2012 Formal Ethics Opinion 5

Reviewing Employee’s Email Communications with Counsel Using Employer’s Business Email System

Opinion rules that a lawyer representing an employer must evaluate whether email messages an employee sent to and received from the employee’s lawyer using the employer’s business email system are protected by the attorney-client privilege and, if so, decline to review or use the messages unless a court determines that the messages are not privileged.

Inquiry #1:

Attorney A represents Employer on various matters including legal disputes with its employees. Employer has a business email system that is available to all employees and that is used for transacting Employer’s business. Employer’s personnel policy states that Employer may monitor emails sent or received using Employer’s email system, specifically including email sent or received on any employee’s business email account.

Employee is in a legal dispute with Employer. Employee has used his business email account on Employer’s email system to send emails to his lawyer and he has received emails from his lawyer on his business email account on Employer’s email system.

Does a lawyer have a duty to avoid communicating with a client over the email system of the client’s employer?

Opinion #1:

A lawyer must avoid communications with a client over an employer’s email system if there is a risk that the employer will find and read the emails. The duty of confidentiality, set forth in Rule 1.6 of the Rules of Professional Conduct, requires a lawyer “to act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer….” Rule 1.6, cmt. [17]. Comment [18] to the rule adds that, when transmitting confidential client information, a lawyer must take “reasonable precautions to prevent the information from coming into the hands of unintended recipients.”

Where a lawyer knows or reasonably should know that a client is using an employer’s email system to communicate with the lawyer, the lawyer should seek to avoid the use of the employer’s system regardless of whether the legal matter is unrelated to the client’s employment and regardless of whether there is a legal argument that use of the system does not waive the attorney-client privilege. The duty of confidentiality is more expansive than the attorney-client privilege. It requires a lawyer to protect confidential information from disclosure to “any unintended recipient.” The lawyer should explore with the client alternative methods of communicating including use of the employee’s personal email system, telephone, and texting.

Inquiry #2:

May Attorney A tell Employer to review the records for its email system to retrieve any personal email messages sent or received by Employee on Employee’s business email account?

Opinion #2:

Attorney A should research the law relating to the recovery, identification and production of employee email, including the law on attorney-client privilege, and advise Employer as to its rights and responsibilities under the law. See Rule 4.4(a)(“In representing a client, a lawyer shall not...use methods of obtaining evidence that violate the legal rights of…a person.”)

Inquiry #3:

Employer reviews the records of its email system and discovers email messages between Employee and his lawyer. The emails from the lawyer contain the statement “Attorney-Client Confidential Communication.” Employer informs Attorney A that it has copies of these messages.

May Attorney A review the email messages?

Opinion #3:

In the absence of a Rule of Professional Conduct or prior ethics opinion on point, the Ethics Committee was guided by the case law on the application of the attorney-client privilege to communications between a client and his lawyer over an employer’s email system. The attorney-client privilege is fundamental to the client-lawyer relationship and the trust that underpins that relationship. As such, the bar must protect the privilege and seek to limit incursions upon the privilege that are not warranted by law.

Case law from many jurisdictions,¹ including North Carolina,² indicates that whether the privilege applies to email exchanges between an employee and his lawyer that occurred over an employer’s email system depends upon whether the employee had a reasonable expectation of privacy in the email communications. This in turn requires an investigation into a myriad of factors, including whether the employer has a clear, unambiguous policy regarding email usage and monitoring; whether that policy is effectively communicated to employees; whether the policy is adhered to by the employer; whether third parties have access to the employee’s email account on the employer’s system; when/where the communication occurred (at home or the office; during work or leisure hours); and whether the employee took affirmative steps to preserve the privacy of the communication. See, e.g., In re Asia Global Crossing, Ltd., 322 B.R. 247, 258 (S.D.N.Y. 2005)(in considering whether employee has objectively reasonable expectation of privacy in emails sent to the employee’s attorney over the employer’s computer systems, court should consider (1) does the corporation maintain a policy banning personal or other objectionable use, (2) does the company monitor the use of the employee’s computer or email, (3) do third parties have a right of access to the computer or emails, and (4) did the corporation notify the employee, or was the employee aware, of the use and monitoring policies).

