Summary of Federal Laws
Miscellaneous Laws that Might Apply
|Chief Information Officer|
|Employee Electronic Communications|
Electronic Communications Privacy Act of 1986 (ECPA)
The ECPA amended Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (the Wire Tap Statute), which was designed to protect communications from government surveillance. The law also regulated private individuals and businesses. The ECPA amended the Wire Tap Statute to encompass transmissions of electronic data by computer and the law prohibits both the interception of electronic communications and access to stored electronic communications. Some commentators argue that this law gives employees of private entities a right to privacy in their e-mail. Title18 U.S.C. § 2510(15) extends the Act's protection to university-owned telephone, e-mail and Internet systems. However, there is support for the proposition that employers who own the computer system used by their employees have the right to monitor employees' e-mail. Employee consent is also a defense to liability under the ECPA intercept provision, and this exception is the more certain of the exceptions to liability under the law. Thus, employees should either consent to or be put on notice that it is university policy that their e-mail may be intercepted.
Selected Case Law
United States v. Councilman, No. 03-1383 (1st Cir. decided June 29, 2004)
This case involved an interpretation of Title I of the Electronic Communications Privacy Act, commonly known as the Wiretap Act.* The defendant in question, was a Vice President, shareholder and employee of Interloc and Alibris. Interloc was primarily an online out of print book service, but also provided certain book dealers with email accounts and acted as on online service provider. The defendant in question tasked an employee with writing a recipe file that caused all of the messages from Amazon.com to these book dealers to be copied while the mail user agent was in the process of placing the messages into the recipient's mailbox, with the copy to be placed in Councilman's own email box. Councilman thus intercepted thousands of email messages before they reached the intended recipients, hoping to use the information gained for commercial advantage.
Whether or not this activity violated the Wiretap Act was the question decided by the 1st Circuit Court of Appeals. The Defendant claimed that the email intercepted was "in storage" as defined under 18 USC § 2510 (17) and thus the Wiretap Act was not violated. The government would have read the law as stating that an intercept is subject to the Wiretap Act between the time the author presses the send button and the time that the message arrives in the recipient's email box. Although the plain text of the law does not address the issue of whether a communication is still considered an electronic communication when it is in electronic storage during transmission, the government argued legislative history favors the goverment's view, which is that it is irrelevant that the transmission may have been in storage at the time of interception as long as the communication is acquired contemporaneously with the transmission.
The Court agreed with the Defendant, and failed to be persuaded by the argument of the government that if an electronic communiciation is obtained while it is simultaneously in transmission and storage, than an illegal intercept under the Wiretap Act occurs. The Court found that Congress intended to give lesser protection to electronic communications than to wire and oral communications. The Court did concede that much of the protection of the law may have been eviscerated by the realities of modern technology. In a 36 page dissent, Judge Lipez rejected Councilman's claim that Congress only intended to protect email when it is traveling through cables and not when it is being processed by electronic switches and computers during transit and delivery. The dissent contains a nice summary of the procedural protections offered under Title I of ECPA and which are absent from Title II of the ECPA. Judge Lipez points out that all digital transmissions must be stored in RAM or on hard drives while they are being processed by computers during transmission. The holding of the Court is only binding in the 1st Circuit.
Changes to ECPA made by the USA PATRIOT ACT
On Oct. 26, 2001 President Bush signed the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 2001. (Public Law 107-56; 115 Stat. 272). This new law amended a number of laws, including the Electronic Communications Privacy Act. The changes made by the PATRIOT Act to ECPA address two situations, one, the manner in which government authorities can compel disclosure, and two, whether or not an organization can make a voluntary disclosure to government authorities. For example, one of the changes in the law is that search warrants can now be used to access stored voice mails transmitted via computer.
Section 212 of the USA-Patriot Act amends ECPA by adding a new voluntary disclosure exception for emergency situations. Under this exception, if a provider reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of certain information without delay, the provider may disclose that information (content or non content records) to a law enforcement agency. Also, and this was not clear under the law before, under the USA PATRIOT Act an Internet Service Provider may authorize federal law enforcement to investigate computer trespass by someone outside the system, e.g. a person that does not have an existing relationship with the owner or operator of the system. (Section 202 amends 18 U.S.C. § 2516(1)(c) to add the Computer Fraud and Abuse Act offenses (18 U.S.C. § 1030))
In light of the changes made by the law, it is advisable for colleges and universities to review their procedures and protocols regarding release of information. Tracy Mitrano, the Policy Advisor for Cornell's Office of Information Technologies, has been advising colleges and universities on this topic, and a full set of her materials, including a Q and A, and policies and procedures, can be found online at Cornell Office of Information Technologies USA Patriot Act page.
Monitoring Employee Phone Calls
The federal wiretap statute, 18 U.S.C. § 2510 et seq., as amended by the Electronic Communications Privacy Act, makes it illegal to intercept or disclose intercepted telephone communications unless certain exceptions apply. The law creates civil and criminal liability for anyone who "intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral or electronic communication."
