Electronic Discovery: Beware of Employees Using Personal Email Accounts for Company Business

View the article as published in Law360 here.

On March 3, 2015, the front page of the New York Times detailed allegations about an employee who failed to ever obtain a work-issued email account, instead utilizing a personal account solely to conduct all business activity.

The employee at issue was not a low level worker or even a member of middle management. Rather, the employee at issue was former Secretary of State Hillary Clinton. During her tenure as Secretary of State, Mrs. Clinton did not have a government email address, and her staff took no actions to preserve her personal emails on government systems. Although Mrs. Clinton is not the first official to use personal email to conduct government business, federal officials claim such use should be limited to emergencies, primarily because the communications should be preserved for the National Archives.

This article provides a cautionary tale for private employers of all shapes and sizes for at least three reasons. First, companies should be concerned that, if their employees are using personal email to conduct business, those communications – and their attachments in particular – may not be secure or confidential. While most private employees are not involved in activity as sensitive as the Secretary of State, it is also highly unlikely that those individuals would be using encryption or other security measures. Therefore, employers could be at risk of third-parties intercepting or hacking delicate business information from personal emails.

Second, and relatedly, if companies were to choose to “crack down” on employees using personal email for fear of the above, they may expose themselves to HIPAA and other privacy law violations. It is entirely possible that, in an effort to monitor personal email usage, an employer could come across communications between an employee and his/her doctor and be accused of snooping. Accordingly, private employers must carefully consider the costs and benefits of observing personal email activity carried out at work.

Last, companies also must be concerned about email retention, but for different reasons. Some private employers face preservation requirements because of Federal and State rules and regulations. More generally, however, all companies should be concerned about retention because a failure to preserve information may give rise to allegations of spoliation in litigation. It is nearly impossible for a company to preserve an employee’s personal email account because the company typically has no control over the settings or usage of that account, both of which could increase the likelihood of a spoliation claim. Allegations of spoliation, if proven, can result in substantial sanctions to a company.

While it remains to be seen what, if anything, are the repercussions for Mrs. Clinton, private employers should beware of how their employees are using – and misusing – their personal email accounts to conduct business. Companies must be cognizant of the need to preserve and balance that need against the risk of being over-intrusive.