Monday, March 25, 2019
Don’t Trust Anyone in IT- Check it Out First
Elizabeth Frankhouser was the Executive Director of the Clearfield County Career & Technical Center. Frankhouser had a personal Dropbox account, which she used sometimes for business and sometimes for pleasure. What happens on Dropbox stays on Dropbox . . . unless your IT guy hates you and has your password. According to Frankhouser, she never accessed the "personal" material in her Dropbox account from the Career Center and never downloaded it to her work computer. While she was at work and on the Center's systems, she used Dropbox strictly for business.
Shortly after she was hired in 2015, Frankhouser's supervisor allegedly began sexually harassing her. Frankhouser refused his advances and complained to his boss. He then began making things difficult for Frankhouser at work, as she alleged in her federal court lawsuit.
At some point in 2016 or 2017, Frankhouser's computer started malfunctioning, and the IT administrator removed and replaced her old hard drive. Among other things, Frankhouser had all of her passwords stored on an Excel spreadsheet on her Career Center computer. After changing out her hard drives, the IT administrator allegedly took the old hard drive home and Frankhouser's "password" spreadsheet, allegedly logged into her Dropbox account using her log-in information, and found two "explicit" pictures of Frankhouser's boyfriend and some compromising pictures of Frankhouser at a party. The IT guy allegedly printed hard copies of the pictures and gave them to others at the Center and spread vicious untrue rumors about what else he found on her hard drive. Frankhouser was then terminated by the Center for allegedly having dirty pictures on her Career Center computer.
Frankhouser then sued for violation of her rights under the Fourth Amendment to the U.S. Constitution (the Career Center is a public-sector employer) and for invasion of privacy under the common law of Pennsylvania. The Career Center and the individual defendants filed a motion to dismiss the "cyber-claims." This week the federal judge allowed some of the claims in the lawsuit, including the "cyber-claims," to go forward. This is what the judge said about the cyber-claims in a nutshell: the Center policy against improper use of Center computers did apply to an employee's private cloud account or material that had never been accessed through the employer's system. Based on the allegations in the lawsuit, Frankhouser absolutely did have a reasonable expectation of privacy with respect to her personal Dropbox material. It was her own private account, it was password-protected, and Frankhouser had never accessed the pictures while on the Career Center system or downloaded them. The fact that she sometimes used Dropbox for work did not mean that she lost the right to keep her personal Dropbox stuff private.
Common Sense Counsel: Employers Don't Overreach. If you have a good internet usage policy, you should have the right to monitor employees' emails in your system, as well as their online activities while on your system. But that doesn't mean you have the right to go "fishing" in employees' private accounts. Make sure you really know the facts before you make an adverse employment decision you'll regret in cyber technologies.