Therefore, whether Attorney A may read the email messages recovered by Employer will depend upon an analysis of the case law and the factors set forth therein to determine whether Employee had a reasonable expectation of privacy or, lacking that, waived the privilege when communicating with his lawyer using Employer’s email system. If Attorney A is able to conclude, confidently and in good faith, that the privilege was waived, he may read the emails and use them to represent his client. However, in deference to the bar’s interest in protecting the attorney-client privilege, Attorney A should err on the side of recognizing the privilege whenever an analysis of the facts and case law is inconclusive. If a matter is in litigation, Attorney A may seek the court’s determination of the waiver issue.

Inquiry #4:

Does Attorney A have to notify Employee’s lawyer that Employer has copies of the email messages?

Opinion #4:

No. Rule 4.4(b) is not applicable in this situation. The rule states that “[a] lawyer who receives a writing relating to the representation of the lawyer’s client and knows or reasonably should know that the writing was inadvertently sent shall promptly notify the sender.” Employee and his lawyer sent the email messages knowingly using Employer’s email system. Therefore, the email was not “inadvertently sent” and no duty to notify arises under this rule. See ABA Formal Opinion 11-460 (2011).

2009 FEO 1 (2010) can be distinguished. The opinion rules that a lawyer must notify the sender upon finding confidential information embedded in metadata transmitted in an electronic communication. The transmission of metadata, which is not disclosed on the face of an electronic document, is held to be inadvertent on the part of the sending lawyer, thus triggering a duty to notify for the receiving lawyer under Rule 4.4(b). However, in the instant situation, the substance of the communications between the employee and his lawyer are disclosed on the face of the emails and use of the employer’s system was intentional. Therefore, the emails were not “inadvertently sent.”

In the absence of a duty to notify, the fact that Employer has copies of the email messages is confidential client information that Attorney A may not disclose unless one of the exceptions to the duty of confidentiality applies or the client gives informed consent to disclosure. Rule 1.6(a). In the current situation, Rule 1.6(b)(1) only allows the lawyer to disclose confidential client information to comply with the law, a court order, or the discovery requirements under the Rules of Civil Procedure.

The ABA Standing Committee on Ethics and Professional Responsibility (the Standing Committee) addressed a similar inquiry in ABA Formal Opinion 11-460 (2011), and found that notification is only allowed with client consent in the absence of a law authorizing disclosure. As observed by the Standing Committee,

[I]f no law can reasonably be read as establishing a reporting obligation, then the decision whether to give notice must be made by the employer-client. Even when there is no clear notification obligation, it often will be in the employer-client's best interest to give notice and obtain a judicial ruling as to the admissibility of the employee's attorney-client communications before attempting to use them and, if possible, before the employer's lawyer reviews them. This course minimizes the risk of disqualification or other sanction if the court ultimately concludes that the opposing party's communications with counsel are privileged and inadmissible. The employer's lawyer must explain these and other implications of disclosure, and the available alternatives, as necessary to enable the employer to make an informed decision.

Inquiry #5:

Employee has a personal email account with a commercial email service (such as Gmail, Hotmail, or Road Runner) that is not a part of Employer’s business email system. However, the personal email account can be accessed via Employee’s office computer. The personal email account is password protected. Employer can access the email messages on this personal email account by changing the password to the account.

May Attorney A advise Employer to change the password to access Employee’s email messages on his personal email account?

Opinion #5:

No. To advise a client to change the password to a personal email account violates Rule 1.2(d), which prohibits a lawyer from counseling a client to engage in criminal or fraudulent conduct, and Rule 8.4(c), which prohibits a lawyer from engaging in conduct involving dishonesty, fraud, deceit, or misrepresentation. Again, obtaining a judicial ruling allowing Employer to access the email messages would authorize the Employer to proceed and avoid any professional misconduct by Attorney A.

Inquiry #6:

On its own initiative, Employer changes the password on Employee’s personal email account and gains access to emails on the account including email messages between Employee and his lawyer.

