Computer Privacy and the Modern Workplace

by Rabbis Elliot N. Dorff and Elie Kaplan Spitz, 2001; Edited by Rabbi Robert Binder

Question (Sh’eilah)

Are there conditions under which employers may monitor their employee’s e-mail or internet usage?

Answer (Teshuvah)

We who are “created in image of God” (Genesis 1:27) are repeatedly directed in the Torah to follow God’s ways: “You shall be holy, for I, the Lord your God, am holy” (Leviticus 19:2); “Walk in all his ways” (Deuteronomy 11:22); and “Follow the Lord your God” (Deuteronomy 13:5). The rabbis understood these verses as establishing the principle of imitatio dei, of modeling ourselves after God: “As God is gracious and compassionate… you too must be gracious and compassionate; as the Holy One is righteous… you too must be righteous; as the Holy One is loving… you too must be loving” (Sifre Devarim, Ekev). When we honor God’s creatures, we honor God, and conversely, degrading people is tantamount to dishonoring God. We are meant to be “a kingdom of priests and a holy people” (Exodus 19:6), not just a nation that observes the minimal necessities of maintaining order and providing for basic needs. As the Torah specifies, to be a holy people requires, among other things, that a lender not intrude on a borrower’s home to collect a loan (Deuteronomy 24:10-11), and that one should not be a talebearer among the people (Leviticus 19:6). Thus both intrusion and disclosure are forbidden so that a person’s home, reputation and communication are all protected as part of the effort to create a holy people.

One category of privacy violation is intrusion, defined as the unauthorized entry into another’s property or the use of that property without permission. The rabbis maintain that the Biblical laws prohibiting intrusion bar not only physical trespass, but also visual penetration of a person’s domain. They interpret Balaam’s praise of the tents of the Israelites – “How goodly are your tents, O Jacob, your dwelling places, O Israel” (Numbers 24:5) – as arising from his observation that the Israelite tents were so situated that the tent openings did not face each other, thus protecting their mutual privacy.

In the Middle Ages, Rabbenu Gershom (Mayence, Germany, 960-1028) issued a decree prohibiting the reading of other people’s mail lest they learn trade secrets or spread gossip. According to the decree, violators would be subject to excommunication even if they did not publicize the improperly read letter. Privacy was thus recognized as an important value in its own right. Moreover, intrusion, as understood in Jewish sources, is not limited to forbidden entry into another person’s property or personal space, but also forbidden use of what one learns from such entry.

One’s personal life should remain private, and the rabbis insisted that we take steps to shield both parties from the temptation to intrude. In the workplace, however, expectations of privacy are, and should be, different from those in the home. Jewish tradition emphasizes that an employee has a clear duty to do a fair day’s work. To prevent employees from idling on the employer’s time, the Talmud instituted an abridge form of Grace after Meals to be recited by day laborers, so that they would impinge as little as possible on the employer’s time when taking their lunch. Conversely, employees have the positive duty to work at their jobs with all their power, modeling themselves after Jacob, who said to his wives, “You know that I worked for your father will all my strength” (Genesis 31:6).

Given by Jewish law, employers have the right to monitor their employees to assure that they are not wasting time but are rather carrying out their responsibilities fairly and faithfully. In times past, employers would simply look to see what their employees were doing. Now that many forms of work involve use of the computer and the Internet, employers need to monitor what employees do on those instruments in order to assess the quality of their work. Employers do not, as a matter of course, have a right to know what their employees are thinking or writing, but they do have the right to insist that their employees spend their time at the computer on business and not on playing games or trading on the stock market for their personal benefit.

How shall we balance the employee’s right to privacy with the employer’s right to a fair day’s work? In order to clarify expectations, employers should notify employees of their intent to monitor the use and content of what their employees do on their office computer. Without such notification, employees could easily infer an expectation of privacy at work, especially because the employer arranges for the employee to have a personal password to gain access to the company’ system. An employer who plans to monitor Internet usage and e-mail should therefore provide employees, at the time of hiring, with both an oral and written notice of company policy about this matter. The notice should state that computers are company property intended for business purposes. The employer will thereby retain the right of access to all written messages on the system and will monitor employees’ use of the computers to advance the company’s legitimate business interests. Employers should also specify whether personal use of company machines (computers, telephone, fax, copy machine, etc.) is totally forbidden or allowed for given purposes and given amounts of time. In this way the lines between legitimate use and theft will become clear.

Conversely, employees who use office equipment for personal communications must take steps to insure that nothing private is seen or heard by others. Thus rabbis and educators should refrain from using e-mail for confidential communications, especially on the congregational server, lest others intentionally or accidentally read them. Similarly, if an employer makes clear that any and all communications on cyberspace generated on office equipment is subject to surveillance but that employees may occasionally send short e-mails to friends to set lunch dates and the like, employees must make sure that the employer will see nothing in such messages that should remain private with them.

In sum, the employer’s duty to protect an employee’s privacy from intrusion in the work place must be balanced against the employee’s duty to produce an honest day’s work. When an employee’s job involves work on the Internet, an employer justifiably intrudes on the employee’s computer usage to monitor job performance. The employer’s duty to protect the employee’s right against intrusion is achieved through notice that the employee’s Internet usage will be monitored, consent, and the duty to avoid harmful disclosure. In preventing unwarranted intrusion by employers and misuse by employees, we strive to fulfill our mission as “a kingdom of priests and a holy people.”

Note that this excerpted from Part I of a teshuvah that also deals with the question of disclosure by a business of information gleaned from a customer’s use of its website or registration form.