Privacy Within The Virtual Workplace

Work In Progress,
Privacy within the Virtual Workplace: The Entitlement of Employees to a Virtual Private Zone and the "Balloon" Theory, Shlomit Yanisky Ravid, Prof. of Law, Yale Law School, ISP, Fellow
Privacy within the Virtual Workplace: The Entitlement of Employees to a Virtual Private Zone and the "Balloon" Theory Dr. Shlomit Yanisky-Ravid1 Abstract: This paper addresses the question of whether employees should have a right to privacy within the virtual sphere of their workplaces, both at the workplace and while using employer-owned property, such as computers and networks. I conclude that there are strong justifications for a paradigm in which a sphere of privacy would be delineated within the virtual workplace, providing employees protection from employer intrusiveness. In other words, my main claim is that employees should have a private zone within the employer wired/digital/virtual premises, even when using corporate network tools or accounts (i.e. Internet accounts) and even during working hours. The reasonable expectation of privacy test implemented by the public sector, when applied within a modern virtual workplace realm, (almost) completely eliminates employees privacy rights. The same result of drained privacy rights has been diagnosed in the private sector by Professor Christine Jolls, who found that non-governmental workers overwhelmingly lose their rights when courts apply a test that examines explicit or implicit consent (all employees agree to waive the right to privacy). Therefore, moving toward employees Consent policy would not change the result. The outcome is that employees (almost) totally lost their privacy rights within the virtual workplaces. Furthermore, the article argues that U.S. legal realm, stemming from court decisions, which eventually distinguish between privacy within tangible premises of the workplace versus virtual spheres, should be reconsidered and refined. The traditional test as set forth by the Supreme Court in its 1987 OConnor v. Ortega decision, recognizing that employees tangible workspaces (such as a desk or cubicle or office) in a public office may be deemed as private space, should be applied to todays virtual workspaces,
1
Professor of Law. Yale Law School, Information Society Project (ISP), Fellow, 2011-2013.
Fordham Law School, Visiting International Professor, 2012. Ono Academic, School of Law, Israel. The Founder and the Head of the Shalom Comparative Legal Research Center, OAC. Thanks to Prof. Jack Balkin, ISP and to Prof. Joel Reidenberg, Center on Law and Information Policy (CLIP), Fordham Law. Special thanks to Ms. Elizabeth Ledkovsky for outstanding research assistance.
Work In Progress,
extending the law so as to integrate it with the realities of the digital era. The employee expectation test as well as other contract and tort theories likewise should be either replaced or adjusted to this notion of virtual workplace privacy zones. Securing a private zone to U.S. employees, a concept adopted by several other legal regimes, is justified by a bundle of psychological theories that can be concisely described as the balloon theory, describing the importance of a private sphere that constantly and permanently surrounds the persona wherever one goes, including within the public domain and digital spheres. Studies have shown that providing private zones fosters a sense of responsibility and accountability and, consequently, improves employee productivity. This theory is consistent with court decisions out side the US such, which found venues to secure employees privacy (i.e. the Israeli Isakov case). Accordingly, I conclude that we should reconsider these tests in order to secure a threshold of Private Zone within the virtual workplace. A new and needed policy may implement other new tests or make use of existing tools, such as the Least Invasive Mean (the Proportionality Analysis).
Work In Progress,
Table of Contents I. INTRODUCTION ........................................................................................................... 3 II. THE VIRTUAL SPHERE INHABITED BY EMPLOYEES ..................................................... 6 III. THE BALLOON THEORY ............................................................................................ 9 IV. THE LEGAL U.S. NORM OF PRIVACY IN WORKPLACE VIRTUAL SPHERES ............... 14 V. A DIFFERENT ATTITUDE: SECURING VIRTIAL PRIVATE ZONE .............................. 16 VI. ALTERNATIVE LEGAL TOOL: THE LEAST INVASIVE MEAN ..................................... 19 VII. RECOMMENDATIONS ............................................................................................. 21 A. Private Zones....................................................................................................... 22 B. The Least Invasive Mean .................................................................................... 22 C. Transparency ....................................................................................................... 22 D. Consent................................................................................................................ 23 E. Specific Purpose. ................................................................................................. 24 VI. Conclusion ............................................................................................................. 24
