A federal judge refused this week to dismiss a "cyber privacy" lawsuit, providing some good lessons for employers.

Most employers have policies giving them the right to monitor employees' activities while using the employer's computer systems. But even so, the employer's rights aren't unlimited.

The allegations in Frankhouser v. Clearfield County Career & Technical Center may not be true. But hang on to your hat because here is what the plaintiff says:

Prologue

Elizabeth Frankhouser was the Executive Director of the Career Center. 

Among other things, Ms. Frankhouser had a personal Dropbox account, which she used sometimes for business and sometimes for pleasure. For those of you who are unfamiliar with Dropbox, it is a cloud-based storage application. There is a free version, and a couple of paid subscription options. If you have a Dropbox account, you can store things like photos and videos, and also documents, in the "cloud" and save some space on your computer hard drive. You can also use it to share files that may be too big to send as email attachments. Dropbox accounts are password-protected. If you are on a mobile device, you can access it through the Dropbox app. If you're on a computer, you go to the Dropbox website using any old browser and log in using an email address and your password.

According to Ms. Frankhouser, she never accessed the "personal" material in her Dropbox account from the Career Center and never downloaded it to her work computer. While she was at work and on the employer's systems, she used Dropbox strictly for business.

Things are about to get interesting.

Shortly after she was hired in 2015, Ms. Frankhouser's supervisor (we'll call him "Todd") allegedly began sexually harassing her. Ms. Frankhouser refused Todd's advances and complained to his boss, "Greg." Todd then allegedly began making things difficult for Ms. Frankhouser at work.

Meanwhile, she investigated one employee, "Doug," for "questionable work practices," which allegedly caused Doug to tell someone that he would like to "kill" her. And the wife of the IT administrator applied for a job at the Career Center and was turned down.

So now, Todd, the IT administrator, and Doug all allegedly hate Ms. Frankhouser.

At some point in 2016 or 2017, Ms. Frankhouser's computer started malfunctioning, and the IT administrator removed and replaced her old hard drive, and loaded her stuff back onto the new hard drive. Among other things, Ms. Frankhouser had all of her passwords stored on an Excel spreadsheet on her Career Center computer. (Terrible idea, I know.)

After changing out her hard drives, the IT administrator allegedly took the old hard drive home and opened Ms. Frankhouser's "password" spreadsheet, allegedly logged into her Dropbox account using her log-in information, and allegedly found two "explicit" pictures of Ms. Frankhouser's boyfriend and some pictures of Ms. Frankhouser at a party, having a really good time. The IT guy allegedly printed hard copies of the pictures and gave them to Doug, the guy who reportedly wanted to "kill" her. Doug allegedly gave the pix to Greg, the big boss.

Greg terminated Ms. Frankhouser, reportedly for having dirty pictures on her Career Center computer. (Which she did not.)

Then Greg allegedly presented Ms. Frankhouser with a separation agreement. Despite the fact that the agreement said she had 21 days to consider it, Greg allegedly told her that she had to sign it on the spot or else.

After her termination, the IT administrator allegedly gave a set of the pictures to Todd, the alleged sexual harasser. And Doug allegedly told people at the Career Center that Ms. Frankhouser had "hundreds" of dirty pictures on her computer, including pictures of her molesting her grandchildren, none of which was true.

(According to the lawsuit, the IT administrator was terminated after giving the pictures to Todd.)

Not surprisingly, Ms. Frankhouser sued for everything in the book, including violation of her rights under the Fourth Amendment to the U.S. Constitution (the Career Center is a public-sector employer) and for invasion of privacy under the common law of Pennsylvania.

Does she have a case? Yep.

The Career Center and the individual defendants filed a motion to dismiss the "cyber-claims" (her claims under the Fourth Amendment and for invasion of privacy) as well as some of the other claims. Among other things, the defendants said that Ms. Frankhouser (1) violated the Career Center's computer use policy by keeping dirty pictures in her Dropbox account, and (2) had no reasonable expectation of privacy with respect to the Dropbox material because she accessed her account frequently while at work.

The judge dismissed some of the claims in the lawsuit, but she allowed several, including the "cyber-claims," to go forward. Here's what she said about the cyber-claims:

• The Career Center's computer use policy was not properly before the court. (On a motion to dismiss the court considers only the allegations made in the plaintiff's lawsuit, not "evidence" submitted by either side. The only issue at this early stage is whether the plaintiff's allegations, if true, would give rise to a valid legal claim. Sorry for the legalese!)
• Even if the Career Center policy had been before the court, it wouldn't have done the defendants any good because it did not apply to an employee's private cloud account or material that had never been accessed through the employer's system. 
• Based on the allegations in the lawsuit, Ms. Frankhouser absolutely did have a reasonable expectation of privacy with respect to her personal Dropbox material. It was her own private account, it was password-protected, and Ms. Frankhouser had never accessed the pictures while on the Career Center system or downloaded them. The fact that she sometimes used Dropbox for work did not mean that she lost the right to keep her personal Dropbox stuff private. 

Again, the court could consider only Ms. Frankhouser's side of the story. The defendants will now have the opportunity to present their side, which could be very different. 

The moral

What can employers learn from this decision about monitoring employees' internet use? Plenty.

Don't overreach. If you have a good internet usage policy, you should have the right to monitor employees' emails in your system, as well as their online activities while on your system. But that doesn't mean you have the right to go "fishing" in employees' private accounts.

Before you take action against an employee for misuse of the company computer systems, educate yourself. Assuming Ms. Frankhouser's allegations are true, I suspect that poor Greg may not have understood the way Dropbox works, so the IT administrator may have been able to mislead him into thinking that the pictures were actually stored on the Career Center computer. Before taking action, Greg should have done some research on his own, or even asked a different IT professional for a tutorial on Dropbox and a second opinion (without revealing identities, of course).

Don't trust anybody! Especially when it comes to cyber-anything, it is too easy nowadays for people to spoof and create all kinds of mischief. In my little law office of 11 attorneys, I'm aware of two cases in the past year and a half involving someone who cyber-sabotaged a co-worker. As they used to tell us in the newspaper business, "If your mother says she loves you, check it out." Make sure you really know what is going on before you make an employment decision you'll regret.

Image Credit: Photo of Danny from The Shining (1981) from flickr, Creative Commons license, by Felipe Pizarro.