Many employers maintain policies that limit employee rights to privacy on company-owned devices, but due to a recent court decision, these may not always protect employers from invasion of privacy claims. On March 19, 2019, Judge Kim R. Gibson partially denied a public employer's motion to dismiss, permitting the plaintiff Elizabeth Frankhouser's claim for Fourth Amendment violations as well as her state law claim for invasion of privacy.

The plaintiff was an executive director for an educational facility (the defendant) in Pennsylvania. Her job required extensive work on her work-issued computer, and she used Dropbox often to store files. Dropbox is an application that allows people to store files on the cloud using a username and password. In the plaintiff's case, her Dropbox account was personal, but her employer allowed her to store work-related files on it. Thus, her Dropbox account contained both personal and private files.

The plaintiff's employer's IT administrator, Tim Walk, used Ms. Frankhouser's username and password to access her Dropbox (he knew she kept this information on a spreadsheet). He discovered some private photographs of the plaintiff's boyfriend which could be deemed explicit, and also of the plaintiff at parties. The superintendent of the facility was made aware of the photos, and Ms. Frankhouser was forced to resign, and subsequently filed the lawsuit.

Ultimately, the court determined that Ms. Frankhouser did, in fact, have a reasonable expectation of privacy with respect to her personal Dropbox material for the following reasons: (1) it was her own private account, (2) it was password-protected, and (3) plaintiff never accessed or downloaded the photographs while on the employer's system. As such, the court declined to dismiss the Fourth Amendment and invasion of privacy claims.

Case Study

1 Do you agree with the court's decision? Why or why not?

2 Have you ever been reprimanded or fired because of something your employer discovered in your private life? Was it fair?

3 In light of this case, as an HR manager, how would you structure employee privacy policies?