I. INTRODUCTION
The virtual domains, such as the Internet, blur the boundaries between workplace property and private zones. Standard modes of communication have changed dramatically. Todays employees have few, if any, viable alternatives to communicating with the world without using the virtual space (such as e-mail, websites, social networking/Facebook, Skype, and so on and so forth). Many employees today carry the newest portable digital devices,
like mobile phones, tablets, and portable computers, wherever they go, including to work. Denying or diminishing this virtual sphere can be equal to and as drastic as forbidding a person from speaking, as these mechanisms are the digital eras basic means of communication with others. Eventually,
nowadays, other alternatives are not "usable" and therefore, cannot be considered as a "real" alternative (i.e. sending letter from work for private purposes instead of an e-mail or text message).
Work In Progress,
Furthermore, employees who spend a tremendous portion of their waking time at the workplace have no other practical option than to use their employers virtual spheres. Dedication to a job or mere employment does not justify loss of privacy. A different perspective on the issue of employee privacy emerges from multinational firms, and the new era of international commerce gives rise to new considerations. American corporations, while working in and with
foreign firms located in different countries, might wrongfully assume that American policy prevails. The result might be a breach of the local policy regarding privacy in the workplace. In Israel, for example, a recent Supreme Labor Court decision held that there are four types of e-mail accounts within the workplace: Professional Mailbox supplied by the employer for professional purposes under a condition of informed written consent by employees that any private use is forbidden (type A); Mixed Mailbox combined or hybrid accounts (type B); Employer-Provided Personal Mailbox, provided by the employer for the employees personal purposes only (type C), and Employees Private Mailbox (i.e. employees Gmail account, which they use for private purposes) (type D). The court held that employers may not read employees private messages in any of these accounts, including type A, even when holding a contract signed by the employee allowing the employer to do so.2 Therefore, uniformity and harmonization of the norm, preferably by a new international
Labour Appeal no. 90/08 Tali Isakov-Inbar v. The Commissioner for Women Labour (February 8th,
2011) [hereinafter Inbar v Commissioner].
Work In Progress,
instrument defining and allowing a private zone, might be a wise and coherent resolution to the policy variations that currently exist around the globe. This Article argues that under the new U.S. legal realm employees (almost) totally lost their privacy rights within the virtual workplaces. This Article not only argues the case for a more balanced approach to employee privacy, but it also suggests a new desirable model to be adopted by policymakers. Inter alia, this solution should be part of the current
governmental discourse about privacy protection within the workplace. It concludes with several suggestions, including adding hard law attributes to the proposed instruments, toward effective implementation and genuine progression of attitudes toward workplace privacy in this global, digital age. The first part of the article describes the virtual sphere inhibited by employers. The following part discusses psychological perspectives of privacy within the workplace. The psychological discourse further refines the distinction between tangible and virtual workplaces. The theories can be concisely described as the balloon theory, describing the importance of a private sphere that constantly and permanently surrounds the persona wherever one goes, including within the public domain, the digital spheres and the employers kingdom". The next part describes briefly the American legal norm, whereas the following part introduces a different attitude from a different legal system (Israel). The last parts conclude with recommendation of alternative principles.
Work In Progress,
We start from explanations and demonstrations of violations of employees privacy within the virtual spheres.
II. THE VIRTUAL SPHERE INHABITED BY EMPLOYEES

