Policy required document Information security
Electronic Communications and Acceptable Use Policy
An electronic communications policy tells employees what the company's email, messaging, internet, devices and accounts may be used for, states that the company may monitor and access them, and says what will happen to messages when an employee leaves or an investigation begins. No federal statute requires the document.
What makes it load-bearing is that the law asks what the employee reasonably expected, and the policy is the answer. The Supreme Court said so directly in City of Ontario v. Quon (2010): employer policies concerning communications will shape the reasonable expectations of their employees, especially to the extent that such policies are clearly communicated.
An employer that reads a departing employee's email during a misconduct investigation, with a distributed policy saying it may, is doing what the policy said; the same employer without the policy is defending a privacy claim.
The second reason is that states have started requiring the notice. New York's Civil Rights Law 52-c requires every private employer that monitors email, phone or internet use to give written notice at hiring, obtain a written or electronic acknowledgment, and post the notice, with civil penalties of $500, $1,000 and $3,000 for successive violations.
Connecticut and Delaware have older versions. The policy is also the practical basis for the two federal wiretap exceptions employers rely on, consent and the ordinary course of business, and it is where an employer explains that company systems are company property and will be searched, preserved and produced when a dispute arrives.
Obligation ledger
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| City of Ontario v. Quon 560 U.S. 746 (2010) | Any employer search of employee communications on employer systems | Employer policies concerning communications shape the reasonable expectations of employees, especially when clearly communicated. A search motivated by a legitimate work-related purpose and not excessive in scope was reasonable. The policy, communicated, is what makes the search defensible. | Implied |
| New York Civil Rights Law, electronic monitoring NY Civ. Rights Law 52-c | Any private employer in New York that monitors or intercepts telephone, email or internet use | Prior written notice to each employee at hiring, acknowledged in writing or electronically; the notice posted in a conspicuous place; the notice must say that telephone conversations, email and internet access may be subject to monitoring at any and all times and by any lawful means. Civil penalties of $500, $1,000 and $3,000 for the first, second and each subsequent offense. Legally required. | Mandatory |
| Electronic Communications Privacy Act, consent exception 18 U.S.C. 2511(2)(d) | Any interception of a wire or electronic communication | Interception is lawful where one party to the communication has given prior consent. A distributed, acknowledged policy is how employers establish that consent for company systems. | Implied |
| Stored Communications Act 18 U.S.C. 2701 | Access to stored electronic communications | Unauthorized access to a facility through which an electronic communication service is provided is an offense; access authorized by the provider of the service is excepted. The employer's own email system is its own service; personal accounts reached through a company device are not. | Implied |
Required sections
- Which systems and accounts the policy covers: email, chat, file storage, devices, network access, and company accounts on third-party services
- A statement that these are company property, that the employee has no expectation of privacy in them, and that the company may monitor, access, search, preserve and disclose their contents at any time (the New York notice language where staff are in New York)
- Permitted personal use, if any, and the rule that personal use does not create privacy
- Prohibited uses: harassment, discrimination, unlawful content, unlicensed software, circumventing security, forwarding confidential material to personal accounts
- Personal accounts and devices: that the company will not access personal social media or personal email except as law allows (see the social media policy), and what happens to company data on a personal device (see the remote work policy)
- Litigation hold: that employees must preserve communications when told to and must not delete them
- What happens at separation: accounts disabled, mailbox retained, forwarding rules, return of devices
- Security basics that belong here rather than in a separate policy for a small employer: passwords, multi-factor authentication, phishing reporting
- No retaliation for reporting misuse, and how to report it
What the examiner asks for
What changed
Change log.
Frameworks
Where this document is required.
Need a hand implementing it?
Find a Consultant for Electronic Communications and Acceptable Use Policy
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
Questions
What people ask.
Can we read an employee's email?
On company systems, with a distributed policy that says you may, and for a legitimate work reason, yes. Quon is the authority. Without the policy you are arguing about expectations after the fact; in New York without the notice you are also paying a penalty.
Does the policy let us read their personal Gmail if they logged in on a work laptop?
No. A personal account on a third-party service is not your system; accessing it is where Stored Communications Act claims come from. The policy should say the company does not access personal accounts, and should tell employees not to use them for work so the question never arises.
Our people are remote in three states. Which notice rule applies?
The employee's state. A remote employee in New York is covered by 52-c regardless of where the company sits. The policy carries the New York, Connecticut and Delaware language for the people in those states, and the same monitoring statement for everyone.
What is the litigation hold section for?
When a dispute starts, the company has a duty to preserve relevant messages. Employees who delete them, even routinely, create a spoliation problem that can decide the case. The policy tells them the duty exists before anyone needs it.