Company Email Policy -- Background

In the United States, the Electronic Communications Privacy Act governs unauthorized access to and disclosure of electronic mail messages. See 18 U.S.Code Sections 2501 et. seq. and 2701 et. seq.

While it is important to be familiar with ECPA, this law does not generally apply to limit the policies that an employer may adopt with regard to use of company email systems by employees and access to or disclosure of employee email, for several reasons.

• The wiretap statute allows the real time interception of messages by a company using equipment and procedures used in the ordinary course of its business. (This provision doesn't apply to access to stored email. And it may be qualified by other laws applicable to workplace monitoring.)
• Access to private email is permitted with the consent of the sender or recipient, and employers can often require that consent as a condition of employment.
• Access to private email is also permitted under specified circumstances that include protection of the security of the system and the rights of the system provider (which would often be the employer).
• The statute prohibits "unauthorized" access, but the employer is often in a position to grant authority to access, by defining the terms under which email and other electronic services are provided.
• Insofar as the employee sends messages as an agent of the employer, the employer, as the principal on whose behalf the message was sent, would have the authority to consent to access or disclosure.
• The special limitations on disclosure of private email, in ECPA, expressly apply only to those who provide electronic communications services to the public -- and an internal system provided by an employer to employees would not be so characterized.

Note that many states also have "wiretap" statutes that in general track the provisions of the federal act -- but that some states require the consent of ALL parties before interception of or access to an electronic communication.