Must a North Carolina lawyer avoid emailing a client through the client's employer's system, and may the employer's lawyer read employee-counsel emails the employer recovered?

Plain-English summary

The opinion addresses an employment dispute in which the employee used his work email account, on a system the employer's policy says it may monitor, to communicate with his own lawyer. It works through the duties of the employer's lawyer (Attorney A) and, at the outset, the duty of any lawyer whose client is using an employer's system. On that first point, the opinion concludes a lawyer must avoid communicating with a client over the employer's email system if there is a risk the employer will find and read the emails. The duty of confidentiality in Rule 1.6 (and Comments [17] and [18]) requires reasonable precautions against disclosure to unintended recipients and is broader than the attorney-client privilege, so the lawyer should avoid the system regardless of whether the matter is unrelated to employment or whether a privilege-waiver argument exists, and should explore alternatives such as personal email, telephone, and texting.

Turning to the employer's lawyer, the opinion holds that Attorney A should research the law on recovering, identifying, and producing employee email, including privilege law, and advise the employer of its rights and responsibilities, taking care under Rule 4.4(a) not to use methods that violate a person's legal rights. Whether Attorney A may actually read employee-counsel emails the employer recovered turns on privilege: drawing on case law, including In re Asia Global Crossing, the opinion ties the question to whether the employee had a reasonable expectation of privacy, which depends on factors such as the clarity and communication of the monitoring policy, whether it is enforced, third-party access, and where and when the communication occurred. If Attorney A can confidently and in good faith conclude the privilege was waived, he may read and use the emails; if the analysis is inconclusive, he should err on the side of recognizing the privilege and may seek a court ruling.

On notice, the opinion concludes Attorney A has no duty under Rule 4.4(b) to tell the employee's lawyer, because that rule applies only to writings inadvertently sent, and the employee and his lawyer used the employer's system intentionally (citing ABA Formal Opinion 11-460 and distinguishing 2009 FEO 1 on inadvertently transmitted metadata). The opinion also draws firm lines around an employee's separate personal email account: a lawyer may not advise the employer to change the password to gain access, because that would counsel criminal or fraudulent conduct under Rules 1.2(d) and 8.4(c), and if the employer does so on its own, the lawyer may not review the messages absent a court order. Finally, a government lawyer required by public-records law to review government employees' emails may participate in that review, but must still protect any employee-counsel communications that are not public records where the privilege was not waived or the waiver question cannot confidently be resolved.

In practice

Under the North Carolina rules as they stood at the time of the opinion, conduct in which a lawyer corresponds with a client over the client's employer's email system is to be avoided where the employer might read the messages, because the duty of confidentiality reaches disclosure to any unintended recipient, not just disclosures that would forfeit privilege. Per the opinion, the lawyer should move the communication to a channel the employer does not control.

Per the opinion, the employer's lawyer who comes into possession of employee-counsel emails may read them only after a good-faith determination that the privilege was waived, judged by the reasonable-expectation-of-privacy factors in the case law, and should otherwise recognize the privilege or seek a court ruling. The opinion finds no Rule 4.4(b) notice duty for emails sent intentionally over the employer's system, prohibits advising the employer to change passwords on an employee's personal account under Rules 1.2(d) and 8.4(c), and permits a government lawyer's public-records review while requiring protection of non-public, privileged employee-counsel emails.

Common questions

Q: Can a lawyer email a client at the client's work email address?

A: The opinion says to avoid it. Opinion #1 concludes a lawyer must avoid communicating with a client over the employer's email system when there is a risk the employer will find and read the emails, because the Rule 1.6 duty of confidentiality is broader than privilege; the lawyer should use personal email, telephone, or texting instead.

Q: Can the employer's lawyer read the employee's emails to his own attorney that the employer recovered?

A: Only conditionally. Opinion #3 ties the answer to whether the employee had a reasonable expectation of privacy under the case-law factors; the lawyer may read and use the emails if he can confidently and in good faith conclude the privilege was waived, and should otherwise err toward recognizing the privilege or seek a court ruling.