In the digital era, there is tremendous potential for employees use of virtual spheres to put individuals at risk of compromising their own privacy by exposing themselves to present of future employer. The most common
violation of employee privacy is employer reading of employees private emails correspondence and employers tracking private information posted about the employees on web sites, even though the discussion of the privacy within the virtual spheres is broader and can embrace many more examples. For example, employers can intervene in employees private means of communication by reading private text messages in mobile phone and other devices, by tracking on-line activity, through surveillance of web postings (i.e. on Facebook), by tracking a persons location using GPS or voluntary social media check-ins, and so on and so forth. Snchez Abril, Levine and Del Riego described three ways in which employers are actively screening on-line activities of employees: (1) monitoring and surveillance of employee social media profiles, (2) evaluation of applicants social media profiles and online speech in the hiring process, and (3) limiting employees
Work In Progress,
off-duty online activities.3 In the twenty-first century, both employees and employers use the Internet and, more specifically, social media as substantial tools relative to employment. Employees use this tool while seeking work, whereas the employers rely on social media while searching for candidates and gathering information about existing and potential employees. Businesses monitor sites like Facebook and Twitter in search of information that may provide insight about prospective hires, while individuals can learn more about what it is like to work at a particular organization.4 In the famous case of City of Ontario v. Quon, the U.S. Supreme Court held that an employer did not violate the Fourth Amendment by reading private text messages, even if the employee had a reasonable expectation of privacy.5 Writing that the Court must proceed with care when considering the whole concept of privacy expectations in communications made on electronic equipment owned by ... a[n]... employer, Justice Kennedy revealed ambivalence toward the Courts present reasonable
Patricia Snchez Abril, Avner Levin and Alissa Del Riego, Blurred Boundaries: Social Media
Privacy and the Twenty-First-Century Employee, 49 AM. BUS. L.J. 63, 66-67 (2012), available at: http://onlinelibrary.wiley.com/store/10.1111/j.17441714.2011.01127.x/asset/ablj1127.pdf;jsessionid=51714F857C44696F55ABE310ED90FAFB.d03t02? v=1&t=hdxrdur0&s=ec0aff2696bd567a3122b8b3bd2163fe84e3257.
4
Id. at 69. Jeffrey Rosen, The Right to Be Forgotten, 64 STAN. L. REV. ONLINE 88 (Feb. 13, 2012),
available at http://www.stanfordlawreview.org/sites/default/files/online/topics/64-SLRO-88.pdf. See also Laura Lagone, The Right To Be Forgotten: A Comparative Analysis (December 7, 2012), available at SSRN: http://ssrn.com/abstract=2229361.
5
City of Ontario v. Quon, 30 S. Ct. 2619 (2010) (An employers monitoring and reading of an
employees personal text messages was justified by legitimate employer interests, even though the employee may have had a reasonable expectation of privacy).
Work In Progress,
expectations of privacy test, articulated in a 1987 decision.6 The narrow opinion was carefully worded, however, expressly describing the Courts wariness of making too early a pronouncement about the privacy levels that individuals may reasonably expect with regard to text messages or similar technologies, acknowledging that both science and society are evolving very rapidly in this realm.7 Indeed, digital technology has revolutionized the vehicles of social interaction. Future generations of employees, such as students, are cognizant of their reputational vulnerability on digital media, yet are not willing to sacrifice Internet participation to segregate their multiple life performances. Lacking the technological or legal ability to shield certain aspects of their lives that might once have been exclusively private, Millennials rely on others, including employers, to refrain from judging them across contexts. In other words, despite granting employers access to information about their private lives by exposing themselves online, respondents expect that work life and private life should be generally segregatedand that actions in one domain should not affect the other.8 Furthermore, portable electronic devices are now pervasive and increasingly dominate everyones life. 9 Thus, some people who are aware of the
6
Id. at 2628-9. See O'Connor v. Ortega, 480 U.S. 709, 107 S. Ct. 1492, 94 L. Ed. 2d 714 (1987). Id. at 2629. Abril et al, supra note 3, at 65-66 (empirical data reveals that new employees stated expectations of
privacy appear to be somewhat paradoxical: employee respondents generally want privacy from unintended employer eyes, and yet they share a significant amount of personal information online, fully knowing it could become available to employers and others.)
9
Michael Z. Green, Against Employer Dumpster-Diving for E-Mail 64 S.C. L. REV. 323 (2012).
(argues that the rise to ubiquity of portable electronic devices (Blackberries, i-phones, i-pads,, Androids, etc.) that blur the workspace with private spaces and blend work-time and private-time, calls
Work In Progress,
potential outcomes of a possible violation of their privacy pay a price, avoiding any kind of Internet expression, becoming virtual cripples, choosing to stay behind as current popular means of communication advance. The question of whether employers common practice of tracking employees private information with the virtual sphere is desirable can be discussed from several points of view. The following section will focus on the psychological need for privacy.
III. THE BALLOON THEORY

