A recent decision out of the New Jersey Superior Court, Appellate Division, adds an additional level of concern for employers about monitoring employee actions over the Internet. In Doe v. XYC Corp., Docket No. A-2909-04T2, December 27, 2005, the Court ruled that an employer can be held liable in tort for the non-business actions of an employee on the Internet, in this case, the viewing and transmission of child pornography images.
The facts are straightforward and, as you might expect, awful. XYC had a company internet policy advising employees that company computer use was not private and could be monitored for inappropriate activity. A company employee was suspected of using his computer to view pornographic (although not specifically child pornographic) websites on the Internet. Several members of management, including the company's IT staff and the employee's immediate supervisor, were aware that the employee visited these websites and met with the employee on two occasions to tell him to stop his inappropriate use of the company computer.
Unknown to the company, the employee was taking nude photographs of his 10-year-old stepdaughter and storing some of these pictures on his work computer. Shortly after being reprimanded a second time, the employee transmitted three of his stepdaughter's pictures to an internet child pornography site using his work computer. He was arrested shortly thereafter.
In ruling against a motion for summary judgment on behalf of the employer, the Court determined that the company had an affirmative duty, once it recognized that the employee was visiting "pornographic sites," to further investigate his activities, which ultimately would have uncovered the fact that he was viewing child pornography. Noting the strong state criminal policy against child pornography, the Court then made the leap to finding that the employer negligently failed to pursue and investigate the activity that violated its policy. It was a short step to the determination that the employer's failure to properly investigate its employee was a proximate cause of damage to the child and her mother.
The problem with the Court's opinion is that the evidence that the employer had regarding the employee's Internet activities was hardly unequivocal. I cannot find a reference indicating that the employer should have known the employee was doing anything other than visiting Internet pornography sites. This is objectionable conduct, and would typically warrant some form of discipline, but would hardly set off alarm bells requiring a full and complete scoping of an employee's computer. My experience tells me that many people look at websites that may contain pornography at work and a typical employer's response is a reprimand and warning not to do it again. What the Court seems to be saying in this case is that the discovery of an employee visiting a pornographic website establishes a duty on the part of the employer to fully review the employee's internet activity, and a failure to do so can expose the employer to liability for whatever skeletons happen to be in the employee's private life that might be uncovered as a result of such a search.
This troubling case may be the precursor to a wider scope of obligations on the part of employers to act in a quasi-law enforcement capacity based on extremely limited knowledge of misconduct. Let’s hope not.