Q: Does the employer's lawyer have to notify the employee's lawyer that the employer has the emails?

A: No. Opinion #4 holds Rule 4.4(b) does not apply because the emails were sent intentionally over the employer's system, not inadvertently; the opinion follows ABA Formal Opinion 11-460 and distinguishes 2009 FEO 1, which involved inadvertently transmitted metadata.

Q: Can a lawyer advise the employer to change the password on the employee's personal (non-work) email account?

A: No. Opinion #5 concludes that advising a client to change the password to a personal email account violates Rule 1.2(d) (counseling crime or fraud) and Rule 8.4(c) (dishonesty); the proper route is a judicial ruling authorizing access.

Q: If the employer changes the password on its own, can the lawyer read those emails?

A: No, not without a court order. Opinion #6 concludes reviewing them would assist fraudulent conduct under Rules 1.2(d) and 8.4(c), and the lawyer may notify the employee's lawyer only with the employer's informed consent or where reasonably necessary to comply with law or a court order.

Q: Can a government lawyer review employee emails for a public-records request?

A: Yes. Opinion #7 permits the review because it is required by law and serves the public interest, but if employee-counsel emails are found not to be public records, the lawyer must determine whether the privilege was waived and protect the communications where it was not or where the waiver cannot confidently be determined.

Background and rules framework

The opinion applies North Carolina Rule 1.6 (confidentiality, the analogue of Model Rule 1.6), relying on Comments [17] and [18] for the duty to safeguard information against inadvertent or unauthorized disclosure to unintended recipients, and Rule 1.6(b)(1) for the narrow disclosure exceptions. It applies Rule 4.4 (respect for the rights of third persons, Model Rule 4.4), both subsection (a) on improper methods of obtaining evidence and subsection (b) on inadvertently sent writings. The analysis of advising on passwords applies Rule 1.2(d) (counseling crime or fraud, Model Rule 1.2) and Rule 8.4(c) (dishonesty, Model Rule 8.4).

Because no rule or prior North Carolina opinion was directly on point for the privilege question, the opinion looks to case law on whether an employee has a reasonable expectation of privacy in emails sent over an employer's system, including In re Asia Global Crossing, Ltd., and to ABA Formal Opinion 11-460.

Citations and references

Rules of Professional Conduct:

• MR 1.6 / NC Rule 1.6, 1.6(b)(1) (confidentiality; reasonable precautions; disclosure exceptions)
• MR 4.4 / NC Rule 4.4(a), (b) (methods of obtaining evidence; inadvertently sent writings)
• MR 1.2 / NC Rule 1.2(d) (counseling or assisting crime or fraud)
• MR 8.4 / NC Rule 8.4(c) (dishonesty, fraud, deceit, or misrepresentation)

Cases:

• In re Asia Global Crossing, Ltd., 322 B.R. 247 (S.D.N.Y. 2005), factors for an employee's objectively reasonable expectation of privacy in workplace email.
• Mason v. ILS Techs., LLC, 2008 U.S. Dist. LEXIS 28905 (W.D.N.C. 2008), privilege not waived where the employee was unaware of the monitoring policy.

Other opinions cited:

• ABA Formal Opinion 11-460 (2011): an employer's lawyer who obtains an employee's emails with counsel has no notice duty for non-inadvertent communications; notice decisions belong to the employer-client.
• NC 2009 FEO 1 (2010): duty to notify the sender of confidential information inadvertently embedded in metadata (distinguished as inadvertent).

See also

• ABA Formal Op. 11-460: Received Privileged Emails
• ABA Formal Op. 06-440: Unsolicited Privileged Materials
• ABA Formal Op. 99-413: Unencrypted Email Confidentiality

Source

• Landing page: https://www.ncbar.gov/for-lawyers/ethics-and-governing-rules/ethics-opinions/opinions/2012-formal-ethics-opinion-5/

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Inquiry #1:

Attorney A represents Employer on various matters including legal disputes with its employees. Employer has a business email system that is available to all employees and that is used for transacting Employer’s business. Employer’s personnel policy states that Employer may monitor emails sent or received using Employer’s email system, specifically including email sent or received on any employee’s business email account.

