Massachusetts Employment Law Letter

You’ve got mail — and perhaps violations of the law!

The Stored Communications Act (“SCA”) is a federal law that prohibits an individual from intentionally accessing electronic communications, either without authorization or in excess of an authorization, in order to obtain or alter electronic communications or block access to a facility providing electronic communication services.  Access to electronic communications in violation of the SCA may also constitute a violation of an individual’s privacy under Massachusetts General Laws ch. 214, § 1B.  So what does this have to do with your employees? Both laws apply to your employees, and, as a result, it is important that employers understand the risk they may face when accessing another employee’s e-mail account.

Two employees, one e-mail account

Dr. David Cheng and Dr. Laura Romo were hired by Advanced Radiology, Inc. (“Advanced”), in 2000.  Dr. Romo’s husband, John Romo, was also an employee at Advanced.   Because Advanced did not issue e-mail accounts to its employees, Dr. Cheng set up a Yahoo! Account, ostensibly for his “personal use,” but he also used it for work purposes.  In July 2000, Dr. Cheng shared his username and password with Dr. Romo so that she could read e-mails from a consulting radiologist that had been sent to his Yahoo! e-mail address.  Dr. Romo accessed Dr. Cheng’s account for this purpose periodically throughout her employment, although it was a rare occurrence.

In July 2008, Dr. Romo and her husband ceased to be employees of Advanced.   Although the case is not specific, it is a good guess that they were terminated, because both filed lawsuits against Advanced the following year.  At some point before she left Advanced, Dr. Romo accessed Dr. Cheng’s e-mail account and read several e-mails.  Dr. Romo used her son’s computer to access the e-mail account because she felt “uncomfortable,” although she testified that she did not think it was “wrong” to do so.  She also acknowledged that she was looking for information about the company, her husband’s disciplinary warnings, and Advanced’s billing practices.  Dr. Romo printed at least ten of these e-mails, some of which had personal content, and John Romo produced these e-mails as part of his lawsuit.  As a result, Dr. Cheng filed suit against Dr. Romo, alleging violations of both the SCA and Chapter 214, § 1B.  Dr. Romo asked the court to dismiss the case before trial.

Authorization to access?

The SCA creates liability for an individual who obtains access to electronic communications by “intentionally access[ing] [them] without authorization” or by “intentionally exceed[ing] an authorization.”  Since Dr. Romo admitted that she accessed Dr. Cheng’s e-mail account for reasons other than looking at e-mails sent from a consulting radiologist, the trial court needed to determine whether the evidence showed conclusively that she had intentionally accessed the account without authorization or had intentionally exceeded her authorization.

The trial court noted that courts have struggled with what “access without authorization” and “exceed[] an authorization to access” mean.  To make its determination, the trial court looked at cases interpreting the meaning of similar language in the Computer Fraud and Abuse Act.  The court noted that a “lack of authorization may be implicit, rather than explicit,” and that a court can inquire into how the information that was obtained was later used.  The court observed that in cases under the Computer Fraud and Abuse Act, if a person accesses information that he or she is entitled to obtain, such access does not exceed his or her authorization.

After reviewing the facts submitted by the parties, the court determined that it could not dismiss the case against Dr. Romo because there were facts that could not be determined one way or the other without a trial.  Specifically, it was unclear whether Dr. Romo had exceeded her access to the account.  Dr. Romo testified that she wasn’t really sure whether she had authorization to access the types of e-mails she had reviewed.  Consequently, the court could not determine whether she had exceeded her authorization and left that matter for a jury to decide.

“You invaded my privacy!”

Dr. Cheng also sued Dr. Romo for invasion of privacy under Massachusetts law.  Massachusetts Gen. L. ch. 214, § 1B provides a person with a right to be free from unreasonable interference with his or her privacy and/or the disclosure of facts that are highly personal or intimate when no legitimate interest exists.  Dr. Romo admitted that she obtained and printed at least ten e-mails and that she gave copies of those e-mails to her husband.  Those e-mails were later produced as part of his lawsuit against Advanced.  Dr. Romo also stated that the e-mails contained “personal commentary,” and the court noted that several of the e-mails had no relationship to Advanced’s business but instead were personal notes between Dr. Cheng and a non-management employee.  The court also observed that the employer’s internet use policy may have some bearing on whether Dr. Cheng had a reasonable expectation of privacy in these e-mail messages.  As a result, the court determined that there were, again, too many facts in dispute:  it was unclear whether Dr. Romo had unreasonably, substantially, or seriously interfered with Dr. Cheng’s privacy when she read and provided the e-mails to her husband.  Consequently, the court declined to dismiss the case, and the entire lawsuit will go forward to trial.

Bottom line

In an age of increasing technology, more work is done and more information is communicated through e-mails.  Although Advanced was not involved in the lawsuit between Dr. Cheng and Dr. Romo, it was involved in the lawsuit in which John Romo produced e-mails from Dr. Cheng’s account.  Therefore, it is important that both employers and their employees understand the risks involved.  If your employees need an e-mail account to conduct their work, and you do not provide one, it’s important that you control a part of the process.  It is also important that employees keep their usernames and passwords private and not share them with other employees, especially if there will be work-related information on those accounts.  And they should also be aware that accessing another employee’s email account can create liability for them, regardless of whether the account is one provided by the employer or one created on their own.  Note that the court in this case wanted to know more about the employer’s internet use policy.  In this day and age, it’s almost mandatory that employers have internet and e-mail policies in their handbooks.  If you’d like to develop one, you should contact your labor and employment attorney for assistance.

Article By: Amelia J. Holstrom, Esq.
Reprinted from the February 2013 issue of the Massachusetts Employment Law Letter.

Amelia J. Holstrom is an Associate at the firm of Skoler, Abbott & Presser, P.C.  Amelia can be reached at (413) 737-4753 or aholstrom@skoler-abbott.com .