Email Privacy Law Concerns

Your email privacy is always at risk. Massive data breaches, persistent scammers, and institutional surveillance make it hard to guarantee that your emails will stay private.

Despite these risks, you have legal protections as a consumer. Laws can't completely ensure your privacy, but they can give you remedies for a privacy violation. You can also use strategies to protect your privacy online.

This article explains how consumer protection laws govern email privacy in different contexts, including at work and on personal devices.

Why Are Emails Riskier Than Other Communications?

Email is one of the least secure methods of communication for several reasons. Data collection and storage are a big part of the risk.

Emails get stored at multiple locations, including:

• The sender's computer or mobile device
• Your internet service provider's (ISP) server
• The receiver's computer or mobile device

Deleting an email from your inbox doesn't mean there aren't other copies still out there. In contrast, phone calls typically aren't recorded and stored. Even if they were, your employer and law enforcement would have to go to court to gain access to them.

Emails are also vastly easier for employers and law enforcement to access than phone records.

Finally, emails can be digitally stored for a long time. Your email records would ideally stay secure, but reality often falls short of expectations. Think twice before writing something in an email you don't want others to see.

Federal Laws Protect and Limit Your Email Privacy

Federal privacy laws protect your email activity. Yet, your email messages may not stay private forever. Understanding your rights — and the limits of your legal protections — can help clarify your privacy level.

The Fourth Amendment Expectation of Privacy

Email privacy has roots in the Fourth Amendment to the U.S. Constitution. The "reasonable expectation of privacy" standard can apply to many situations.

Unfortunately, you can't always expect email privacy at the same level as the Constitution protects. Your messages must pass through several computers and storage locations. Due to its open nature, the expectation of privacy is lower than other forms of communication, especially at work.

The Electronic Communications Privacy Act

The Electronic Communications Privacy Act (ECPA) also governs your emails. The ECPA creates protections, such as a warrant requirement, to support email privacy. This law also includes the Stored Communications Act (SCA), which protects email records that your ISPs keep.

Under the ECPA, emails lose their status as protected communication in 180 days. After that time, a warrant is no longer necessary. Law enforcement can access your emails through a simple subpoena.

Temporary Privacy Acts

The U.S. government has sacrificed people's email privacy for national security.

The USA Patriot Act of 2001 weakened ECPA protections in many ways. Opponents of the law believed it gave the government too much power to spy on private communications, including email. Congress eventually did not reauthorize this law, so most of it technically expired in 2020.

The USA Freedom Act of 2015 essentially took its place. This act limited some controversial government powers but still allowed digital surveillance. Congress reauthorized this law through late 2023.

Section 702 of the Foreign Intelligence Surveillance Act (FISA) also affects email privacy. This law allows the government to search emails from foreign senders to American recipients without a warrant. FISA includes a few measures to limit Americans' loss of privacy, but this level of surveillance is still controversial. The government reauthorized this act for two more years (until 2026).

Email and data privacy laws continue to evolve on the federal and state levels. Unlike the other two acts, the ECPA has no expiration date. Yet, lawmakers might have to control new risks with legislation that could affect your online privacy.

Email Privacy for Employees at Work

Privacy at work is a complicated area of law. The stakes are high for businesses and workers alike.

Most employers have their employees sign a computer and network usage policy. These policies typically require you to limit your email use to business purposes only.

By extension, they usually grant the employer the right to monitor email and computer usage. This agreement normally deprives an employee of any reasonable expectation of privacy.

Can My Employer Read My Emails?

Yes, your work emails are typically fair game for an employer to search. You use work equipment to send messages that could affect the business. Employers have enough legal justification to access these emails.

Unlike the police, employers have few obstacles to searching your emails. Even without a computer usage agreement, courts rarely say employees have a reasonable expectation of privacy for their work email.

For example, one court found that emailing others at work was inherently work-related (Smyth v. Pillsbury Co., 1996). There could be no reasonable expectation of privacy. This principle applies to online activity when working from home on employer-issued laptops and mobile devices (TBG Ins. Servs. Corp. v. Robert Zieminski, 2002).

Why Employers Monitor Private Work Emails

On the flip side, employers are concerned about many email and email privacy issues. Monitoring email at work is one way to ensure that employees are using work email appropriately. Tracking employee productivity is only one potential goal.

