Privacy can be legally protected in three ways: by the constitution (federal or state), by federal and/or state statutes, and by the common law. Common law refers to the body of law comprised of the decisions handed down by courts, rather than specified in any particular statutes or regulations.
The Constitution's Fourth Amendment protection against an unreasonable search and seizure governs only the public-sector workplace because the Constitution applies only to state action. Therefore, unless the employer is the government or other representative of the state, the Constitution generally will not apply.
Statutes offer little, if any, protection from workplace intrusions. The Electronic Communications Privacy Act of 1986 (ECPA) prohibits the "interception" or unauthorized access of stored communications. However, courts have ruled that "interception" applies only to messages in transit and not to messages that have actually reached company computers. Therefore, the impact of the ECPA is to punish electronic monitoring only by third parties and not by employers. Moreover, the ECPA allows interception where consent has been granted. Therefore, a firm that secures employee consent to monitoring at the time of hire is immune from ECPA liability.
The "invasion of privacy" claim with which most people are familiar is one that developed through case law called "intrusion into seclusion." This legal violation occurs when someone intentionally intrudes on the private affairs of another when the intrusion would be "highly offensive to a reasonable person." As we begin to live more closely with technology, and the intrusions it allows, we begin to accept more and more intrusions in our lives as reasonable; as privacy invasions become more common, they begin to be closer to what is normal and expected. It may no longer be reasonable to be offended by intrusions into one's private life that used to be considered unacceptable.