Employee Privacy Rights: A Delicate Balancing Act

1
Employee Privacy Rights A Delicate Balancing Act

• Laura K. Sitar
• Shareholder, Wroten Associates

2
Article 1, Section 1 of the California
Constitution

• California citizens have an inalienable right of
  privacy.
• Their protected interests include
• Interests precluding the dissemination or misuse
  of sensitive or confidential information
  (informational privacy).
• Interests in making intimate and personal
  decisions or conducting activities without
  observation, intrusion or interference (autonomy
  privacy).

3
Employers Have The Right To Decide How Best to
Operate Their Businesses

• Employers monitor employee behavior for a number
  of reasons.
• To improve productivity
• To avoid litigation
• To protect assets
• To reduce or prevent injuries
• Just because employers are curious

4
Employer Needs vs. Employee Rights
5
Reasonable Expectation of Privacy

• An employees reasonable expectations are
  evaluated objectively based on community
  standards. Protective measures are taken into
  consideration when evaluating a violation.

6
Violation?

• Consider the nature of the intrusion on an
  employees reasonable expectation of privacy
• As well as the offensiveness of the intrusion
  balanced against the justification for the
  intrusion

7
Does An Employee Have A Reasonable Expectation of
Privacy?

• Dating a subordinate?
• Dating a peer?

• Pre-employment drug testing?
• Pre-promotion drug testing?
• Random drug testing?
• Medical examinations?

8
Employee Health Information

• Employers are obligated to protect employees
  health information.
• Employees financial and other personal
  information also are safeguarded by state laws.

9
Record Safeguards

• Keep records in a secured location.
• Make accessible only to persons with need for
  access.
• Never use social security numbers as IDs.
• Keep records only as long as necessary.

10
References

• Have a policy.
• Provide only objective, verifiable facts.
• If you give positive, give negative as well.
• Can you disclose the grounds for termination?

11
Employee Monitoring

• Does the employee have a reasonable expectation
  of privacy?

12
Do Employers Really Monitor Their Employees?

• According to the 2007 Electronic Monitoring and
  Surveillance Survey conducted by the American
  Management Association and the ePolicy Institute
• 48 of the 304 companies surveyed used some form
  of video monitoring in the workplace
• 66 monitored employee Internet use
• 30 reported having terminated employees based on
  findings from Internet monitoring
• 28 of the respondents had terminated employees
  for misuse of e-mails

13
Video Monitoring

• Employers can monitor their employees by video
  except in certain locations.

14
GPS Tracking

• Does an employee have a reasonable expectation of
  privacy driving the company van?
• Does an employee have a reasonable expectation of
  privacy driving his own car for company business?

15
Company Devices
16
Monitoring Phone Usage

• When parties to a call are all in California,
  state law requires that they be informed that
  the conversation is recorded or monitored by
  either putting a beep tone on the line or
  playing a recorded message. (California Public
  Utilities Commission General Order 107-B)
• Federal law, which regulates phone calls with
  persons outside the state, allows unannounced
  monitoring for business-related calls. (See
  Electronic Communications Privacy Act, 18 USC
  2510, et. seq.)
• Under federal case law, when an employer realizes
  the call is personal, he or she must immediately
  stop monitoring the call. However, when employees
  are told not to make personal calls from
  specified business phones, the employee then
  takes the risk that calls on those phones may be
  monitored.

17
How to Spy?

• A number of companies make keylogger apps. Mobile
  Spy has an app that works with iOS, Android,
  BlackBerry and Nokia's Symbian. SpectorSoft has
  eBlaster, which works with Android and
  BlackBerry.
• These apps silently record text messages, email,
  Web use, GPS location, contacts, call logs,
  photos and videos. A company can set geo fences
  so the
• company knows whether an employee
• leaves work during company hours.
• All the information is emailed to the person
  who installed the app.
• Keylogger apps are invisible and designed to
  prevent tampering. It's very difficult to detect
  one and almost as hard to eliminate it.

