “F*ck toy” was false and defamatory, as required for the employee to recover from the contractor for defamation.
• Copyright infringement – Employers also may be needlessly exposed to lawsuits for copyright violations if they permit (or ignore the fact that) employees to receive or download software or other materials, e.g., music, video, and graphics files. See Varilease Tech. Group, Inc. v. Michigan Mut. Ins. Co. ((Mich. Ct. App. 2004), which concerned a suit against an employer alleging its employees copied and retained copyrighted product support manuals and diagnostic software, used the materials in their contracts to perform service and maintenance for their clients, and distributed the materials to subcontractors.

It is also worth noting that, in limited circumstances, there may be an upside for employee Internet misconduct. For example, a former employee’s acts of transmitting sexual images via employer’s internet and email applications was a deliberate violation of employer’s computer usage policy, and accordingly, his actions constituted misconduct connected with his work, and thus, claimant was disqualified from unemployment benefits; Ernst v. Sumner Group, Inc., 264 S.W.3d 669, Unempl. Ins. Rep.(2008).

The Take Aways: Monitoring Is A Must

While claims against employers for employee Internet misconduct may ultimately fail to impose liability, the exposure is still there. And the preceding cases underscore the importance of monitoring employee Internet browsing to minimize that liability. Here are some suggestions to consider when it comes to monitoring employee’s Internet usage:

• Create a policy that spells out what types of sites are off-limits. Also explain that the company has the right to monitor employee usage of company computers to confirm compliance with the policy and, therefore, employees should have no expectation of privacy when it comes to any of the company’s electronic equipment. Make sure employees also understand that violating the policy may result in discipline.
• Communicate the policy. It is also important for IT to understand that monitoring is permitted and under what circumstances.
• Highlight to employees the negative effects misuse of the Internet may have on the company (e.g., liability for sexual harassment).
• If you believe an employee is violating your Internet usage policy, make sure you properly preserve the evidence, e.g., Web activity, the employee’s PC or laptop.
• If a violation occurs, assess whether law enforcement officials should be contacted, (child porn).

Feel free to shoot me your thoughts or comments about this post. And if you have story that tops the SEC supervisor’s 17 day porn rampage, I would be interested in hearing about it, but I don’t need to see the proof.

Privacy in the Digital Workplace – Oxymoron? Maybe Not.

The Spring 2009 Hofstra Labor and Employment Law Journal includes a symposium on Emerging Technology and Employee privacy. There are two articles that are especially relevant to employers: Invasion of Privacy Liability in the Electronic Workplace: A Lawyer’s Perspective (by Christine E. Howard) and The Emergence of State Data Privacy and Security Laws Affecting Employers (by Joseph J. Lazzarotti).

Employee privacy has received increased attention. For example, in a 2008 case, Quon v. Arch Wireless Operating and Co., the 9th Circuit Court of Appeals held that a company that contracted with an employer to provide text messaging services to the employer’s employees, violated the federal Stored Communications Act (SCA) when it provided the stored text messages to the employer. Employers will also want to take notice because the Court held, in the particular factual context presented, that the employer violated its employee’s privacy rights as well as the recipients of the text messages under the Fourth Amendment and under Article I, Section 1 of the California Constitution.

These particular facts are as follows: The City of Ontario contracted with Arch Wireless for pagers that supported text messaging,. These pagers were issued to Police Department employees, including plaintiff Jeff Quon. The Police Department had a general “Computer Usage, Internet and E-mail Policy” that limited the “use of City-owned computers and all associated equipment, software, programs, networks, Internet, e-mail and other systems . . .” to City business. The policy also provided that “[u]sers should have no expectation of privacy or confidentiality when using these resources” which extended to the pagers. But, the police official responsible for overseeing the City’s text-message program, had  stated that the City would not read an officer’s text messages, so long as the officer paid for any  charges for overages  under the City’s plan.  Quon did in fact pay for overages on several occassions. Subsequent to this statement and payment of Quon’s overages, the Chief of Police ordered transcripts, which were turned over by Arch, the wireless provider. Many of Quon’s messages were personal in nature, including sexually explicit. The Court held that Quon had a reasonable expectation of privacy in his text messages as the result of the lieutenant’s statements that the messages would not be audited if overages were paid.

The take-away from Quon for employers is that a clear policy that electronic communications are not private is a must. Further, to minimize the chance that this policy is not undercut by stray assurances of privacy or workplace reality (i.e., employers generally don’t have the time or interest to read employee e-mails), it should also provide that no one other than a designated person has the authority to change the terms of the policy and that all such changes must be in writing.  There may be some additional recommendations in the articles referenced above and feel free to offer your own insight. Thanks.