Privacy Within the Virtual Workplace

Work In Progress, Privacy within the Virtual Workplace: The Entitlement of Employees to a

Virtual Private Zone and the "Balloon" Theory, Shlomit Yanisky Ravid, Prof. of Law, Yale Law School, ISP, Fellow

1

Privacy within the Virtual Workplace: The Entitlement of

Employees to a Virtual Private Zone and the "Balloon" Theory

Dr. Shlomit Yanisky-Ravid1

Abstract:

This paper addresses the question of whether employees should have a

right to privacy within the virtual sphere of their workplaces, both at the

workplace and while using employer-owned property, such as computers and

networks. I conclude that there are strong justifications for a paradigm in

which a sphere of privacy would be delineated within the virtual workplace,

providing employees protection from employer intrusiveness. In other words,

my main claim is that employees should have a private zone within the employer wired/digital/virtual premises, even when using corporate network

tools or accounts (i.e. Internet accounts) and even during working hours.

The reasonable expectation of privacy test implemented by the public

sector, when applied within a modern virtual workplace realm, (almost)

completely eliminates employees privacy rights. The same result of drained privacy rights has been diagnosed in the private sector by Professor Christine

Jolls, who found that non-governmental workers overwhelmingly lose their

rights when courts apply a test that examines explicit or implicit consent (all

employees agree to waive the right to privacy). Therefore, moving toward employees Consent policy would not change the result. The outcome is that employees (almost) totally lost their privacy rights within the virtual

workplaces.

Furthermore, the article argues that U.S. legal realm, stemming from

court decisions, which eventually distinguish between privacy within tangible

premises of the workplace versus virtual spheres, should be reconsidered and

refined. The traditional test as set forth by the Supreme Court in its 1987

OConnor v. Ortega decision, recognizing that employees tangible workspaces (such as a desk or cubicle or office) in a public office may be

deemed as private space, should be applied to todays virtual workspaces,

1 Professor of Law. Yale Law School, Information Society Project (ISP), Fellow, 2011-2013.

Fordham Law School, Visiting International Professor, 2012. Ono Academic, School of Law,

Israel. The Founder and the Head of the Shalom Comparative Legal Research Center, OAC.

Thanks to Prof. Jack Balkin, ISP and to Prof. Joel Reidenberg, Center on Law and Information

Policy (CLIP), Fordham Law. Special thanks to Ms. Elizabeth Ledkovsky for outstanding

research assistance.



2

extending the law so as to integrate it with the realities of the digital era. The

employee expectation test as well as other contract and tort theories likewise

should be either replaced or adjusted to this notion of virtual workplace

privacy zones.

Securing a private zone to U.S. employees, a concept adopted by several other legal regimes, is justified by a bundle of psychological theories

that can be concisely described as the balloon theory, describing the importance of a private sphere that constantly and permanently surrounds the

persona wherever one goes, including within the public domain and digital

spheres. Studies have shown that providing private zones fosters a sense of responsibility and accountability and, consequently, improves employee

productivity. This theory is consistent with court decisions out side the US

such, which found venues to secure employees privacy (i.e. the Israeli Isakov case).

Accordingly, I conclude that we should reconsider these tests in order

to secure a threshold of Private Zone within the virtual workplace. A new and needed policy may implement other new tests or make use of existing

tools, such as the Least Invasive Mean (the Proportionality Analysis).



3

Table of Contents

I. INTRODUCTION ........................................................................................................... 3 II. THE VIRTUAL SPHERE INHABITED BY EMPLOYEES ..................................................... 6 III. THE BALLOON THEORY ............................................................................................ 9 IV. THE LEGAL U.S. NORM OF PRIVACY IN WORKPLACE VIRTUAL SPHERES ............... 14 V. A DIFFERENT ATTITUDE: SECURING VIRTIAL PRIVATE ZONE .............................. 16 VI. ALTERNATIVE LEGAL TOOL: THE LEAST INVASIVE MEAN ..................................... 19 VII. RECOMMENDATIONS ............................................................................................. 21

A. Private Zones....................................................................................................... 22 B. The Least Invasive Mean .................................................................................... 22 C. Transparency ....................................................................................................... 22 D. Consent................................................................................................................ 23 E. Specific Purpose. ................................................................................................. 24

