Legal Report November 2009
U.S. JUDICIAL DECISIONS
EMPLOYEE MONITORING. A company that installed a surveillance camera to record activity in an empty office after hours did not invade the privacy of the two employees who used that office during the day.
Founded in 1913, Hillsides, Inc., was originally an orphanage. The Pasadena, California facility houses children who have been in foster care and were victims of emotional, physical, and sexual abuse. The 12 buildings on the Hillsides campus are protected by external door alarms and CCTV cameras trained on the parking lot, main entrance, and the exterior of the administration building. All employees are required to wear photo ID badges, and security officers patrol the premises around the clock.
Abigail Hernandez and Maria-Jose Lopez performed clerical duties during business hours. They shared an office in the administration building, but each employee had her own desk and workstation. The office door could be closed and locked. Both Hernandez and Lopez had keys to the office as did five administrators and all the security staff members.
According to Hillsides’ computer systems policy, employees had no expectation of privacy when using its computers, network, or system. Further, administrators warned employees that the company could monitor and record employee activity. The policy noted that using the computer network for illegal or inappropriate activity was prohibited, as was accessing pornographic Web sites or displaying, downloading, or distributing sexually explicit material.
To ensure compliance with the company policy, administrators would routinely print a list of all Internet Web sites accessed from every computer at Hillsides. In July 2002, the review showed that numerous pornographic Web sites had been viewed in the late night and early morning hours from two computers. One computer was located in a classroom and the other one was used by Lopez.
Upon learning of the inappropriate computer use, John Hitchcock, the facility director, suspected that the perpetrator was either a security officer or an administrative employee who had free rein of the facility at all hours. Hitchcock did not consider any of the children, because they were under supervision and asleep at the time of the incidents. Neither Hernandez nor Lopez was under suspicion, because they were both off duty when the violations occurred.
Hitchcock decided to install a camera in the office shared by Hernandez and Lopez to try and catch the perpetrator in the act. The camera was hidden on a bookshelf. A motion detector was placed nearby so that the camera would only be triggered if someone came into the office. The devices were remotely connected to a monitor and recorder, which Hitchcock had moved into a nearby storage room.
Hitchcock only recorded the camera feed on three occasions. He never recorded during the day and never recorded when Hernandez and Lopez were in the office.
The surveillance equipment was in place for three weeks. At that point, Hernandez and Lopez discovered the setup, and Hitchcock had it removed. During that time, no one was caught using the computer in the office. Hitchcock assumed that the culprit had learned about the camera and had ceased the inappropriate activity.
When Hernandez and Lopez found the setup, they informed their supervisors, who, in turn, called Hitchcock. A few days later Hitchcock apologized to Hernandez. He explained the reason for the surveillance and assured her that she was not the target of the investigation and was not recorded by the camera. Hitchcock later conveyed this same information to Lopez.
The next week, Lopez asked to see what the camera had recorded. Hitchcock showed Lopez the videotape. There was a brief image of Hitchcock setting up the system, but no one else appeared on the tape.
Hernandez and Lopez sued Hillsides for invasion of privacy. Hillsides requested summary judgment—a hearing based on the facts of a case without a trial. The Los Angeles County Superior Court granted the summary judgment. Hernandez and Lopez appealed the decision.
The California Court of Appeal reversed the lower court’s ruling. The court found that Hernandez and Lopez had suffered an intrusion into a protected zone of privacy and that Hitchcock’s actions were so unjustified and offensive that they constituted a privacy violation. Hillsides appealed the ruling.
The Supreme Court of California overruled the appeals court decision and reinstated the summary judgment in favor of Hillsides. The court ruled that Hitchcock’s actions were reasonable given the risk of doing nothing to stop the viewing of pornographic materials in a facility that housed at-risk children.
In summarizing its ruling, the court noted: “We reach this conclusion from the standpoint of a reasonable person based on defendant’s vigorous efforts to avoid intruding on plaintiffs’ visual privacy altogether. Activation of the surveillance system was narrowly tailored in place, time, and scope, and was prompted by legitimate business concerns. Plaintiffs were not at risk of being monitored or recorded during regular work hours and were never actually caught on camera or videotape.” (Hernandez v. Hillsides, Inc., Supreme Court of California, No. S147552, 2009)
PREMISES LIABILITY. A university student who was assaulted in a parking garage cannot sue the school because the attack was not foreseeable.
