Winter 2007In a criminal case, an employee sought to suppress images of child pornography found on his workplace computer. The issue in the Ninth U.S. Circuit Court of Appeals case was whether an employee has a legitimate expectation of privacy on his workplace computer and in his office.
The employee was the Director of Operations for a Montana company that services Internet merchants by processing on-line electronic payments. The employee was provided an office with a locking door and a computer that was password protected. The company had administrative access to his computer, had issued company policies notifying employees that the computer system was not to be used for activities of a personal nature, and that the company routinely monitored Internet traffic for compliance. The company's IT personnel then actively monitored and reviewed Internet sites accessed by employees, including the employee at issue here.
The court, relying on U.S. Supreme Court precedent, was compelled "to recognize that in the private employer context, employees retain at least some expectation of privacy in their offices." But the court said "that even where a private employee retains an expectation that his private office will not be the subject of an unreasonable government search, such interest may be subject to the possibility of an employer's consent to a search of the premises which it owns." The court found that the company maintained "common authority over the office and the workplace computer such that it could validly consent to a search.
The good news is that employers can maintain common authority over its company-owned or provided assets so that it can validly consent to a search by government agents or exercise its right to search company-owned property. To do so, a company should have:
- Clear and concise written policies notifying employees of the company's right to access company property and to monitor computer systems, including Internet access;
- A policy that states the computers are company-owned and not to be used for activities of a personal nature;
- Active and regular procedures in place to monitor and review computer systems, including Internet sites accessed; and
- An employee handbook in which the policies and procedures are set forth.
United States v. Ziegler, 9th Cir., No. 05-30177 (Jan. 30, 2007).