Liability is also a primary concern for employers. For example, employers must prevent workplace harassment lawsuits. One way to protect a business from getting sued is to monitor and prevent any harassment in the first place. Many employers run software that searches for offensive words and highlights problematic emails for review.

Emails can be especially devastating for a company's liability and reputation. People often communicate informally, sometimes saying things in emails that they never would in public, professional correspondence.

Employers May Keep Your Email Records

Old work emails could also be relevant years down the road in a lawsuit or data breach. What you send via work email can get preserved for years.

Many companies have an established practice of purging old emails as part of their data retention policies. Otherwise, those emails can be a gold mine for anyone suing the company or accessing its records illegally.

Yet, employers must also keep certain email records in case of an investigation or discovery process. Something you wrote years ago could become relevant to a case, even if you already left the job.

Email Privacy for Government Employees

Private sector employees may have little email privacy, but government employees have even less. Government jobs have strict rules about email use, security, and retention policies.

Public records laws and the Freedom of Information Act (FOIA) lower privacy expectations. The public can access almost anything a government employee writes, including emails.

The nature of your job also matters to the justice system. Courts are typically unwilling to find that government employees have a reasonable right to privacy at work in the first place.

Personal Email Privacy at Home

Unlike your email at work, emailing on your personal device is more likely to grant you a reasonable expectation of privacy. But even then, it's not very difficult for prying eyes to read your emails.

Because your employer stores your emails locally, at your ISP, and on the receiving end, hackers or law enforcement can gain access at many points. It may be difficult for law enforcement to legally seize your home computer and local copies of your emails. Yet, it is much easier for them to get your ISP to turn over your email records.

ISPs are increasingly creating End User Service Agreements. To use the service, you usually must agree to its terms.

These agreements reduce any expectation of privacy. They often include terms that grant the ISP the right to monitor your network traffic or turn over records at the request of a government agency.

Email Crimes Can Threaten Your Privacy

Remember that scammers and hackers ignore laws. Phishing emails, spoofing, and other online scams are federal crimes.

Cybercriminals often use phishing scams, malware, and spyware to steal sensitive information, such as:

• Your Social Security number
• Your name and date of birth
• Financial information like your credit card and bank account numbers
• Personal and work phone numbers
• Login credentials and account information for other websites and apps, such as your social media or government benefits accounts

Many employers put cybersecurity safeguards on the devices they give to employees, but they don't catch all threats. Many scammers use social engineering tactics to get around email spam filters. Plus, your personal email might not offer the same technical safeguards.

Consumers should take extra steps to protect their privacy and avoid identity theft. Learn to spot potential scam emails by examining the header details before clicking any links or attachments.

How To Keep Your Email Private

First, consider taking steps to maintain your expectation of privacy in the first place, such as:

• Always use password-protected devices and email clients.
• Always use two-factor authentication on all email accounts.
• Avoid using your personal email account on employer-issued devices, even though courts have historically recognized a right to expect privacy in this scenario.
• Avoid using your personal email address to conduct official business for your employer (regardless of the device you use).
• Treat your activity as anything the employer might see while your personal device is connected to an employer's virtual private network (VPN).
• Protect your physical devices from theft and hacking.

The next best way to keep your emails confidential is to encrypt them. Encryption scrambles your email into unintelligible data that only someone else's device with the correct digital "key" can read. Two popular forms of email encryption are OpenPGP and S/MIME.

Due to speed and convenience issues, few people use encryption. Most email remains unencrypted and unsecured.

No matter the precautions, you can't guarantee an email message will stay secret forever. Treat every email like it's open to the public. Don't write things you don't want others to read. Remember that even after you've deleted your emails, they could be available from other sources for years.

Get Legal Advice After a Privacy Violation or Data Breach

Companies and employers sometimes break privacy laws. Whether intentional or accidental, exposure of your email data could have immense consequences for your career, finances, and reputation.

You may also become the target of identity theft due to an email privacy violation. If so, you can get help from the Federal Trade Commission (FTC) resource, IdentityTheft.gov.

You may also want to discuss your options with an internet law attorney. Sometimes, you might have a path to reclaim lost money and other damages. An attorney can help clarify your rights under federal and state laws.