Information Law Group: Privacy, Privilege, and the Cloud, Oh My: Taking LovingCare to Heart
At the Information Law Group blog, Tanya Forsheit discusses the New Jersey Supreme Court’s recent ruling (pdf) in Stengart v. Loving Care Agency, Inc. (A-16-09), a case concerning the privacy of employees’ personal e-mail on employers’ computers. Forsheit says the case has implications for cloud computing.
What does workplace privacy have to do with the cloud? Everything. On Tuesday, the New Jersey Supreme Court issued its opinion in Stengart v. LovingCare Agency, Inc., — A.2d —-, 2010 WL 1189458 (N.J. March 30, 2010), and came out on the side of protecting employee privacy and the attorney-client privilege in personal Yahoo! webmail (a cloud service) even though the employee used a company computer. While everyone has been busy writing about the implications of LovingCare for company policies governing employee expectations of privacy (and for good reason), few have stopped to note that LovingCare is a cloud case. LovingCare is one of only a few published opinions addressing the difficult issues surrounding employee use of webmail and other cloud services on company computers where the attorney-client privilege is at stake, and the impact of the LovingCare decision will undoubtedly be felt for years to come by nearly every employer across the country, both in crafting policies for employee use of company computer systems and in conducting discovery in nearly every employment-related litigation. [...]
In a ruling based on these very particular factual circumstances, the New Jersey Supreme Court held that Stengart could reasonably expect that e-mail communications with her lawyer through her personal, password-protected, web-based email account, accessed on a company laptop, would remain private, and that sending and receiving them via a company laptop did not eliminate the attorney-client privilege that protected them. [...]
Stengart had a subjective expectation of privacy because she “plainly took steps to protect the privacy of those e-mails and shield them from her employer. She used a personal, password-protected e-mail account instead of her company e-mail address and did not save the account’s password on her computer.” She had an objective expectation of privacy because the Policy said nothing about such personal emails and her communications were protected by the attorney-client privilege. [...]
Naturally, the Court’s decision does not deny employers the ability to restrict personal communications by employees using web-based cloud services on company-owned computers. [...]
However, there are limits – and the Court signaled that an employer will not be able to enforce a policy that prohibits all personal communications and reserve the right to read attorney-client communications:
Possibly related posts: