## Facts

- An executive employee received an employer-issued laptop that could access the internet through the employer’s server.
- The employer maintained an electronic communications policy reserving broad rights to review matters on company “media systems and services,” while also permitting “occasional personal use.”
- The policy did not expressly address personal, web-based, password-protected email accounts or warn that such messages could be stored and later retrieved from browser cache files.
- While still employed, the employee used the company laptop to access her personal, password-protected Yahoo! Mail account to communicate with her attorney about workplace issues; she did not save her login credentials on the laptop.
- The laptop’s browser automatically stored copies of viewed web pages, including emails, in temporary internet files on the hard drive; the attorney’s emails included a confidentiality/privilege notice.
- After the employee resigned and returned the laptop, she sued the employer for employment discrimination-related claims.
- The employer retained a forensic expert to image the hard drive and recovered several employee–attorney emails from the cache; defense counsel reviewed them and used information from them during discovery.
- The employee demanded return and destruction of the emails as privileged; the employer asserted a right to review under its policy and denied any reasonable expectation of privacy.

## Issues

1. Whether an employee has a reasonable expectation of privacy in attorney–client emails sent through a personal, password-protected, web-based email account using an employer-issued laptop under an ambiguous electronic communications policy.
2. Whether such emails remain protected by the attorney–client privilege or are waived by using the employer’s equipment.
3. Whether defense counsel’s review and use of the recovered emails violated RPC 4.4(b), and what remedy or sanctions, if any, are warranted.

## Decision

- The court held the employee could reasonably expect that communications with her attorney through her personal, password-protected webmail account would remain private despite use of a company laptop.
- The court held the attorney–client privilege applied and was not waived on these facts.
- The court held the employer’s policy did not provide clear notice that personal webmail communications would be monitored, stored, retrieved from cache, and reviewed, and therefore did not defeat privacy or privilege.
- The court held defense counsel breached RPC 4.4(b) by reading emails that were at least arguably privileged and failing to promptly notify opposing counsel.
- The court affirmed as modified and remanded for the trial court to determine appropriate sanctions, if any, against the employer’s counsel.

## Legal Principles

- Attorney–client communications retain privileged status when an employee uses an employer-issued computer to access a personal, password-protected, web-based email account, absent clear and unambiguous policy language sufficient to negate a reasonable expectation of privacy and consistent with public policy favoring confidentiality.
- Workplace electronic communications policies are construed with attention to their specificity; ambiguous policies that permit personal use and do not clearly address personal webmail and cache retrieval are insufficient to establish waiver of attorney–client privilege.
- The reasonable expectation of privacy analysis is strengthened when the communications are with counsel, are password-protected, and contain indicia of confidentiality.
- Under RPC 4.4(b), a lawyer who receives or encounters materials that the lawyer knows or reasonably should know are privileged or confidential must refrain from exploiting them and must promptly notify the adversary (and, when appropriate, seek court guidance); reading and using such materials can warrant sanctions.

## Conclusion

The court protected attorney–client emails accessed through personal, password-protected webmail on a work laptop where the employer’s policy did not clearly authorize monitoring and retrieval of such messages, and it directed consideration of sanctions after finding defense counsel violated RPC 4.4(b) by reviewing and using communications that were at least arguably privileged.


Stengart v. Loving Care Agency, Inc., 201 N.J. 300, 990 A.2d 650 (N.J. 2010)