There are basically two exceptions to this law that can be considered by an employer who wishes to monitor employee phone calls:
the consent exception, and
the business extension exemption.
The Consent Exception
Interception of a communication is allowed when one of the parties to a communication has given prior consent. Express consent to be monitored should be given by the employee. Implied consent is a possibility, but tougher to rely upon. Consent will not be casually implied, as the intent of the law is to protect individual privacy. Thus, an employee who has consented to the monitoring of calls for business purposes should not be considered to have given consent to monitoring of personal calls.
Special Considerations for Interstate Phone Calls
In addition to the federal statutory requirements, most telephone common carriers have implemented tariffs that require one of the following when the conversation being taped is interstate:
two-party consent to the wiretapping;
verbal notification by the recording party prior to recording the conversation; or
an automatic "beep" tone at regular intervals while the recording device is in use.
Failure to follow these rules may result in a fine from the carrier or discontinuation of the phone service. The rules are modeled after the Federal Communications Commission tariffs regulating phone companies. See 48 C.F.R. § 64.501.
The Business Extension Exemption
The business extension exemption does not require consent. However, there are very specific conditions that must be met to qualify for this exemption. The business extension exemption can only be claimed for monitoring performed by certain types of equipment, and the recording must occur in the ordinary course of business. The exemption covers any recording done by any telephone or telegraph instrument, equipment or facility, or any component thereof
furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of business and being used in the ordinary course of business, or
furnished by such subscriber or user for connection to the facilities of such service and used in the ordinary course of its business.
In sum, to rely on this exemption, two prerequisites must be met:
either the phone company or the subscriber furnished the intercepting telephone or telegraph instrument, equipment, facility, or component, and
the equipment was used in the ordinary course of business.
Pascale v. Carolina Freight Carriers Corp., 898 F. Supp. 276, 278-79 (D.N.J. 1995). In Pascale, voice-activated tape recorders attached to the telephone busboard to monitor employees' calls for evidence regarding thefts did not fall within the business extension exemption because recorders are not excepted telephone equipment. Similarly, most of the federal circuit courts of appeals addressing the issue have held that a recorder acquired by a third party and attached to a telephone line does not fall within the business extension exemption.
An extension phone listened to by an employer does fall within the business extension exemption. The distinction is made because extension phone eavesdropping has less potential for violating the privacy of the targeted and innocent third parties. See T.B. Proprietary Corp. v. Sposato Builders, Inc., 1996 U.S. Dist. LEXIS 7464, 1996 WL 290036 (E.D. Pa. May 31, 1996).
In terms of the business extension exemption, a personal call may not be intercepted in the ordinary course of business except to the extent necessary to guard against unauthorized use of the telephone, or to determine whether a call is personal or not. In determining the latter, the listener would be obliged to cease listening as soon as a determination is made that the call is personal. See Watkins v. L.M. Berry Co., 704 F.2d 577 (11th Cir. 1983).
If covert monitoring is to take place, it must be justified by a valid business purpose, or at least shown to be undertaken normally. See Berry v. Funk, 146 F. 3d 1003 (D.C. Cir. 1998). The Court of Appeals for the D.C. Circuit rejected the 11th Circuit view that any call whose subject is business, if monitored, in necessarily done in the ordinary course of business, even if not authorized by a company monitoring policy and not known to employees.
Many state statutes resemble the federal wiretapping statute. See e.g., D.C. Code Ann. § 23-541 et seq. However, other states may impose greater restrictions. See, e.g., Md. Code Ann. § 10-402. For employees in a union, the National Labor Relations Board (NLRB) has held that employee monitoring is a mandatory subject of bargaining.
As can be seen from the above, the business extension exemption is difficult to administer and leaves the employer open to charges of illegally monitoring personal calls. The preferred route is recording calls with the necessary consent in place.
The following steps should be taken by any employer who monitors employee phone calls:
Identify within the organization the reason for monitoring calls. Acceptable reasons may include making sure your employees are handling calls properly, and obtaining tapes for training new employees.
Do not intercept personal calls. Monitoring must cease as soon as the personal nature of the call becomes apparent.
Provide a separate unmonitored phone line for personal calls. Advise employees to use this line when making personal calls.
Inform employees in writing about the policy of monitoring calls and the reason for doing so. Inform all new employees of the same.
Only allow authorized personnel to monitor the calls.
If recording of interstate calls occurs, both parties to the call must have notice of the recording.
Obtain a written acknowledgment and consent form from employees. The form should make it clear that while it is the employer's policy to not monitor personal calls, the employee who is charged with listening to a tape may overhear personal calls that are made on a taped line.
These suggestions were adapted from "Monitoring Employees' Telephone Calls: Is it Legal?," Georgia Employment Law Letter, Vol. 6, Issue 3 (Oct. 1993) (M. Lee Smith Publishers & Printers).
Q: What are the state laws on tape recording of conversations?
updated 2/21/13 CCR