The abundant diversity of Internet/virtual tools provides more than just new means of expression. The pervasive use of the these virtual instruments, such as email, Facebook, Twitter, what sup, Skype, and so on and so forth, combined with the growing popularity of these tools among future employees, reflect a new reality. Access to culture, education, knowledge and human relationships are conducted primarily by active and constant everyday use of these virtual instruments. The virtual tools play an essential role in the definition of the person identity, self, self-expression, and self-identification.10 This is the point where psychological discourse meets the legal rules.
for a re-thinking of traditional distinctions and a new emphasis, not on employees reasonable expectations, but, rather, employers reasonableness in monitoring workers). See also United States v. Ziegler, 456 F.3d 1138, 1144 (9th Cir. 2006) (withdrawn on rehearing).
10
Id, at 2630.
Work In Progress,
Works about intrinsic motivation, from the psychological perspective, reveal that privacy is a notion perceived entirely in a persons consciousness, and not in the external world.11 The virtual spheres influence this consciousness, as related to privacy, because it does not depend on or stem from tangible assets or physical reality. In other words, privacy actually exists within our mind and soul. Privacy is the way we perceive privacy. This insight leads to the conclusion that differentiating between tangible and virtual spheres in their legitimate influence on privacy rights discourse or expectation to privacy may be misleading. Perceiving the consciousness as the intermediary between the cause of violated privacy and the psychological outcomes thereof justifies the interconnection, as has been made in the legal literature, between the right to privacy (including within virtual sphere) and important values embedded in psychological concepts such as freedom, dignity, autonomy of the persona, selfhood and human relation.12 Scholars and jurists have suggested many definitions to privacy without having settled on any one as the right one.13 I hold the notion that from a psychological/personhood perspective, privacy is the personal information and
11
Mihaly Csikszentmihalyi, Introduction, in OPTIMAL EXPERIENCE: PSYCHOLOGICAL STUDIES OF
FLOW IN CONSCIOUSNESS 10, 17 (Mihaly Csikszentmihalyi, Isabella Selega Csikszentmihalyi, eds, Cambridge University Press, 1998). (Consciousness is the information system that could differentiate among variety of stimuli that could choose certain stimuli and focus selectively on them and that could store and retrieve the information is a usable way).
12
Daniel J. veve, Marc Rotenberg & Paul M. Schwartz, PRIVACY, INFORMATION AND TECHNOLOGY
40 (Aspen Publishers, 2006).