VI. Conclusion ............................................................................................................. 24

I. INTRODUCTION

The virtual domains, such as the Internet, blur the boundaries between

workplace property and private zones. Standard modes of communication

have changed dramatically. Todays employees have few, if any, viable

alternatives to communicating with the world without using the virtual space

(such as e-mail, websites, social networking/Facebook, Skype, and so on and

so forth). Many employees today carry the newest portable digital devices,

like mobile phones, tablets, and portable computers, wherever they go,

including to work. Denying or diminishing this virtual sphere can be equal to

and as drastic as forbidding a person from speaking, as these mechanisms are

the digital eras basic means of communication with others. Eventually,

nowadays, other alternatives are not "usable" and therefore, cannot be

considered as a "real" alternative (i.e. sending letter from work for private

purposes instead of an e-mail or text message).



4

Furthermore, employees who spend a tremendous portion of their

waking time at the workplace have no other practical option than to use their

employers virtual spheres. Dedication to a job or mere employment does not

justify loss of privacy.

A different perspective on the issue of employee privacy emerges from

multinational firms, and the new era of international commerce gives rise to

new considerations. American corporations, while working in and with

foreign firms located in different countries, might wrongfully assume that

American policy prevails. The result might be a breach of the local policy

regarding privacy in the workplace.

In Israel, for example, a recent Supreme Labor Court decision held that

there are four types of e-mail accounts within the workplace: Professional

Mailbox supplied by the employer for professional purposes under a

condition of informed written consent by employees that any private use is

forbidden (type A); Mixed Mailbox combined or hybrid accounts (type B);

Employer-Provided Personal Mailbox, provided by the employer for the

employees personal purposes only (type C), and Employees Private

Mailbox (i.e. employees Gmail account, which they use for private purposes)

(type D). The court held that employers may not read employees private

messages in any of these accounts, including type A, even when holding a

contract signed by the employee allowing the employer to do so.2 Therefore,

uniformity and harmonization of the norm, preferably by a new international

2 Labour Appeal no. 90/08 Tali Isakov-Inbar v. The Commissioner for Women Labour (February 8

th,

2011) [hereinafter Inbar v Commissioner].



5

instrument defining and allowing a private zone, might be a wise and

coherent resolution to the policy variations that currently exist around the

globe.

This Article argues that under the new U.S. legal realm employees

(almost) totally lost their privacy rights within the virtual workplaces. This

Article not only argues the case for a more balanced approach to employee

privacy, but it also suggests a new desirable model to be adopted by

policymakers. Inter alia, this solution should be part of the current

governmental discourse about privacy protection within the workplace. It

concludes with several suggestions, including adding hard law attributes to the

proposed instruments, toward effective implementation and genuine

progression of attitudes toward workplace privacy in this global, digital age.

The first part of the article describes the virtual sphere inhibited by

employers. The following part discusses psychological perspectives of privacy

within the workplace. The psychological discourse further refines the

distinction between tangible and virtual workplaces. The theories can be

concisely described as the balloon theory, describing the importance of a

private sphere that constantly and permanently surrounds the persona

wherever one goes, including within the public domain, the digital spheres and

the employers kingdom". The next part describes briefly the American legal

norm, whereas the following part introduces a different attitude from a

different legal system (Israel). The last parts conclude with recommendation

of alternative principles.



6

We start from explanations and demonstrations of violations of

employees privacy within the virtual spheres.

II. THE VIRTUAL SPHERE INHABITED BY EMPLOYEES

In the digital era, there is tremendous potential for employees use of

virtual spheres to put individuals at risk of compromising their own privacy by

exposing themselves to present of future employer. The most common

violation of employee privacy is employer reading of employees private e-

mails correspondence and employers tracking private information posted

about the employees on web sites, even though the discussion of the privacy

within the virtual spheres is broader and can embrace many more examples.

For example, employers can intervene in employees private means of

communication by reading private text messages in mobile phone and other

devices, by tracking on-line activity, through surveillance of web postings (i.e.

on Facebook), by tracking a persons location using GPS or voluntary social

media check-ins, and so on and so forth.

