It is clear that employees do not have any expectation of privacy in the e-mail account provided by their employers; but what about personal e-mail accounts accessed through the employer's computers at the place of employment? I am referring to that employee that gets bored at work and frequently visits his or her yahoo e-mail.  Then, the employer manages to get the employee's user ID and password and accesses employee's personal account. Is there any violation of the law in this scenario and can the employee recover damages?     

The U.S. Stored Communication Act (SCA), 18 USC § 2701, criminalizes the intentional act of accessing without authorization a facility through which an electronic communication service is provided, or intentionally exceeds an authorization to access such facility, and by doing so obtains, alters, or prevents authorized access to a wire or electronic communication while it is electronically stored in such system.  In other words, unauthorized access to an e-mail account to obtain or alter e-mails stored in that account may constitute a criminal conduct under the SCA. SCA is part of the U.S. Electronic Privacy Act, 18 USC § 2510 (2000). In addition to typifying this conduct as criminal, SCA § 2707(a) provides a private cause of action for any aggrieved by violation of § 2701.  SCA § 2707 allows a U.S. district court to award equitable or declaratory relief, reasonable attorney's fees and other costs, and damages.  This section also limits the award of statutory damages to the actual damages suffered by the victim.  There is an interesting case on point where the trial court ordered payment of statutory and punitive damages and on appeal, the court held that a judge cannot order statutory damages under SCA absent actual proof of damages suffered.

In the case of Van Alstyne v. Elec. Scriptorium, Ltd., 560 F.3d 199 (Ct. of Appl. 4th Circ. March 2009), the plaintiff was a former employee of defendant's company. The president of this company accessed plaintiff's employee personal e-mail account for over a year after the employee left the company and became a subcontractor for the defendant company. Plaintiff employee personal e-mail account was obviously password protected. There were some sexual harassment issues between plaintiff employee and the president of the defendant company; as a result, plaintiff employee's contract was changed for that of a subcontractor. Plaintiff employee brought a lawsuit under SCA and claimed damages, including statutory and punitive damages.  The jury awarded plaintiff employee statutory and punitive damages and the trial court awarded attorney's fees and costs.  The jury awarded $1,000 in statutory damages per violation of the SCA.  However, before filing this lawsuit under SCA, plaintiff employee had filed other cause of actions under labor laws and in those lawsuits, the defendant company used documents that seemed to have been retrieved from plaintiff employee's private e-mail account. The president of the defendant company admitted having accessed plaintiff employee's private e-mail account for over one year after she left the company and having obtained those documents through that unauthorized access.

On appeal, defendant Company claimed that the court erred in allowing the jury to (1) grant statutory damages of $1,000 per violation of the SCA, (2) grant punitive damages, and (3) attorney fees, without first finding whether plaintiff employee had suffered actual damage. The court of appeals agreed with defendant company and held that "plaintiffs pursuing claims under the SCA must prove actual damages in order to be eligible for an award of statutory damages."  Yet, the court disagreed with the defendant company's claim that recovery of punitive damages and attorney's fees is contingent to the proof of actual damages suffered by the victim.  The court vacated the award of statutory damages and reminded the case to the trial court to determine whether punitive damages and attorney's fees should have been ordered in this case, even with lack of proof of actual damages suffered by plaintiff employee.  

The court of appeals concluded that it is clear from the statutory language that Congress intended actual damages to accrue and be proven before statutory damages can be ordered. The court referred to previous interpretations of the U.S. Electronic Privacy Act by the United States Supreme Court: "Like the Privacy Act, the SCA limits an award of damages to the "actual damages suffered," as well as "any profits," thus "ma [king] specific provision . . . for what a victim . . . may recover." Furthermore, the SCA and Privacy Act contain the substantively identical following phrase: "but in no case shall a person entitled to recover receive less than the sum of $ 1, 000," which "looks back to the immediately preceding provision for recovering actual damages."  Indeed, the only differences between the damages provisions in the two statutes is the SCA's use of the term "suffered" instead of "sustained" and its use of the phrase "and any profits made by the violator." Neither difference, it seems to us, has any material impact. Thus, we are left to interpret statutory language in all important respects identical to that already interpreted by the Supreme Court. Our answer, it appears, should be obvious: just as the Privacy Act required proof of "actual damages" as a prerequisite to recovering statutory damages, so does the SCA."