Accessing Email Evidence on Company Computers
Work-related email accounts are ubiquitous and often are used by employees for personal reasons. Employees also may use their own personal email accounts on employer-provided resources—with or without the permission of the employer. Many cases have considered the right of an employer to access an employee's email accounts from the employee's work computer.1 A trio of recent cases, however, addressed the question of whether an employer may rely on evidence obtained from employee emails that are discovered on company owned computers.
An Employee's Office Computer
A recent decision by the Supreme Court, New York County, discussed the various factors that will be considered in assessing the right of an employer to rely on employee emails in litigation with the employee, including the existence of email policies, the location of the emails when accessed, and the context of the claim.2
As the court explained, Front Inc. sued Philip Khalil, a former employee, for allegedly using Front's confidential and proprietary information to divert work from Front. Front alleged that three days after Khalil had tendered his written resignation, the company's network engineer noticed an external hard drive storage device attached to Khalil's office computer. The next morning, Khalil, the network engineer, and two Front executives reviewed the contents of that hard drive. They determined that in addition to some of Khalil's private information, it also contained Front's files including allegedly confidential and propriety information. It allegedly was agreed that Front would keep the hard drive, but would provide Khalil with a second hard drive onto which it copied Khalil's private information.
In the ensuing litigation, Khalil brought an affirmative claim against Front and Front's partner, Marc Simmons, and moved to suppress all emails and documentary evidence accessed from his personal and business email accounts by Front.
The court first rejected Khalil's argument that a cause of action could be stated or his emails suppressed based on the Stored Communications Act (SCA).3 The court credited Front's argument that it was Khalil's storage of his personal emails on Front's computer, which he later transferred to the external hard drive, that permitted Front to access "dead copies" of emails. It rejected, as conclusory, Khalil's claim that his emails had been "improperly intercepted," finding no evidence that Front had accessed Khalil's email accounts. The court decided that because neither an office computer nor an external hard drive constituted a "facility through which an electronic communication service is provided"4 for purposes of the SCA, the cause of action for damages had to be dismissed and the emails did not have to be suppressed.5
The court then considered whether the emails could be suppressed based on Khalil's right of privacy. Khalil asserted (and Front did not contest) that Front had no policy barring the use of an office computer for personal email activity. Therefore, Khalil contended, he had a reasonable expectation of privacy with respect to any information stored on his computer and his personal communications had to remain out of his employer's reach.
The court noted that in this case, unlike prior cases that addressed the issue, the emails did not involve attorney-client communications,6 but were personal in nature. It observed that the emails that Khalil sought to suppress were found by Front "because only a few days after Khalil tendered his written resignation, it was discovered that he was downloading documents from his office computer to an external hard drive." Then, with Khalil present, the contents of that hard drive were inspected by Front. In the court's view, even if Khalil may have had some expectation of privacy with respect to his computer, "it was not unreasonable for his employer to examine the contents of the external hard drive to determine whether any of Front's documents were being downloaded by its employee, who had just tendered his resignation." The court stressed that to the extent that copies of Khalil's personal emails were accessed, that was accomplished by viewing copies Khalil had saved on the hard drive of his office computer and then downloaded to an external hard drive and not by accessing his private email account. Thus, questions of "work-related misconduct" by Khalil overcame any expectation he may have had based upon pre-resignation practices.7
Tacit Waiver of Privilege
Another judge in the Supreme Court, New York County, considered similar factors when determining whether the attorney-client privilege was waived when attorney-client emails were stored on a company computer accessed by all employees.8
In that case, two ex-employees, Ian Gipe and Jonathan Ben-Yosef, sued Monaco Reps (a photographers agency) and its principals for non-payment of commissions after they resigned. Monaco countersued for breach of contract, breach of fiduciary duty, misappropriation, and other claims in connection with the plaintiffs' alleged use of Monaco's resources and proprietary information while still employed by Monaco and also brought a third-party action against the plaintiffs' new company. Monaco largely had learned of the existence of its claims against the plaintiffs after viewing certain emails that were sent by a lawyer who was consulted in regard to the plaintiffs' new company. Those emails were forwarded by Gipe to Ben-Yousef, who then downloaded the lawyers' emails and others to Monaco's office computer.
Gipe and Ben-Yosef moved to suppress use of the emails and for disqualification of Monaco's counsel and attorney fees. In denying the application, the court noted that there was an undisputed right to privilege that attached to the initial exchange between Gipe and the attorney regardless of the fact that it was sent by email. However, the court determined that Gipe had waived that privilege when he forwarded the emails at a time that Ben-Yosef had not yet become a client of the attorney. The court rejected the argument that there was a "common interest" between Gipe and Ben-Yousef that permitted him to share the email prior to Ben-Yousef's retention of the attorney.
The court moreover looked at the facts and circumstances beyond the mere fact that the emails at issue contained Gipe's private email address. It gave substantial weight to the fact that Ben-Yousef had stored the emails on his company computer—a shared computer that was accessible to all employees through a single, shared login.
The court also noted that Monaco (like Front) had accessed copies of emails that were located on Monaco's company desktop computers and were "not on a website or server." Accordingly, CPLR 4548, which protects the privileged nature of communication even if "persons necessary for the… facilitation of such electronic communication have access," did not apply.