Snchez Abril, Levine and Del Riego described three ways in which

employers are actively screening on-line activities of employees: (1) monitoring and

surveillance of employee social media profiles, (2) evaluation of applicants social

media profiles and online speech in the hiring process, and (3) limiting employees



7

off-duty online activities.3 In the twenty-first century, both employees and employers

use the Internet and, more specifically, social media as substantial tools relative to

employment. Employees use this tool while seeking work, whereas the employers

rely on social media while searching for candidates and gathering information about

existing and potential employees. Businesses monitor sites like Facebook and Twitter

in search of information that may provide insight about prospective hires, while

individuals can learn more about what it is like to work at a particular organization.4

In the famous case of City of Ontario v. Quon, the U.S. Supreme Court held that an

employer did not violate the Fourth Amendment by reading private text messages,

even if the employee had a reasonable expectation of privacy.5 Writing that the Court

must proceed with care when considering the whole concept of privacy expectations

in communications made on electronic equipment owned by ... a[n]... employer,

Justice Kennedy revealed ambivalence toward the Courts present reasonable

3 Patricia Snchez Abril, Avner Levin and Alissa Del Riego, Blurred Boundaries: Social Media

Privacy and the Twenty-First-Century Employee, 49 AM. BUS. L.J. 63, 66-67 (2012), available at:

http://onlinelibrary.wiley.com/store/10.1111/j.1744-

1714.2011.01127.x/asset/ablj1127.pdf;jsessionid=51714F857C44696F55ABE310ED90FAFB.d03t02?

v=1&t=hdxrdur0&s=ec0aff2696bd567a3122b8b3bd2163fe84e3257.

4 Id. at 69. Jeffrey Rosen, The Right to Be Forgotten, 64 STAN. L. REV. ONLINE 88 (Feb. 13, 2012),

available at http://www.stanfordlawreview.org/sites/default/files/online/topics/64-SLRO-88.pdf. See

also Laura Lagone, The Right To Be Forgotten: A Comparative Analysis (December 7, 2012), available

at SSRN: http://ssrn.com/abstract=2229361.

5 City of Ontario v. Quon, 30 S. Ct. 2619 (2010) (An employers monitoring and reading of an

employees personal text messages was justified by legitimate employer interests, even though the

employee may have had a reasonable expectation of privacy).



8

expectations of privacy test, articulated in a 1987 decision.6 The narrow opinion was

carefully worded, however, expressly describing the Courts wariness of making too

early a pronouncement about the privacy levels that individuals may reasonably

expect with regard to text messages or similar technologies, acknowledging that both

science and society are evolving very rapidly in this realm.7

Indeed, digital technology has revolutionized the vehicles of social interaction.

Future generations of employees, such as students, are cognizant of their reputational

vulnerability on digital media, yet are not willing to sacrifice Internet participation to

segregate their multiple life performances. Lacking the technological or legal ability

to shield certain aspects of their lives that might once have been exclusively private,

Millennials rely on others, including employers, to refrain from judging them across

contexts. In other words, despite granting employers access to information about their

private lives by exposing themselves online, respondents expect that work life and

private life should be generally segregatedand that actions in one domain should

not affect the other.8 Furthermore, portable electronic devices are now pervasive and

increasingly dominate everyones life. 9 Thus, some people who are aware of the

6 Id. at 2628-9. See O'Connor v. Ortega, 480 U.S. 709, 107 S. Ct. 1492, 94 L. Ed. 2d 714 (1987).

7 Id. at 2629.

8 Abril et al, supra note 3, at 65-66 (empirical data reveals that new employees stated expectations of

privacy appear to be somewhat paradoxical: employee respondents generally want privacy from

unintended employer eyes, and yet they share a significant amount of personal information online, fully

knowing it could become available to employers and others.)

9 Michael Z. Green, Against Employer Dumpster-Diving for E-Mail 64 S.C. L. REV. 323 (2012).

(argues that the rise to ubiquity of portable electronic devices (Blackberries, i-phones, i-pads,,

Androids, etc.) that blur the workspace with private spaces and blend work-time and private-time, calls



9

potential outcomes of a possible violation of their privacy pay a price, avoiding any

kind of Internet expression, becoming virtual cripples, choosing to stay behind as

current popular means of communication advance.

The question of whether employers common practice of tracking

employees private information with the virtual sphere is desirable can be

discussed from several points of view. The following section will focus on the

psychological need for privacy.