In January 2002, Graciette DiSalvo, a student at the University of the District of Columbia (UDC) was attacked by two armed men in a parking garage on the UDC campus. The assailants demanded money and one of them stabbed DiSalvo through her cheek. DiSalvo fought off the two men and escaped. The attackers were never identified or apprehended.
DiSalvo sued UDC for negligence, claiming that the lack of security and safety precautions led to the attack. As evidence, DiSalvo noted that, at the time of the attack, the garage was open to the public and was protected only by one security officer who patrolled several university properties. There was no video or audio surveillance and no parking attendant. Also, a UDC security officer had requested that a parking attendant be added at the garage in question.
DiSalvo also noted that several crimes had recently taken place on the UDC campus. However, none of these crimes were committed using a weapon, none occurred in a parking facility, and none resulted in serious injury.
A jury found in favor of DiSalvo and awarded her $400,000 in damages. UDC appealed the decision.
The appeals court overturned the jury verdict, finding that there was no evidence that the attack on DiSalvo was foreseeable. The court noted that there had been no reports of crime in the parking garage where DiSalvo was attacked. And the UDC security officer testified that his request for a parking attendant was one of many routine requests and was not based on any specific security concerns.
In the written opinion of the case, the court concluded: “The facts simply do not establish that UDC had reason to foresee the attack on DiSalvo any more precisely than any other possible criminal act on campus. Without more, the mere possibility of a criminal act occurring is not sufficient to impose a duty of protection on UDC.” (University of the District of Columbia v. DiSalvo, District of Columbia Court of Appeals, No. 06-CV-1481, 2009)
U.S. CONGRESSIONAL LEGISLATION
COMMUNICATIONS. A bill (S. 251) introduced by Sen. Kay Bailey Hutchison (R-TX), which is designed to prohibit prisoners from using smuggled cell phones, has been approved by the Senate Commerce, Science, and Transportation Committee. The Senate has not announced whether it will consider the bill.
The provision would allow corrections officials to petition the government to use wireless jamming devices. (Currently, any interference with wireless services is illegal.) In deciding whether to grant a petition, the government must consider whether the jamming device would interfere with the work of local first responders or other public-safety or emergency personnel.
Under the bill, the Federal Communications Commission would issue regulations governing the manufacture, sale, importation, and shipment of such devices.
REAL ID. A bill (S. 1261) that will repeal the REAL ID Act of 2005 and replace it with an alternative ID program has been approved by the Senate Homeland Security and Governmental Affairs Committee. The Senate has not announced whether it will consider the measure.
S. 1261 has some of the same requirements as REAL ID. State-issued drivers’ licenses must still include a digital photograph and have information encoded so that it can be read by machine. States will still be required to verify an applicant’s Social Security number and immigration status. However, motor vehicle departments will not have to verify the authenticity of an applicant’s birth certificate as required under REAL ID.
Under S. 1261, states must have administrative and physical safeguards to protect the security, confidentiality, and integrity of the personal information collected from applicants. Similarly, the bill would require that those employees authorized to produce drivers’ licenses or ID cards undergo background screening.
STATE LEGISLATION
Massachusetts
IDENTITY THEFT. New regulations implemented in Massachusetts requiring that companies encrypt documents sent over the Internet or saved on laptops or flash drives have been revised to make the process easier for small businesses. Under the regulations, wirelessly transmitted data must be protected and firewalls must be up to date. The revised regulations are risk-based in implementation, meaning that the administrative, technical, and physical safeguards necessary are based on several factors, such as the size, scope, and type of business; the resources available; the amount of data stored; and the need for security and confidentiality of the information. Businesses in the state must meet the new regulations by March 1, 2010.
North Carolina
SCHOOL VIOLENCE. A new law (formerly S.B. 526) in North Carolina requires public schools to establish programs to prevent bullying and harassment. The law requires schools to address physical, verbal, and electronic harassment and to implement procedures for reporting, investigating, and preventing such behavior. The new law states that having an unpopular viewpoint does not constitute bullying or harassment.
This column should not be construed as legal or legislative advice.