18
Monitoring Text Messages

• In a June 2010 decision, City of Ontario v. Quon,
  the Supreme Court unanimously upheld the search
  of a police officer's personal messages on a
  government-owned pager, saying it did not violate
  his constitutional rights. The warrantless search
  was not an unreasonable violation of the
  officers 4th Amendment rights because it was
  motivated by legitimate work-related purposes.
• The city obtained a transcript of Quons messages
  during an investigation to determine whether
  officers were using their pagers for personal
  messages. The transcripts showed that Quon had
  been exchanging sexually explicit messages.
• The Courts decision generally allows government
  employers to look at workers' electronic messages
  if employers have reasonable, work-related
  grounds.
• The 4th Amendment would not apply to a private
  employer. However, the decision could have an
  impact on future court decisions involving
  private employers.

19
Usage Policies

• For company-provided devices, explain that the
  employer retains full ownership and the right of
  access to all electronic communications,
  including the ability to access and audit device
  content on a business necessity basis.
• Reviewable content should include e-mail, text
  messages, photos and videos sent, received or
  stored on the devicewhether business-related or
  personal.

20
Monitoring Emails

• In Holmes v. Petrovich Development Company, LLC,
  a California court ruled that emails sent by an
  employee to her attorney from a computer in her
  workplace were not protected by attorney-client
  privilege. 
• The court noted that the employee had been
• (1) told of the companys policy that its
  computers were to be used only for company
  business,
• (2) warned that the company would monitor its
  computers for compliance with this policy, and
• (3) advised that employees using company
  computers have no right of privacy.  

21
Monitoring Computer Usage

• To increase productivity
• To prevent or remedy harassment
• To protect employee data

22
Stored Communications Act

• Konop v. Hawaiian Airlines, Inc, 302 F.3d 868
  (9th Cir. 2002)-Vice President accessed pilots
  private web site by using authorized employee
• Pietrylo v. Hillstone Restaurant Group, No.
  06-5754, 2008 U.S. Dist. LEXIS 108834 (D.N.J.
  2008)-Employer accessed chat group on employees
  Myspace account without authorization

23

• Can an employer monitor a computer which is given
  to an employee to use at home?
• Can an employer monitor computer use when the
  company is the employees home?

24
Policy Tips

• If the employer reimburses employees for some or
  all business-related use of an employees
  personally purchased electronic device, ensure
  that the policy establishes the companys right
  to similarly access any business-related content.
• Clearly and consistently communicate that
  employees should have no expectation of privacy
  regarding any transmitted content, if the
  employer reimburses employees for
  business-related use of an electronic device.
• Include a No Abuse of Privilege Clause clearly
  identifying and prohibiting harmful activities.
  This type of clause is intended to shield the
  employer from liability resulting from employee
  misuse, especially in situations where an
  employee uses the device in a manner that harms
  others.

25
Policy Tips (cont.)

• Consider obtaining the employees written
  authorization permitting the employer to seek
  reimbursement for any charges or liability
  incurred from the employees unauthorized,
  illegal or excessive use of the device.
• Outline the consequences of failing to return
  company-owned devices upon separation of
  employment.
• Quickly address violations and consistently
  enforce policies in place.
• As technology advances, regularly review and
  update electronic communications policies to
  shield the employer from legal liability.

26
Sample Policy Regarding Use of Company Electronic
Devices

• Computer, Network and Telephone Use
• The Company's communications equipment such as
  telephones, computers, networks, and Internet
  access are important tools for everyday operation
  and are provided to facilitate Company business.
  No employee should have any expectation of
  privacy in his or her use of Company-provided
  communication resources. The Company reserves
  the unlimited right to access and review all
  traffic transmitted through or received by
  employer-provided equipment and services. The
  Company intends to engage in such reviews on a
  regular basis and to take steps necessary to
  correct inappropriate or unauthorized use Company
  resources.