III. THE BALLOON THEORY

The abundant diversity of Internet/virtual tools provides more than just new

means of expression. The pervasive use of the these virtual instruments, such as e-

mail, Facebook, Twitter, what sup, Skype, and so on and so forth, combined with the

growing popularity of these tools among future employees, reflect a new reality.

Access to culture, education, knowledge and human relationships are conducted

primarily by active and constant everyday use of these virtual instruments. The

virtual tools play an essential role in the definition of the person identity, self,

self-expression, and self-identification.10 This is the point where psychological

discourse meets the legal rules.

for a re-thinking of traditional distinctions and a new emphasis, not on employees reasonable

expectations, but, rather, employers reasonableness in monitoring workers). See also United States v.

Ziegler, 456 F.3d 1138, 1144 (9th

Cir. 2006) (withdrawn on rehearing).

10 Id, at 2630.



10

Works about intrinsic motivation, from the psychological perspective, reveal

that privacy is a notion perceived entirely in a persons consciousness, and not in the

external world.11

The virtual spheres influence this consciousness, as related to

privacy, because it does not depend on or stem from tangible assets or physical

reality. In other words, privacy actually exists within our mind and soul. Privacy is

the way we perceive privacy. This insight leads to the conclusion that differentiating

between tangible and virtual spheres in their legitimate influence on privacy rights

discourse or expectation to privacy may be misleading.

Perceiving the consciousness as the intermediary between the cause of

violated privacy and the psychological outcomes thereof justifies the interconnection,

as has been made in the legal literature, between the right to privacy (including within

virtual sphere) and important values embedded in psychological concepts such as

freedom, dignity, autonomy of the persona, selfhood and human relation.12

Scholars and jurists have suggested many definitions to privacy without

having settled on any one as the right one.13

I hold the notion that from a

psychological/personhood perspective, privacy is the personal information and

11

Mihaly Csikszentmihalyi, Introduction, in OPTIMAL EXPERIENCE: PSYCHOLOGICAL STUDIES OF

FLOW IN CONSCIOUSNESS 10, 17 (Mihaly Csikszentmihalyi, Isabella Selega Csikszentmihalyi, eds,

Cambridge University Press, 1998). (Consciousness is the information system that could differentiate

among variety of stimuli that could choose certain stimuli and focus selectively on them and that could

store and retrieve the information is a usable way).

12 Daniel J. veve, Marc Rotenberg & Paul M. Schwartz, PRIVACY, INFORMATION AND TECHNOLOGY

40 (Aspen Publishers, 2006).

13 The most famous one is the right to be left alone. Samuel D. Warren and Louis D. Brandeis, The

Right to Privacy, Harvard Law Rev. (2890).



11

emotions that remain personal, when the person is exposed in public. It can also be

considered the ability of individuals to differentiate themselves or information about

themselves and thereby reveal themselves selectively to others. We refer to private

issues as information that is considered emotionally or personally sensitive or

inherently important or special.14

The levels, boundaries, or content of what is

considered private differ among situations, cultures and individuals, but share basic

common themes. One of them is the wish to remain unnoticed or unidentified in the

public realm (anonymity).15

In contrast to one of Professor Jed Rubenfelds main claims that privacy exists

within a private sphere,16

I suggest that the real meaning of privacy does not exist

when there are no others around, as the meaning of privacy and the need to privacy is

established when other people may be perceived as invading into this conceptual

privacy sphere. It can occur by physical invasion, such as seizure, scrutiny or rape,

but most of the time it happens by others finding personal information (surveillance)

or asking personal questions (investigation). Privacy, then, is the outcome of a

persons wish to withhold from others certain knowledge as to his past, present or

future. The wish for privacy is the desire to be an enigma to others or, more

generally, the desire to control others perceptions and beliefs by monitoring the

exposed information about ones self.17

14

Solove et al, supra note 12, at 39-42 (different definitions of privacy).

15 Jed Rubenfeld, Anonymity and the digital Revolution, (publication pending, 2013)

16 Id,

17 Sidney M. Jourard, Some Psychological Aspects of Privacy, DUKE LAW AND CONTEMP. PROBS. 307

(1966).



12

This sphere of privacy consists of our perception about information and

emotions can be analogized to the concept of an intangible balloon that always

accompanies a person wherever she or he goes within the public domain or when

perceiving an encounter with other people or actually interacting with other people.