13
The most famous one is the right to be left alone. Samuel D. Warren and Louis D. Brandeis, The
Right to Privacy, Harvard Law Rev. (2890).
10
Work In Progress,
emotions that remain personal, when the person is exposed in public. It can also be considered the ability of individuals to differentiate themselves or information about themselves and thereby reveal themselves selectively to others. We refer to private issues as information that is considered emotionally or personally sensitive or inherently important or special.14 The levels, boundaries, or content of what is considered private differ among situations, cultures and individuals, but share basic common themes. One of them is the wish to remain unnoticed or unidentified in the public realm (anonymity).15 In contrast to one of Professor Jed Rubenfelds main claims that privacy exists within a private sphere,16 I suggest that the real meaning of privacy does not exist when there are no others around, as the meaning of privacy and the need to privacy is established when other people may be perceived as invading into this conceptual privacy sphere. It can occur by physical invasion, such as seizure, scrutiny or rape, but most of the time it happens by others finding personal information (surveillance) or asking personal questions (investigation). Privacy, then, is the outcome of a
persons wish to withhold from others certain knowledge as to his past, present or future. The wish for privacy is the desire to be an enigma to others or, more
generally, the desire to control others perceptions and beliefs by monitoring the exposed information about ones self.17
14
Solove et al, supra note 12, at 39-42 (different definitions of privacy). Jed Rubenfeld, Anonymity and the digital Revolution, (publication pending, 2013) Id, Sidney M. Jourard, Some Psychological Aspects of Privacy, DUKE LAW AND CONTEMP. PROBS. 307
15
16
17
(1966).
11
Work In Progress,
This sphere of privacy consists of our perception about information and emotions can be analogized to the concept of an intangible balloon that always accompanies a person wherever she or he goes within the public domain or when perceiving an encounter with other people or actually interacting with other people. The size of the balloon differs according to the interaction. When we are with family and friends we consciously shrink the balloon and share part of it with them. When we are with foreigners or employers we need to save the balloon in order to preserve our personal sovereignty. The person may choose the time, place, and the level of disclosures of personal information, experience and emotions as well as the company before whom such disclosures are made. The state of privacy is related to the act of concealment.18 The reality of employees staying at the premises of
employment and using the employers tools both tangible tools such as computers and virtual ones such as Internet accounts is a classic example of the balloon theory in action, where the need to protect privacy is generated by a situation or encounter. The persons differ from one situation to the other.19 Different sets of social norms control distinct social settings. Thus, among friends and family, one acts according to one set of social behaviors, whereas the same behavior is not acceptable in a different setting and subject to sanction for visible deviation from patterned role behavior.20 Drinking with friends or at a festive celebration is welcome, unlike
18
Id. Shlomit Yanisky Ravid, Will the Wolf Dwell with the Lamb? Psychological Relationships in the
19
Workplace, in Liber Amicorum Elisheva Barak-Ussoskin (Guy Davidov and Guy Mundlak, eds., 2012).
20
Jourard, supra note 16, at 308 (physical sickness and mental disease may be the outcome of role-
conformity).
12
Work In Progress,
drinking at the workplace or while driving. Today, the Internet has blurred the borders between social contexts and mixed the different situations, creating a blend, and sometimes a clash, of rights and wrongs. It is ok to take pictures with friends at a costume party, but the same picture, once posted on the web, can cause a persons dismissal. A person should have adequate freedom to build the self and choose how that self will be represented. Likewise, the concept of privacy as limited accessibility enables us to identify when loss of privacy occurs to one self.21 The experience of psychotherapists has shown that people maintain themselves in physical health as well as psychological and spiritual well being when they have private space some locus that is inviolable by others, except by the persons express invitation.22 People disclose themselves to those that they trust, and it is reasonable to expect trust to be built before the disclosure. Nevertheless, electronic communication is different than traditional communication. Writing to a computer or keypad tends to seem impersonal. Consequently, messages are depersonalized, often resulting in stronger or more uninhibited text and more assertiveness in return.23 In other words, todays electronically transmitted communications are more likely than more traditional forms to be even more personal and, as perceived by the creator, private in nature. Yet, despite documented adverse
21
Solove at al, supra note 12, at 40. Jourard, supra note 17, at 310. Sara Kiesler, Jane Siegel, and Timothy W. McGuire, Social Psychological Aspects of Computer-
22
23
Mediated Communication, AM. PSYCHOLOGIST 1125 (1984), 9 (the use of electronic communication brings new social psychological norms of behavior).
13
Work In Progress,
effects from psychological and business perspectives, employee monitoring and surveillance remain pervasive in the business world.24
Having a private sphere in the workplace might bring better results from the employers point of view. In place of suspicion and mistrust, privacy and trust might encourage employee motivation, followed by higher productivity levels, an improved sense of responsibility toward work, an increased likelihood of employees taking initiative and even better worker health.25
IV. THE LEGAL U.S. NORM OF PRIVACY IN WORKPLACE VIRTUAL SPHERES