Employee is in a legal dispute with Employer. Employee has used his business email account on Employer’s email system to send emails to his lawyer and he has received emails from his lawyer on his business email account on Employer’s email system.

Does a lawyer have a duty to avoid communicating with a client over the email system of the client’s employer?

Opinion #1:

A lawyer must avoid communications with a client over an employer’s email system if there is a risk that the employer will find and read the emails. The duty of confidentiality, set forth in Rule 1.6 of the Rules of Professional Conduct, requires a lawyer “to act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer….” Rule 1.6, cmt. [17]. Comment [18] to the rule adds that, when transmitting confidential client information, a lawyer must take “reasonable precautions to prevent the information from coming into the hands of unintended recipients.”

Where a lawyer knows or reasonably should know that a client is using an employer’s email system to communicate with the lawyer, the lawyer should seek to avoid the use of the employer’s system regardless of whether the legal matter is unrelated to the client’s employment and regardless of whether there is a legal argument that use of the system does not waive the attorney-client privilege. The duty of confidentiality is more expansive than the attorney-client privilege. It requires a lawyer to protect confidential information from disclosure to “any unintended recipient.” The lawyer should explore with the client alternative methods of communicating including use of the employee’s personal email system, telephone, and texting.

Inquiry #2:

May Attorney A tell Employer to review the records for its email system to retrieve any personal email messages sent or received by Employee on Employee’s business email account?

Opinion #2:

Attorney A should research the law relating to the recovery, identification and production of employee email, including the law on attorney-client privilege, and advise Employer as to its rights and responsibilities under the law. See Rule 4.4(a)(“In representing a client, a lawyer shall not...use methods of obtaining evidence that violate the legal rights of…a person.”)

Inquiry #3:

Employer reviews the records of its email system and discovers email messages between Employee and his lawyer. The emails from the lawyer contain the statement “Attorney-Client Confidential Communication.” Employer informs Attorney A that it has copies of these messages.

May Attorney A review the email messages?

Opinion #3:

In the absence of a Rule of Professional Conduct or prior ethics opinion on point, the Ethics Committee was guided by the case law on the application of the attorney-client privilege to communications between a client and his lawyer over an employer’s email system. The attorney-client privilege is fundamental to the client-lawyer relationship and the trust that underpins that relationship. As such, the bar must protect the privilege and seek to limit incursions upon the privilege that are not warranted by law.

Case law from many jurisdictions,1 including North Carolina,2 indicates that whether the privilege applies to email exchanges between an employee and his lawyer that occurred over an employer’s email system depends upon whether the employee had a reasonable expectation of privacy in the email communications. This in turn requires an investigation into a myriad of factors, including whether the employer has a clear, unambiguous policy regarding email usage and monitoring; whether that policy is effectively communicated to employees; whether the policy is adhered to by the employer; whether third parties have access to the employee’s email account on the employer’s system; when/where the communication occurred (at home or the office; during work or leisure hours); and whether the employee took affirmative steps to preserve the privacy of the communication. See, e.g., In re Asia Global Crossing, Ltd., 322 B.R. 247, 258 (S.D.N.Y. 2005)(in considering whether employee has objectively reasonable expectation of privacy in emails sent to the employee’s attorney over the employer’s computer systems, court should consider (1) does the corporation maintain a policy banning personal or other objectionable use, (2) does the company monitor the use of the employee’s computer or email, (3) do third parties have a right of access to the computer or emails, and (4) did the corporation notify the employee, or was the employee aware, of the use and monitoring policies).