The size of the balloon differs according to the interaction. When we are with

family and friends we consciously shrink the balloon and share part of it with them.

When we are with foreigners or employers we need to save the balloon in order to

preserve our personal sovereignty. The person may choose the time, place, and the

level of disclosures of personal information, experience and emotions as well as the

company before whom such disclosures are made. The state of privacy is related to

the act of concealment.18

The reality of employees staying at the premises of

employment and using the employers tools both tangible tools such as computers

and virtual ones such as Internet accounts is a classic example of the balloon theory

in action, where the need to protect privacy is generated by a situation or encounter.

The persons differ from one situation to the other.19

Different sets of social norms

control distinct social settings. Thus, among friends and family, one acts according

to one set of social behaviors, whereas the same behavior is not acceptable in a

different setting and subject to sanction for visible deviation from patterned role

behavior.20

Drinking with friends or at a festive celebration is welcome, unlike

18

Id.

19 Shlomit Yanisky Ravid, Will the Wolf Dwell with the Lamb? Psychological Relationships in the

Workplace, in Liber Amicorum Elisheva Barak-Ussoskin (Guy Davidov and Guy Mundlak, eds.,

2012).

20 Jourard, supra note 16, at 308 (physical sickness and mental disease may be the outcome of role-

conformity).



13

drinking at the workplace or while driving. Today, the Internet has blurred the

borders between social contexts and mixed the different situations, creating a blend,

and sometimes a clash, of rights and wrongs. It is ok to take pictures with friends at a

costume party, but the same picture, once posted on the web, can cause a persons

dismissal. A person should have adequate freedom to build the self and choose

how that self will be represented. Likewise, the concept of privacy as limited

accessibility enables us to identify when loss of privacy occurs to one self.21

The experience of psychotherapists has shown that people maintain

themselves in physical health as well as psychological and spiritual well being when

they have private space some locus that is inviolable by others, except by the

persons express invitation.22 People disclose themselves to those that they trust, and

it is reasonable to expect trust to be built before the disclosure. Nevertheless,

electronic communication is different than traditional communication. Writing to a

computer or keypad tends to seem impersonal. Consequently, messages are

depersonalized, often resulting in stronger or more uninhibited text and more

assertiveness in return.23

In other words, todays electronically transmitted

communications are more likely than more traditional forms to be even more personal

and, as perceived by the creator, private in nature. Yet, despite documented adverse

21

Solove at al, supra note 12, at 40.

22 Jourard, supra note 17, at 310.

23 Sara Kiesler, Jane Siegel, and Timothy W. McGuire, Social Psychological Aspects of Computer-

Mediated Communication, AM. PSYCHOLOGIST 1125 (1984), 9 (the use of electronic communication

brings new social psychological norms of behavior).



14

effects from psychological and business perspectives, employee monitoring and

surveillance remain pervasive in the business world.24

Having a private sphere in the workplace might bring better results from the

employers point of view. In place of suspicion and mistrust, privacy and trust might

encourage employee motivation, followed by higher productivity levels, an improved

sense of responsibility toward work, an increased likelihood of employees taking

initiative and even better worker health.25

IV. THE LEGAL U.S. NORM OF PRIVACY IN WORKPLACE VIRTUAL

SPHERES

The current U.S. legal policy regarding privacy at the workplace reveals that

employees are often exposed to trespass by their employers, via unwelcome reading

of private mails or text messages in mobile phones and other devices, tracking their

webs activities, surveillance of web postings (i.e. on Facebook), tracking of employee

location, and so on and so forth.

The fact is, courts and lawmakers around the world are having trouble

conceptualizing privacy in new technologies.26

The prevailing attitude in the U.S. is

that the digital sphere of the employers (i.e. e-mail, internet accounts) is not protected

24

Abril et al, supra note 3, at 69.

25 Id. See also Jourard, supra note 17, at 308.

26 Abril et al, supra note 3, at 64 (the shared unease among lawmakers around the world suggests that

they need more information to gauge privacy and behavioral norms for new technologies).