The current U.S. legal policy regarding privacy at the workplace reveals that employees are often exposed to trespass by their employers, via unwelcome reading of private mails or text messages in mobile phones and other devices, tracking their webs activities, surveillance of web postings (i.e. on Facebook), tracking of employee location, and so on and so forth.
The fact is, courts and lawmakers around the world are having trouble conceptualizing privacy in new technologies.26 The prevailing attitude in the U.S. is that the digital sphere of the employers (i.e. e-mail, internet accounts) is not protected
24
Abril et al, supra note 3, at 69. Id. See also Jourard, supra note 17, at 308. Abril et al, supra note 3, at 64 (the shared unease among lawmakers around the world suggests that
25
26
they need more information to gauge privacy and behavioral norms for new technologies).
14
Work In Progress,
from employer intrusiveness into the employees privacy.27 The law differentiates between employees who work in governmental institutions and those who work in the private sector, because the U.S. Constitution (specifically with respect to privacy, its Fourth Amendment) limits the government, including in its capacity as an employer).28 That distinction notwithstanding, the policy permitting employer
intrusion upon employee electronic communication and digital tool usage is prevalent within both sectors. Public Sector employer monitoring of employee usage of employer Internet tools and other communication devices is subject to a test of the employees reasonable expectation of privacy,29 whereas private sectors workers are governed mainly by explicit or implicit contracts.30 The prevailing attitude in the U.S.
27
Privacy Rights Clearinghouse, Fact Sheet 7: Workplace Privacy and Employee Monitoring ,
available at https://www.privacyrights.org/fs/fs7-work.htm#4a (last visited March 7, 2013).

