A federal district court in New Jersey ruled this week that an employer might have invaded an employee’s common-law privacy rights by coercing a co-worker into giving the employer access to the employee’s Facebook profile.

The plaintiff, a nurse and paramedic employed by a non-profit hospital service corporation, alleges that her supervisor forced a co-worker who was one of the plaintiff’s Facebook friends to log into Facebook in front of the supervisor so the supervisor could see the plaintiff’s postings. The complaint alleges the supervisor viewed and copied several of the plaintiff’s posts, including a comment implying that paramedics should not have saved a man who shot and killed a guard at the United States Holocaust Memorial Museum in Washington, D.C. The complaint alleges that the employer sent letters about the post to state regulators in a “malicious” attempt to damage the plaintiff’s reputation and employment opportunities. The defendants asked the court to dismiss the plaintiff’s common law invasion of privacy claim and her claim under New Jersey’s Wiretapping and Electronic Surveillance Control Act.

Noting that “[p]rivacy in social networking is an emerging, but underdeveloped, area of case law,” the court found the plaintiff had “stated a plausible claim for invasion of privacy” because she had taken steps to protect her Facebook posts from public view and thus “may have had a reasonable expectation that her Facebook posting would remain private.” The court said case law is fairly clear that there is no reasonable expectation of privacy for material on unprotected public websites and that there is a reasonable expectation of privacy for individual, password-protected communications such as e-mails. However, the court ruled, the plaintiff’s claim falls between these ends of the spectrum, and thus the reasonableness of the plaintiff’s expectation is a fact-sensitive question that could not be resolved on a motion to dismiss.

The court did dismiss the plaintiff’s state wiretapping claim, holding that the statute protects only electronic communications in the course of transmission. The plaintiff’s Facebook post was in “post-transmission storage,” and thus outside the statute’s protection, the court held.