15

from employer intrusiveness into the employees privacy.27 The law differentiates

between employees who work in governmental institutions and those who work in the

private sector, because the U.S. Constitution (specifically with respect to privacy, its

Fourth Amendment) limits the government, including in its capacity as an

employer).28

That distinction notwithstanding, the policy permitting employer

intrusion upon employee electronic communication and digital tool usage is prevalent

within both sectors. Public Sector employer monitoring of employee usage of

employer Internet tools and other communication devices is subject to a test of the

employees reasonable expectation of privacy,29 whereas private sectors workers are

governed mainly by explicit or implicit contracts.30

The prevailing attitude in the U.S.

27

Privacy Rights Clearinghouse, Fact Sheet 7: Workplace Privacy and Employee Monitoring,

available at https://www.privacyrights.org/fs/fs7-work.htm#4a (last visited March 7, 2013).

28 Paul M. Secunda, Privatizing Workplace Privacy, 88 NOTRE DAME L. REV. 277 (2012) (offers a

clear delineation of the differences between the private and the public employment sectors, arguing that

there are sound public policy interests in providing greater protection for government workers. Absent

government intervention or involvement as an employer, the law affecting private employers and their

employees is based mainly in tort, and it is evolving).

29 Articulated by Justice Harlan (there is a twofold requirement, first that a person have exhibited an

actual (subjective) expectation of privacy and, second, that the expectation be one that society is

prepared to recognize as reasonable.), concurring in Katz v. U.S., 389 U.S. 347, 360 (1967). But the

Court later held that privacy rights do not rise or fall with the Katz formulation, noting that common

law understandings of trespass, including the particular concern of government trespass upon the areas

(persons, houses, papers, and effects) was not repudiated by Katz, but rather supplemented by the

ruling. U.S. v. Jones, 132 S. Ct. 945, 950 (2012).

30 Christine Jolls, Privacy and Consent Over Time: The Role of Agreement in Fourth Amendment

Analysis, available at



16

workplace and courts is that e-mail privacy (and, less explicitly, Internet usage in

general) as well as tracking of private information on employee Internet posts is not

protected, whether originating in the physical workplace or from the virtual sphere,

especially when employees use employer computers and networks. Courts have held

that employees cannot have a reasonable expectation of privacy related to e-mail or

other electronic communications, and federal law is very limited and generally leans

away from affording employee privacy, especially when it comes to the specific issue

of e-mail. Courts have held that employees cannot have a reasonable expectation of

privacy related to e-mail or other electronic communications. 31

Physical instruments and spaces have traditionally defined privacy law in the

United States. The reasonable expectation of privacy analysis, endemic to privacy

jurisprudence, is firmly rooted in the experience of physical space and its surrounding

normative circumstances. Policy makers have thus far failed to adjust privacy norms

to the new reality that most workers function within a virtual sphere in a way that

individual privacy will be at least partially protected.

V. A DIFFERENT ATTITUDE: SECURING VIRTIAL PRIVATE ZONE

Israels National Labor Court combined two appeals concerning the

admissibility of email correspondence as evidence.32

In the first, Panaya Ltd., a

software company, dismissed Tali Isakov-Inbar, an employee of the company. Inbar

http://www.law.yale.edu/documents/pdf/Alumni_Affairs/Jolls_RationalityandConsentinPrivacyLaw_1-

21-10.pdf (last visited Mar. 7, 2012).

31 Lisa Smith-Butler, Workplace Privacy: Well Be Watching You, 35 OHIO N.U. L. REV. 53 (2009).

32 Isakov v. Commissioner, supra note 2.



17

sued her former employer, claiming that she was unlawfully dismissed due to her

pregnancy. Panaya contended that the dismissal notice was issued to Isakov prior to

her pregnancy. To support its claim, Panaya submitted copies of Inbar's e-mails sent

from her company-provided mailbox. These emails contained Inbar's CV and were

sent to several employment agencies. Inbar argued that, although Panaya provided

the mailbox to her, use of the mailbox for personal purposes was permitted. In the

second case, Ron Fisher was a senior manager, employed for over 20 years by Afikei

Mayim, an agricultural cooperative that supplies water in the Beit Shean Valley. The

employer suspected Fisher of using its trade secrets to run a competing business and

claimed that such activity caused the company significant financial harm. The

employer fired Fisher and supported its action through e-mails from Fishers private

e-mail account and from paper copies of the e-mails, which Fisher had thrown into his

garbage can at work. In Inbar's case, the Regional Labor Court ruled that there was

no violation of the Privacy or Eavesdropping laws. However, the Israeli National

Labor Court, by a unanimous decision, ruled that in both cases the employers violated

the employees privacy.33

The Court distinguished four different types of employee mailboxes based on the

type of correspondence generally exchanged in such mailboxes and whether the

mailbox was provided by the employer, establishing different rules for each type of

mailbox. It should be noted that those specific rules are in addition to the general

standards detailed above, which apply to all monitoring activity.

