Maryland employers can legally monitor work emails on company systems, but strict limits apply to personal accounts under federal and state privacy laws. The Electronic Communications Privacy Act (ECPA) allows monitoring of employer-provided email if employees have notice or consent, while Maryland’s two-party consent rule governs recordings. Recent expansions like the Maryland Online Data Privacy Act (MODPA), effective October 2025, add consumer protections that indirectly impact workplace data handling.​
Employer Monitoring Rights
Employers may access and read emails sent or received on company devices or networks as part of “ordinary business activities,” provided clear policies notify employees upfront. This includes tracking usage for productivity, security, or compliance, but accessing personal email accounts (e.g., Gmail on personal devices) without authorization violates the Stored Communications Act (SCA). Maryland’s 2012 User Name & Password Law prohibits demanding personal social media or email credentials, except in cases of suspected unauthorized data transfers.​
Employee Privacy Protections
Workers retain expectations of privacy in personal communications, even on BYOD (bring your own device) policies if not explicitly waived. AI-driven monitoring requires notice under Maryland’s workplace AI rules (effective 2022), and retaliation for refusing invasive surveillance may trigger NLRA claims. Cybersecurity laws mandate employers safeguard data but do not expand monitoring into off-duty personal use.​