28
Paul M. Secunda, Privatizing Workplace Privacy, 88 NOTRE DAME L. REV. 277 (2012) (offers a
clear delineation of the differences between the private and the public employment sectors, arguing that there are sound public policy interests in providing greater protection for government workers. Absent government intervention or involvement as an employer, the law affecting private employers and their employees is based mainly in tort, and it is evolving).
29
Articulated by Justice Harlan (there is a twofold requirement, first that a person have exhibited an
actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as reasonable.), concurring in Katz v. U.S., 389 U.S. 347, 360 (1967). But the Court later held that privacy rights do not rise or fall with the Katz formulation, noting that common law understandings of trespass, including the particular concern of government trespass upon the areas (persons, houses, papers, and effects) was not repudiated by Katz, but rather supplemented by the ruling. U.S. v. Jones, 132 S. Ct. 945, 950 (2012).
30
Christine Jolls, Privacy and Consent Over Time: The Role of Agreement in Fourth Amendment
Analysis, available at
15
Work In Progress,
workplace and courts is that e-mail privacy (and, less explicitly, Internet usage in general) as well as tracking of private information on employee Internet posts is not protected, whether originating in the physical workplace or from the virtual sphere, especially when employees use employer computers and networks. Courts have held that employees cannot have a reasonable expectation of privacy related to e-mail or other electronic communications, and federal law is very limited and generally leans away from affording employee privacy, especially when it comes to the specific issue of e-mail. Courts have held that employees cannot have a reasonable expectation of privacy related to e-mail or other electronic communications. 31 Physical instruments and spaces have traditionally defined privacy law in the United States. The reasonable expectation of privacy analysis, endemic to privacy jurisprudence, is firmly rooted in the experience of physical space and its surrounding normative circumstances. Policy makers have thus far failed to adjust privacy norms to the new reality that most workers function within a virtual sphere in a way that individual privacy will be at least partially protected.
V. A DIFFERENT ATTITUDE: SECURING VIRTIAL PRIVATE ZONE

Israels National Labor Court combined two appeals concerning the admissibility of email correspondence as evidence.32 In the first, Panaya Ltd., a software company, dismissed Tali Isakov-Inbar, an employee of the company. Inbar
http://www.law.yale.edu/documents/pdf/Alumni_Affairs/Jolls_RationalityandConsentinPrivacyLaw_121-10.pdf (last visited Mar. 7, 2012).
31
Lisa Smith-Butler, Workplace Privacy: Well Be Watching You, 35 OHIO N.U. L. REV. 53 (2009).
32
Isakov v. Commissioner, supra note 2.
16
Work In Progress,
sued her former employer, claiming that she was unlawfully dismissed due to her pregnancy. Panaya contended that the dismissal notice was issued to Isakov prior to her pregnancy. To support its claim, Panaya submitted copies of Inbar's e-mails sent from her company-provided mailbox. These emails contained Inbar's CV and were sent to several employment agencies. Inbar argued that, although Panaya provided the mailbox to her, use of the mailbox for personal purposes was permitted. In the second case, Ron Fisher was a senior manager, employed for over 20 years by Afikei Mayim, an agricultural cooperative that supplies water in the Beit Shean Valley. The employer suspected Fisher of using its trade secrets to run a competing business and claimed that such activity caused the company significant financial harm. The employer fired Fisher and supported its action through e-mails from Fishers private e-mail account and from paper copies of the e-mails, which Fisher had thrown into his garbage can at work. In Inbar's case, the Regional Labor Court ruled that there was no violation of the Privacy or Eavesdropping laws. However, the Israeli National Labor Court, by a unanimous decision, ruled that in both cases the employers violated the employees privacy.33 The Court distinguished four different types of employee mailboxes based on the type of correspondence generally exchanged in such mailboxes and whether the mailbox was provided by the employer, establishing different rules for each type of mailbox. It should be noted that those specific rules are in addition to the general standards detailed above, which apply to all monitoring activity.
33
Id. English version interpretation and recommendation: Landmark Case Establishes Guidelines For
Monitoring Employee Online activity, Meitar, available at: http://www.meitar.com/177013
17
Work In Progress,
Under this ruling, a Professional Employer Mailbox(type A) is a mailbox provided by the employer for professional purposes only and the employee is restricted from using it for his or her private needs. The employer is required to inform the employee of the restrictions on use and of the employer's ability to Monitor the email correspondence exchanged in such mailbox. The employer is required to obtain general consent for its e-mail policy in order to monitor even professional correspondence, but is not required to obtain consent for each individual instance of monitoring of professional correspondence in this type of mailbox. The most important rule is related to personal correspondence in the Professional Mailbox: the Court did not accept an expectation of privacy test, and held that, although the employee is not authorized to engage in private correspondence, the employer is nevertheless prevented from reviewing the content of such correspondence without the employees specific consent. Moreover, in accordance with the High-Tech Sector Agreement from 2008 on Email Monitoring and Computer Use, which was referred to on several occasions in the Inbar opinion, the employer may be required to notify the employee that they have a right to be present during such review of email. A Mixed Mailbox" (type B) is a mailbox provided by the employer for both professional and personal purposes. 34 Reviewing (i.e., actually inspecting and reading the content of the correspondence), as opposed to merely monitoring, personal correspondence in the Mixed Mailbox requires the employee's specific consent in each instance.
34
In our view, in most cases these days, employers will be providing such a mixed mailbox, as e-mail
is used for both professional and personal purposes.
18
Work In Progress,
On the other hand, the "Employer-Provided Personal Mailbox" (type C) is provided by the employer for the employees personal purposes only. Any type of Monitoring of the Personal Mailbox (whether actually inspecting the content of emails or just monitoring subject lines of the e-mails or other parameters, such as size of the e-mails), regardless of the type of correspondence (personal or professional) requires the employees specific consent in each instance. Finally, an Employees Private Mailbox is a mailbox privately held by the employee (such as Hotmail, Gmail, Yahoo, etc.), which may be accessed via the workplaces Internet connection (Type D). All monitoring of the Private Mailbox by the employer is prohibited without a court order, even in when the employee gives general or specific consent. Hence the court has adopted the private zone within a digital employment sphere wherein employees are entitled to private space, respecting individual dignity and providing workers the opportunity to be party to any inspection and to (at least partially) control it.35
VI. ALTERNATIVE LEGAL TOOL: THE LEAST INVASIVE MEAN