33

Id. English version interpretation and recommendation: Landmark Case Establishes Guidelines For

Monitoring Employee Online activity, Meitar, available at: http://www.meitar.com/177013



18

Under this ruling, a Professional Employer Mailbox(type A) is a mailbox

provided by the employer for professional purposes only and the employee is

restricted from using it for his or her private needs. The employer is required to

inform the employee of the restrictions on use and of the employer's ability to

Monitor the email correspondence exchanged in such mailbox. The employer is

required to obtain general consent for its e-mail policy in order to monitor even

professional correspondence, but is not required to obtain consent for each individual

instance of monitoring of professional correspondence in this type of mailbox. The

most important rule is related to personal correspondence in the Professional Mailbox:

the Court did not accept an expectation of privacy test, and held that, although the

employee is not authorized to engage in private correspondence, the employer is

nevertheless prevented from reviewing the content of such correspondence without

the employees specific consent. Moreover, in accordance with the High-Tech Sector

Agreement from 2008 on Email Monitoring and Computer Use, which was referred to

on several occasions in the Inbar opinion, the employer may be required to notify the

employee that they have a right to be present during such review of email.

A Mixed Mailbox" (type B) is a mailbox provided by the employer for both

professional and personal purposes. 34

Reviewing (i.e., actually inspecting and reading

the content of the correspondence), as opposed to merely monitoring, personal

correspondence in the Mixed Mailbox requires the employee's specific consent in

each instance.

34

In our view, in most cases these days, employers will be providing such a mixed mailbox, as e-mail

is used for both professional and personal purposes.



19

On the other hand, the "Employer-Provided Personal Mailbox" (type C) is

provided by the employer for the employees personal purposes only. Any type of

Monitoring of the Personal Mailbox (whether actually inspecting the content of e-

mails or just monitoring subject lines of the e-mails or other parameters, such as size

of the e-mails), regardless of the type of correspondence (personal or professional)

requires the employees specific consent in each instance.

Finally, an Employees Private Mailbox is a mailbox privately held by the

employee (such as Hotmail, Gmail, Yahoo, etc.), which may be accessed via the

workplaces Internet connection (Type D). All monitoring of the Private Mailbox by

the employer is prohibited without a court order, even in when the employee gives

general or specific consent. Hence the court has adopted the private zone within a

digital employment sphere wherein employees are entitled to private space,

respecting individual dignity and providing workers the opportunity to be party to any

inspection and to (at least partially) control it.35

VI. ALTERNATIVE LEGAL TOOL: THE LEAST INVASIVE MEAN

The reasonable expectation of privacy test implemented by the

public sector, when applied within a modern virtual workplace realm, (almost)

completely eliminates employees privacy rights. The same result of drained

privacy rights has been diagnosed in the private sector by Professor Christine

Jolls, who found that non-governmental workers overwhelmingly lose their

rights when courts apply a test that examines explicit or implicit consent (all

35

Id.



20

employees agree to waive the right to privacy). 36 Therefore, moving toward

employees Consent policy would not change the result. The outcome is

that employees (almost) totally lost their privacy rights within the virtual

workplaces.

Securing a private zone to U.S. employees, which have been adopted by

several other legal regimes, is justified by a bundle of psychological theories that can

be concisely described as the balloon theory. Following the conclusion that

employees have the right for secured private zone, we should rethink about the

existing tests and consider replacing them with alternative tools that better serve this

purpose. Without excluding other alternative tools, the article brings the Least

Restrictive Mean test usually considers as part of the proportionality analysis, as an

example for an alternative legal tool.37

Proportionality analysis has widely diffused over the past fifty years. It is

today an overarching principle of constitutional adjudication, the preferred procedure

for managing certain disputes. Although other modes of rights adjudication were

available and could have been chosen and developed, proportionality analysis has

emerged as a multi-purpose, best-practice, standard.38

36

Jolls, supra note 30.