Therefore, whether Attorney A may read the email messages recovered by Employer will depend upon an analysis of the case law and the factors set forth therein to determine whether Employee had a reasonable expectation of privacy or, lacking that, waived the privilege when communicating with his lawyer using Employer’s email system. If Attorney A is able to conclude, confidently and in good faith, that the privilege was waived, he may read the emails and use them to represent his client. However, in deference to the bar’s interest in protecting the attorney-client privilege, Attorney A should err on the side of recognizing the privilege whenever an analysis of the facts and case law is inconclusive. If a matter is in litigation, Attorney A may seek the court’s determination of the waiver issue.

Inquiry #4:

Does Attorney A have to notify Employee’s lawyer that Employer has copies of the email messages?

Opinion #4:

No. Rule 4.4(b) is not applicable in this situation. The rule states that “[a] lawyer who receives a writing relating to the representation of the lawyer’s client and knows or reasonably should know that the writing was inadvertently sent shall promptly notify the sender.” Employee and his lawyer sent the email messages knowingly using Employer’s email system. Therefore, the email was not “inadvertently sent” and no duty to notify arises under this rule. See ABA Formal Opinion 11-460 (2011).

2009 FEO 1 (2010) can be distinguished. The opinion rules that a lawyer must notify the sender upon finding confidential information embedded in metadata transmitted in an electronic communication. The transmission of metadata, which is not disclosed on the face of an electronic document, is held to be inadvertent on the part of the sending lawyer, thus triggering a duty to notify for the receiving lawyer under Rule 4.4(b). However, in the instant situation, the substance of the communications between the employee and his lawyer are disclosed on the face of the emails and use of the employer’s system was intentional. Therefore, the emails were not “inadvertently sent.”

In the absence of a duty to notify, the fact that Employer has copies of the email messages is confidential client information that Attorney A may not disclose unless one of the exceptions to the duty of confidentiality applies or the client gives informed consent to disclosure. Rule 1.6(a). In the current situation, Rule 1.6(b)(1) only allows the lawyer to disclose confidential client information to comply with the law, a court order, or the discovery requirements under the Rules of Civil Procedure.

The ABA Standing Committee on Ethics and Professional Responsibility (the Standing Committee) addressed a similar inquiry in ABA Formal Opinion 11-460 (2011), and found that notification is only allowed with client consent in the absence of a law authorizing disclosure. As observed by the Standing Committee,

[I]f no law can reasonably be read as establishing a reporting obligation, then the decision whether to give notice must be made by the employer-client. Even when there is no clear notification obligation, it often will be in the employer-client's best interest to give notice and obtain a judicial ruling as to the admissibility of the employee's attorney-client communications before attempting to use them and, if possible, before the employer's lawyer reviews them. This course minimizes the risk of disqualification or other sanction if the court ultimately concludes that the opposing party's communications with counsel are privileged and inadmissible. The employer's lawyer must explain these and other implications of disclosure, and the available alternatives, as necessary to enable the employer to make an informed decision.

Inquiry #5:

Employee has a personal email account with a commercial email service (such as Gmail, Hotmail, or Road Runner) that is not a part of Employer’s business email system. However, the personal email account can be accessed via Employee’s office computer. The personal email account is password protected. Employer can access the email messages on this personal email account by changing the password to the account.

May Attorney A advise Employer to change the password to access Employee’s email messages on his personal email account?

Opinion #5:

No. To advise a client to change the password to a personal email account violates Rule 1.2(d), which prohibits a lawyer from counseling a client to engage in criminal or fraudulent conduct, and Rule 8.4(c), which prohibits a lawyer from engaging in conduct involving dishonesty, fraud, deceit, or misrepresentation. Again, obtaining a judicial ruling allowing Employer to access the email messages would authorize the Employer to proceed and avoid any professional misconduct by Attorney A.

Inquiry #6:

On its own initiative, Employer changes the password on Employee’s personal email account and gains access to emails on the account including email messages between Employee and his lawyer.

May Attorney A review the email messages? Should Attorney A notify Employee’s lawyer that Employer has copies of the email messages?