The reasonable expectation of privacy test implemented by the public sector, when applied within a modern virtual workplace realm, (almost) completely eliminates employees privacy rights. The same result of drained privacy rights has been diagnosed in the private sector by Professor Christine Jolls, who found that non-governmental workers overwhelmingly lose their rights when courts apply a test that examines explicit or implicit consent (all
35
Id.
19
Work In Progress,
employees agree to waive the right to privacy). 36 Therefore, moving toward employees Consent policy would not change the result. The outcome is that employees (almost) totally lost their privacy rights within the virtual workplaces.
Securing a private zone to U.S. employees, which have been adopted by several other legal regimes, is justified by a bundle of psychological theories that can be concisely described as the balloon theory. Following the conclusion that employees have the right for secured private zone, we should rethink about the existing tests and consider replacing them with alternative tools that better serve this purpose. Without excluding other alternative tools, the article brings the Least Restrictive Mean test usually considers as part of the proportionality analysis, as an example for an alternative legal tool.37 Proportionality analysis has widely diffused over the past fifty years. It is today an overarching principle of constitutional adjudication, the preferred procedure for managing certain disputes. Although other modes of rights adjudication were available and could have been chosen and developed, proportionality analysis has emerged as a multi-purpose, best-practice, standard.38
36
Jolls, supra note 30.
37
Aharon Barak, Proportionality: Proportionality: Constitutional Rights and their Limitations (Cambridge Studies in Constitutional Law, 2011) (Aharon Barak explores its four components of proportionality: proper purpose, rational connection, necessity and proportionality stricto sensu) 38 Alec Stone Sweet and Jud Mathews. "Proportionality Balancing and Global Constitutionalism" Columbia Journal of Transnational Law 47, 74-75 (2008) (In the authors view, proportionality-based rights adjudication now constitutes one of the defining features of global constitutionalism, if global constitutionalism can be said to exist at all).
20
Work In Progress,
The core of necessity analysis is the deployment of a least restricted Means (LRM) test: the judge ensures that the measure does not curtail the right any more than is necessary for the other side (government) to achieve its stated goals.39 When applied to workplaces, either public or private, I suggest using the Least Invasive Mean as the applicable test for maintaining Virtual Privacy (as well as other sorts) at the workplace. The idea behind this principle is simple. When there are two means to achieve legitimate information the permissible mean would be the less invasive, less restrictive, less offensive one. The mean that better protects the right will be the right one. I conclude with a recommendation to implement this principle within the context discussed in this study.
VII. RECOMMENDATIONS
The conclusions, follow from the alternative case of Isakov discussed above, and can be implemented in a wide variety of cases in the field of employees privacy within the virtual spheres. 40 A number of principles emerge that make sense for a 21st century workplace environment that encourages employee engagement and respects privacy. The components described below do not stand alone. Their efficiency depends on combining them together into one coherent solution.
39 40
Id. Isakov, supra note 2
21
Work In Progress,
A. Private Zones The importance of privacy rights does not skip over employees at the workplace. It is time to reconsider standard privacy policy within the workplace and to secure private zones to employees using the virtual sphere of the workplace.
B. The Least Invasive Mean The rule of proportionality can be implemented in this issue of employees privacy efficiently. The employers should limit incursion of employees private zone to extreme circumstances in which severe immediate damage may be caused to the employers legitimate interests (such as criminal harmful activity by the employee). Violation of employees privacy may only take place if it is proportional, measured in light of the potential harm to the employer, and only to the extent there are no other, less invasive alternatives to achieve the same result. Employers should use the least invasive technology available. For example: automated monitoring or blocking software would be less invasive than human monitoring of e-mail.41
C. Transparency Employers should have a clear, written and detailed internet, e-mail and computer usage policy. The employee should be aware of the policy and its outcomes and must
41
Isakov, supra note 2
22
Work In Progress,
explicitly agrees to it. The policy should be attached to individual employment agreements and approved by the employee signature. If the company has an employee handbook, the policy should be included. 42
D. Consent Employers should obtain employees informed, willing, written and signed consent to any violating of employees privacy. In order to meet the informed consent requirement, the employer must disclose to employee, in writing, the matters set forth in the policy, such as: the nature of any monitoring tools, the purpose of monitoring, and the period for which monitored data will be retained. There are two types of employees consent: (i) general consent to e-mail policy; and (ii) specific consent to each instance of monitoring. . 43 In case of privacy, in order to secure the necessary private zone, we recommend to adopt the second specific rule of specific consent The consent policy bears risks, as employees would probably sign any agreement in order to be employed.44 Therefore, I suggest considering informed and explicit consent only when the broader policy includes more components for securing a minimum of privacy, which will not be subject to contractual waiver. 45
42 43
Isakov, supra note 2 Isakov, supra note 2 44 Jolls, supra note 30. 45 Isakov, supra note 2
23
Work In Progress,
E. Specific Purpose. Surveillance after any employees private information must be founded on a specific, clear and legitimate purpose, and the employer may not use the information gathered from the monitoring for a purpose other than the purpose for which the monitoring was performed. 46
VI. Conclusion
One of the most important conclusions is the fact that the mere existence of technical tools, capable of tracing, surveillance and tracking of personal data, does not mean that using them to violate privacy is a permissible norm. There is a gap between what can technically be done and what should be done. Bringing American policy in line with the realities of digital age society will benefit employers, by fostering trust, encouraging workplace creativity and improving productivity.
46
Isakov, supra note 2
24

Privacy Within The Virtual Workplace

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Privacy Within The Virtual Workplace

Uploaded by

Copyright:

Available Formats

Work In Progress,

2011) [hereinafter Inbar v Commissioner].

II. THE VIRTUAL SPHERE INHABITED BY EMPLOYEES

III. THE BALLOON THEORY

Mihaly Csikszentmihalyi, Introduction, in OPTIMAL EXPERIENCE: PSYCHOLOGICAL STUDIES OF

40 (Aspen Publishers, 2006).

Right to Privacy, Harvard Law Rev. (2890).

IV. THE LEGAL U.S. NORM OF PRIVACY IN WORKPLACE VIRTUAL SPHERES

available at https://www.privacyrights.org/fs/fs7-work.htm#4a (last visited March 7, 2013).

V. A DIFFERENT ATTITUDE: SECURING VIRTIAL PRIVATE ZONE

Isakov v. Commissioner, supra note 2.

Monitoring Employee Online activity, Meitar, available at: http://www.meitar.com/177013

is used for both professional and personal purposes.

VI. ALTERNATIVE LEGAL TOOL: THE LEAST INVASIVE MEAN

Jolls, supra note 30.

Id. Isakov, supra note 2

Isakov, supra note 2

Isakov, supra note 2

You might also like