27

• Limited personal use of these resources is
  allowed as long as it does not interfere with job
  responsibilities. In the event charges are
  incurred for the use of the Company's resources
  for personal business, then the employee will
  reimburse the Company and may be subject to
  disciplinary action.
• In addition, the use of the Company's
  communications equipment for solicitation,
  religious, or political causes is prohibited.
  Further, personal use may not violate state or
  federal laws, including the Health Insurance
  Portability and Accountability Act. Offensive
  and or disruptive messages containing sexual,
  racial, or degrading commentary shall not be
  tolerated and may be subject to disciplinary
  action.

28
Monitoring Social Media
29
Legislative Landscape

• California, Illinois, Maryland and Michigan
  adopted social media privacy laws last year. A
  similar law in Utah takes effect this month.
• Social media privacy legislation has been
  introduced or is underway in 35 states since
  January of this year.

30

• California, Colorado, Connecticut, North Dakota
  and New York, have laws that prohibit employers
  from disciplining an employee based on off-duty
  activity on social networking sites, unless the
  activity can be shown to damage the company in
  some way.

31
National Labor Relations Act

• Concerted activity", is simply activity
  undertaken by employees acting together, rather
  than individually, even if no union is involved,
  as long as the employees are discussing their
  work conditions or terms of employment.

32
California Social Media Law

• THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS
  FOLLOWS
• SECTION 1.
• Chapter 2.5 (commencing with Section 980) is
  added to Part 3 of Division 2 of the Labor Code,
  to read
• CHAPTER  2.5. Employer Use of Social Media
• 980.
• (a) As used in this chapter, social media means
  an electronic service or account, or electronic
  content, including, but not limited to, videos,
  still photographs, blogs, video blogs, podcasts,
  instant and text messages, email, online services
  or accounts, or Internet Web site profiles or
  locations.
• (b) An employer shall not require or request an
  employee or applicant for employment to do any of
  the following
• (1) Disclose a username or password for the
  purpose of accessing personal social media.
• (2) Access personal social media in the presence
  of the employer.
• (3) Divulge any personal social media, except as
  provided in subdivision (c).
• (c) Nothing in this section shall affect an
  employers existing rights and obligations to
  request an employee to divulge personal social
  media reasonably believed to be relevant to an
  investigation of allegations of employee
  misconduct or employee violation of applicable
  laws and regulations, provided that the social
  media is used solely for purposes of that
  investigation or a related proceeding.
• (d) Nothing in this section precludes an employer
  from requiring or requesting an employee to
  disclose a username, password, or other method
  for the purpose of accessing an employer-issued
  electronic device.
• (e) An employer shall not discharge, discipline,
  threaten to discharge or discipline, or otherwise
  retaliate against an employee or applicant for
  not complying with a request or demand by the
  employer that violates this section. However,
  this section does not prohibit an employer from
  terminating or otherwise taking an adverse action
  against an employee or applicant if otherwise
  permitted by law.
• SECTION 2
• Notwithstanding any other provision of law, the
  Labor Commissioner, who is Chief of the Division
  of Labor Standards Enforcement, is not required
  to investigate or determine any violation of this
  act.

33
Key Points for Social Media Policy

• Clearly articulate parameters for use of social
  media sites during working hours.
• Communicate mechanisms by which employees can
  bring forward work-related complaints before
  posting to social media sites.
• Reiterate policy that company computers and email
  systems are company property intended for company
  use and may/will be monitored.
• Prohibit use of company logos and trademarks on
  social media sites without executive approval.
• Prohibit disclosure of confidential, proprietary
  or trade secret information or intellectual
  property of the employer.

34
Key Points (Cont.)

• Prohibit posting information which could be
  viewed as harassing, threatening or retaliatory.
• Prohibit posting false or misleading information
  regarding company, employees, clients.
• Reiterate that conduct that would be grounds for
  discipline or dismissal if performed at work is
  also grounds for discipline or dismissal if
  performed online.
• State that misuse is grounds for discipline,
  including termination.
• Require employees to sign a written
  acknowledgement that they have read and will
  abide by the policy.