May Attorney A review the email messages? Should Attorney A notify Employee’s lawyer that Employer has copies of the email messages?

Opinion #6:

No. Attorney A may not review the email messages unless allowed to do so by court order. To hold otherwise would be to permit a lawyer to assist a client in fraudulent conduct in violation of Rule 1.2(d) and Rule 8.4(c).

Attorney A may not notify Employee’s lawyer that Employer has copies of the email messages unless he has the informed consent of Employer or if Attorney A believes that notification is reasonably necessary to comply with law or a court order. Rule 1.6(a) and (b)(1). As noted above, it may be in Employer’s best interest to obtain a judicial ruling on the admissibility of the email messages and this should be explained to Employer to obtain consent to disclose.

Inquiry #7:

Lawyers who are employed by government agencies that are subject to public records laws frequently are required to review emails of government employees to ascertain whether the emails are public records and must be produced pursuant to a public records request. Because all emails are subject to review to comply with the public records law, emails between a government employee and his lawyer would be subject to the same review. May a government lawyer participate in such a review?

Opinion #7:

Yes. The review is required by law and it is in the best interests of the government and the public that the review be performed by lawyers. However, if emails between a government employee and his lawyer are evaluated and held not to be public records, the government lawyer must further determine whether the attorney-client privilege for the communications was waived by the employee by the use of the government’s email system. See Opinion #2 above. If the lawyer determines that the privilege was not waived or the lawyer cannot confidently and in good faith make that determination, the lawyer should recognize the privilege and take steps to protect the communications from further disclosure or distribution unless authorized by court order.

Endnotes

1. The Ethics Committee is grateful to the North Carolina Bar Association Labor and Employment Law Section Council for the following list of relevant cases: Convertino v. US DOJ, 674 F. Supp. 2d 97 (D.D.C. 2009); Curto v. Medical World Comms. Inc., 2006 US Dist. LEXIS 29387 (EDNY 2006); Curto v. Medical World Comms. Inc., 2006 US Dist. LEXIS 29387 (EDNY 2006); Garrity v. John Hancock Mut. Life Ins. Co., No. 00-12143-RWZ, 2002 US Dist. LEXIS 8343 (D. Mass. May 7, 2002); Haynes v. Office of the Attorney General, 298 F.Supp.2d 1154 (D. Kan. 2003); Holmes v. Petrovich Dev. Co., LLC, 191 Cal. App.4th 1047, 119 Cal.Rptr.3d 878 (2011); Kaufman v. Sungard Inv. Sys., No. 05-CV-1236, 2006 US Dist. LEXIS 28149 (DNJ 2006) (unpub.); Leor Exploration & Prod’n LLC v. Aguiar, No. 09-60136-CIV, 2009 US Dist. LEXIS 87323 (SD Fla. Sept. 23, 2009); Leventhal v. Knapek, 266 F.3d 64 (2d Cir. 2001); Muick v. Glenayre Elecs., 280 F.3d 741 (7th Cir. 2002); Restuccia v. Burk Tech., 5 Mass.L.Rep. 712, 1996 Mass. Super. LEXIS 367 (Mass. Super. Ct. 1996); Scott v. Beth Israel Medical Center, Inc., 17 Misc.3d 934, 847 N.Y.S.2d 436 (NY Sup. Ct. 2007; Sims v. Lakeside School, No. CO6-1412RSM, 2007 US Dist. LEXIS 69568 (Sept. 20, 2007); Hygeson v. US Bancorp Equip. Fin’g, Inc., No. CV-03-467-ST, 2004 US Dist. LEXIS 18863 (D.Or. Sept. 15, 2004); United States v. Simons, 205 F.3d 392 (4th Cir. 2000).
2. Mason v. ILS Techs., LLC, No. 3:04-CV-139, 2008 US Dist. LEXIS 28905 (W.D.N.C. 2008) (attorney-client privilege was not waived where the employee testified that he did not know of the employer’s policy on monitoring of personal emails transmitted on the employer’s email system and employer failed to prove otherwise).