Opinion #6:

No. Attorney A may not review the email messages unless allowed to do so by court order. To hold otherwise would be to permit a lawyer to assist a client in fraudulent conduct in violation of Rule 1.2(d) and Rule 8.4(c).

Attorney A may not notify Employee’s lawyer that Employer has copies of the email messages unless he has the informed consent of Employer or if Attorney A believes that notification is reasonably necessary to comply with law or a court order. Rule 1.6(a) and (b)(1). As noted above, it may be in Employer’s best interest to obtain a judicial ruling on the admissibility of the email messages and this should be explained to Employer to obtain consent to disclose.

Inquiry #7:

Lawyers who are employed by government agencies that are subject to public records laws frequently are required to review emails of government employees to ascertain whether the emails are public records and must be produced pursuant to a public records request. Because all emails are subject to review to comply with the public records law, emails between a government employee and his lawyer would be subject to the same review. May a government lawyer participate in such a review?

Opinion #7:

Yes. The review is required by law and it is in the best interests of the government and the public that the review be performed by lawyers. However, if emails between a government employee and his lawyer are evaluated and held not to be public records, the government lawyer must further determine whether the attorney-client privilege for the communications was waived by the employee by the use of the government’s email system. See Opinion #2 above. If the lawyer determines that the privilege was not waived or the lawyer cannot confidently and in good faith make that determination, the lawyer should recognize the privilege and take steps to protect the communications from further disclosure or distribution unless authorized by court order.

End Notes

• The Ethics Committee is grateful to the North Carolina Bar Association Labor and Employment Law Section Council for the following list of relevant cases: Convertino v. US DOJ, 674 F. Supp. 2d 97 (D.D.C. 2009); Curto v. Medical World Comms. Inc., 2006 US Dist. LEXIS 29387 (EDNY 2006); Curto v. Medical World Comms. Inc., 2006 US Dist. LEXIS 29387 (EDNY 2006); Garrity v. John Hancock Mut. Life Ins. Co., No. 00-12143-RWZ, 2002 US Dist. LEXIS 8343 (D. Mass. May 7, 2002); Haynes v. Office of the Attorney General, 298 F.Supp.2d 1154 (D. Kan. 2003); Holmes v. Petrovich Dev. Co., LLC, 191 Cal. App.4th 1047, 119 Cal.Rptr.3d 878 (2011); Kaufman v. Sungard Inv. Sys., No. 05-CV-1236, 2006 US Dist. LEXIS 28149 (DNJ 2006) (unpub.); Leor Exploration & Prod’n LLC v. Aguiar, No. 09-60136-CIV, 2009 US Dist. LEXIS 87323 (SD Fla. Sept. 23, 2009); Leventhal v. Knapek, 266 F.3d 64 (2d Cir. 2001); Muick v. Glenayre Elecs., 280 F.3d 741 (7th Cir. 2002); Restuccia v. Burk Tech., 5 Mass.L.Rep. 712, 1996 Mass. Super. LEXIS 367 (Mass. Super. Ct. 1996); Scott v. Beth Israel Medical Center, Inc., 17 Misc.3d 934, 847 N.Y.S.2d 436 (NY Sup. Ct. 2007; Sims v. Lakeside School, No. CO6-1412RSM, 2007 US Dist. LEXIS 69568 (Sept. 20, 2007); Hygeson v. US Bancorp Equip. Fin’g, Inc., No. CV-03-467-ST, 2004 US Dist. LEXIS 18863 (D.Or. Sept. 15, 2004); United States v. Simons, 205 F.3d 392 (4th Cir. 2000).

• Mason v. ILS Techs., LLC, No. 3:04-CV-139, 2008 US Dist. LEXIS 28905 (W.D.N.C. 2008) (attorney-client privilege was not waived where the employee testified that he did not know of the employer’s policy on monitoring of personal emails transmitted on the employer’s email system and employer failed to prove otherwise).