Businesses need to carefully consider whether they will permit employees to use business information technology systems for private work. For example, while allowing an employee to use company resources for charitable work may be commendable, it can impose substantial costs if the non-business work leads to litigation.
A recent article about a professor who used his university email system for non-university work provides an example of the costs that an information governance policy may impose on an unwary employer. S. Francis Ward, “Chapman University says it didn’t authorize law prof’s representation of Trump, yet work was on server” (ABA Journal Feb. 7, 2022). Professor Eastman used Chapman University email to represent former President Trump. The House Select Committee issued a subpoena to the university.
Ms. Ward wrote:
Law professors often use school emails when representing clients, but they may want to rethink that, following a recent subpoena sent to Chapman University from the House Select Committee investigating the Jan. 6, 2021, U.S. Capitol attack, seeking documents from former faculty member John Eastman….
Although it’s Eastman’s ethical responsibility to check for attorney-client privilege regarding his emails, the university also has a duty to make sure nothing in the subpoena violates the Family Educational Rights and Privacy Act, which covers student information or the privacy rights of their employees, says Michael O’Brien, an Anchorage, Alaska-based partner at Perkins Coie who represents colleges and universities in employment matters.
Most university general counsel offices do not have sophisticated discovery review tools, according to O’Brien. He estimates that hiring outside counsel to review 19,000 items would cost “tens of thousands of dollars,” especially if there are many documents with varying types of privacy obligations.
“You may have no dog in the fight, but you are bound by privacy rules to deal with it,” says O’Brien, who previously served as an associate general counsel for the University of Alaska. [emphasis added].
When an employee asks permission to use corporate email or other information technology for a child’s soccer league, it may be a good business decision to say “yes.” However, it may also impose significant costs down the road.