Employee Privacy Interest In Internet Address

The New Jersey Supreme Court has recently held in State v. Reid (April 21, 2008) that an employee had a reasonable expectation of privacy in her internet subscriber identity.  The case was a criminal one in which the employee was prosecuted for using her home computer to access the website of a supplier in order to change the address of her employer on the site.  The employee challenged the adequacy of a subpoena seeking the identity of the person using the IP address that changed the address.  In addressing that issue, the court recognized that "[f]ederal case law interpreting the Fourth Amendment has found no expectation of privacy in Internet subscriber information."  Those decisions are based on precedent that there is no reasonable expectation of privacy in information shown to third parties.  Under the New Jersey constitution, however:

[The state supreme court had previously] concluded that a person “is entitled to assume that the numbers he dials in the privacy of his home will be recorded solely for the telephone company’s business purposes.” . . . ISP records share much in common with long distance billing information and bank records [which have also enjoyed an expectation of privacy]. All are integrally connected to essential activities of today’s society. Indeed, it is hard to overstate how important computers and the Internet have become to everyday, modern life. Citizens routinely access the Web for all manner of daily activities: to gather information, explore ideas, read, study, shop, and more.

Individuals need an IP address in order to access the Internet. However, when users surf the Web from the privacy of their homes, they have reason to expect that their actions are confidential. Many are unaware that a numerical IP address can be captured by the websites they visit. More sophisticated users understand that that unique string of numbers, standing alone, reveals little if anything to the outside world. Only an Internet service provider can translate an IP address into a user’s name.

In addition, while decoded IP addresses do not reveal the content of Internet communications, subscriber information alone can tell a great deal about a person. With a complete listing of IP addresses, one can track a person’s Internet usage. “The government can learn the names of stores at which a person shops, the political organizations a person finds interesting, a person’s . . . fantasies, her health concerns, and so on.” Daniel Solove, The Future of Internet Surveillance Law, 72 Geo. Wash. L. Rev. 1264, 1287 (2004). Such information can reveal intimate details about one’s personal affairs in the same way disclosure of telephone billing records does. Although the contents of Internet communications may be even more revealing, both types of information implicate privacy interests. . . . For all of those reasons, we find that Article I, Paragraph 7, of the New Jersey Constitution protects an individual’s privacy interest in the subscriber information he or she provides to an Internet service provider.

Although not an employment case, the existence of a privacy interest in an employee's IP address could be important for public employees.  Moreover, it's nice to see a court recognize the importance of the Internet. No doubt certain people (hi Paul) may also use this case to remind me that states can provide greater protection for employees than the federal government. 

Kudos to fellow blogger Dan Solove for getting quoted in the decision.

Hat Tip:  Bill Herbert

-JH