Excerpted from a Constangy Brooks Smith & Prophete LLP blog by Robin Shea
Know where your rights as an employer begin and end. A federal judge refused this week to dismiss a “cyber privacy” lawsuit, providing some good lessons for employers.
Most employers have policies giving them the right to monitor employees’ activities while using the employer’s computer systems. But even so, the employer’s rights aren’t unlimited.
The allegations in Frankhouser v. Clearfield County Career & Technical Center may not be true. But hang on to your hat because here is what the plaintiff says:
Prologue
Elizabeth Frankhouser was the Executive Director of the Career Center.
Among other things, Ms. Frankhouser had a personal Dropbox account, which she used for business and sometimes for pleasure. For those unfamiliar with Dropbox, it is a cloud-based storage application. If you have a Dropbox account, you can store things like photos and videos, and also documents in the “cloud” to save space on your hard drive.
Dropbox accounts are password-protected. If you are on a mobile device, you can access it through the app. If you’re on a computer, you go to the Dropbox website and log in using an email address and password.
According to Ms. Frankhouser, she never accessed “personal” material in her Dropbox from the Career Center and never downloaded it to her work computer. While at work and on the employer’s systems, she used Dropbox strictly for business.
Things are about to get interesting
Shortly after she was hired in 2015, Ms. Frankhouser’s supervisor “Todd” allegedly began sexually harassing her. Ms. Frankhouser refused Todd’s advances and complained to his boss, “Greg.” Todd then allegedly began making things difficult for Ms. Frankhouser.
Meanwhile, she investigated one employee, “Doug,” for “questionable work practices,” which allegedly caused Doug to tell someone that he would like to “kill” her. And the wife of the IT administrator applied for a job at the Career Center and was turned down.
So, Todd, the IT administrator, and Doug all allegedly hate Ms. Frankhouser.
At some point, Ms. Frankhouser’s computer started malfunctioning, and the IT administrator removed and replaced her old hard drive and loaded her stuff onto the new hard drive. Among other things, Ms. Frankhouser had her passwords stored on an Excel spreadsheet on her Career Center computer (terrible idea).
After changing her hard drives, the IT administrator allegedly took the old hard drive home and opened Ms. Frankhouser’s “password” spreadsheet, logged into her Dropbox account and found two “explicit” pictures of Ms. Frankhouser’s boyfriend and some pictures of her at a party, having a really good time.
The IT guy allegedly printed hard copies of the pictures and gave them to Doug and he allegedly gave the pix to Greg, the big boss.
Greg terminated Ms. Frankhouser, reportedly for having dirty pictures on her Career Center computer (which she did not).
Then Greg allegedly presented Ms. Frankhouser with a separation agreement. Despite the fact the agreement said she had 21 days to consider, Greg allegedly told her she had to sign on the spot or else.
After her termination, the IT administrator allegedly gave a set of the pictures to Todd, the alleged sexual harasser. And Doug told people at the Career Center that Ms. Frankhouser had “hundreds” of dirty pictures on her computer, which was not true.
Not surprisingly, Ms. Frankhouser sued for everything in the book, including violation of her rights under the Fourth Amendment to the U.S. Constitution (the Career Center is a public-sector employer) and for invasion of privacy under Pennsylvania common law.
Does she have a case? Yep.
The Career Center and the individual defendants filed a motion to dismiss the “cyber-claims” as well as the other claims. Among other things, the defendants said Ms. Frankhouser (1) violated the Career Center’s computer use policy by keeping dirty pictures in her Dropbox, and (2) had no reasonable expectation of privacy with respect to the Dropbox material because she accessed her account frequently while at work.
The judge dismissed some of the claims in the lawsuit, but she allowed several, including the “cyber-claims,” to go forward. Here’s what she said about the cyber-claims:
• The Career Center’s computer use policy was not properly presented before the court. On a motion to dismiss, the court considers only allegations made in the plaintiff’s lawsuit, not evidence submitted by either side. The only issue at this stage is whether the plaintiff’s allegations, if true, would give rise to a valid legal claim.
• Even if the Career Center policy had been before the court, it wouldn’t have done the defendants any good because it did not apply to an employee’s private cloud account or material that had never been accessed through the employer’s system.
• Based on the lawsuit allegations, Ms. Frankhouser absolutely did have a reasonable expectation of privacy with respect to her personal Dropbox material. It was her own private account, it was password-protected, and Ms. Frankhouser had never accessed the pictures while on the Career Center system or downloaded them. The fact she sometimes used Dropbox for work did not mean she lost the right to keep her personal Dropbox private.
Again, the court could consider only Ms. Frankhouser’s side of the story. The defendants will now have the opportunity to present their side.
So, what can employers learn from this decision about employees’ internet use? Plenty.
Don’t overreach. If you have a good internet usage policy, you should have the right to monitor employees’ emails in your system, as well as their online activities. But that doesn’t mean you have the right to go “fishing” in employees’ private accounts.
Before you take action, educate yourself. If Ms. Frankhouser’s allegations are true, poor Greg may not have understood Dropbox, so the IT administrator may have been able to mislead him into thinking pictures were stored on the work computer. Before taking action, Greg should have done research, or even asked a different IT expert for a Dropbox tutorial (without revealing identities).
Don’t trust anybody! Especially when it comes to cyber-anything. It is too easy today for people to spoof and create mischief. In my law office of 11 attorneys, I’m aware of two cases in the past year involving someone who cyber-sabotaged a co-worker. As they used to tell us in the newspaper business, “If your mother says she loves you, check it out.” Make sure you know what is going on before you make an employment decision you’ll regret.