37 Aharon Barak, Proportionality: Proportionality: Constitutional Rights and their Limitations

(Cambridge Studies in Constitutional Law, 2011) (Aharon Barak explores its four components of proportionality: proper purpose, rational connection, necessity and proportionality stricto sensu) 38

Alec Stone Sweet and Jud Mathews. "Proportionality Balancing and Global Constitutionalism"

Columbia Journal of Transnational Law 47, 74-75 (2008) (In the authors view, proportionality-based

rights adjudication now constitutes one of the defining features of global constitutionalism, if global

constitutionalism can be said to exist at all).



21

The core of necessity analysis is the deployment of a least restricted Means

(LRM) test: the judge ensures that the measure does not curtail the right any more

than is necessary for the other side (government) to achieve its stated goals.39

When

applied to workplaces, either public or private, I suggest using the Least Invasive

Mean as the applicable test for maintaining Virtual Privacy (as well as other sorts) at

the workplace. The idea behind this principle is simple. When there are two means to

achieve legitimate information the permissible mean would be the less invasive, less

restrictive, less offensive one. The mean that better protects the right will be the

right one. I conclude with a recommendation to implement this principle within the

context discussed in this study.

VII. RECOMMENDATIONS

The conclusions, follow from the alternative case of Isakov discussed above, and

can be implemented in a wide variety of cases in the field of employees privacy

within the virtual spheres. 40

A number of principles emerge that make sense for a 21st

century workplace environment that encourages employee engagement and respects

privacy. The components described below do not stand alone. Their efficiency

depends on combining them together into one coherent solution.

39

Id. 40

Isakov, supra note 2



22

A. Private Zones

The importance of privacy rights does not skip over employees at the

workplace. It is time to reconsider standard privacy policy within the workplace and

to secure private zones to employees using the virtual sphere of the workplace.

B. The Least Invasive Mean

The rule of proportionality can be implemented in this issue of employees

privacy efficiently.

The employers should limit incursion of employees private zone to extreme

circumstances in which severe immediate damage may be caused to the employers

legitimate interests (such as criminal harmful activity by the employee). Violation of

employees privacy may only take place if it is proportional, measured in light of the

potential harm to the employer, and only to the extent there are no other, less invasive

alternatives to achieve the same result. Employers should use the least invasive

technology available. For example: automated monitoring or blocking software

would be less invasive than human monitoring of e-mail.41

C. Transparency

Employers should have a clear, written and detailed internet, e-mail and computer

usage policy. The employee should be aware of the policy and its outcomes and must

41




23

explicitly agrees to it. The policy should be attached to individual employment

agreements and approved by the employee signature. If the company has an

employee handbook, the policy should be included. 42

D. Consent

Employers should obtain employees informed, willing, written and signed

consent to any violating of employees privacy. In order to meet the informed

consent requirement, the employer must disclose to employee, in writing, the matters

set forth in the policy, such as: the nature of any monitoring tools, the purpose of

monitoring, and the period for which monitored data will be retained.

There are two types of employees consent: (i) general consent to e-mail policy; and

(ii) specific consent to each instance of monitoring. . 43

In case of privacy, in order to

secure the necessary private zone, we recommend to adopt the second specific rule

of specific consent

The consent policy bears risks, as employees would probably sign any

agreement in order to be employed.44

Therefore, I suggest considering informed and

explicit consent only when the broader policy includes more components for securing

a minimum of privacy, which will not be subject to contractual waiver. 45

42

Isakov, supra note 2 43

Isakov, supra note 2 44

Jolls, supra note 30. 45




24

E. Specific Purpose.

Surveillance after any employees private information must be founded on a

specific, clear and legitimate purpose, and the employer may not use the information

gathered from the monitoring for a purpose other than the purpose for which the

monitoring was performed. 46

VI. Conclusion One of the most important conclusions is the fact that the mere existence of

technical tools, capable of tracing, surveillance and tracking of personal data, does not

mean that using them to violate privacy is a permissible norm. There is a gap between

what can technically be done and what should be done. Bringing American policy in

line with the realities of digital age society will benefit employers, by fostering trust,

encouraging workplace creativity and improving productivity.

46


Privacy Within the Virtual Workplace

Documents

Transcript of Privacy Within the Virtual Workplace