Employee Privacy Rights: A Delicate Balancing Act

1. Employee Privacy Rights: A Delicate Balancing Act Laura K. Sitar Shareholder, Wroten & Associates

2. Article 1, Section 1 of the California Constitution California citizens have an inalienable right of privacy. • Their protected interests include: • Interests precluding the dissemination or misuse of sensitive or confidentialinformation (informational privacy). • Interests in making intimate and personal decisions or conducting activities without observation, intrusion or interference (autonomy privacy).

3. Employers Have The Right To Decide How Best to Operate Their Businesses • Employers monitor employee behavior for a number of reasons. • To improve productivity • To avoid litigation • To protect assets • To reduce or prevent injuries • Just because employers are curious

4. Employer Needs vs. Employee Rights

5. Reasonable Expectation of Privacy An employee’s reasonable expectations are evaluated objectively based on community standards. Protective measures are taken into consideration when evaluating a violation.

6. Violation? • Consider the nature of the intrusion on an employee’s reasonable expectation of privacy • As well as the offensiveness of the intrusion balanced against the justification for the intrusion

7. Does An Employee Have A Reasonable Expectation of Privacy? • Dating a subordinate? • Dating a peer? • Pre-employment drug testing? • Pre-promotion drug testing? • Random drug testing? • Medical examinations?

8. Employee Health Information • Employers are obligated to protect employees’ health information. • Employee’s financial and other personal information also are safeguarded by state laws.

9. Record Safeguards • Keep records in a secured location. • Make accessible only to persons with need for access. • Never use social security numbers as IDs. • Keep records only as long as necessary.

10. References • Have a policy. • Provide only objective, verifiable facts. • If you give positive, give negative as well. Can you disclose the grounds for termination?

11. Employee Monitoring Does the employee have a reasonable expectation of privacy?

12. Do Employers Really Monitor Their Employees? According to the2007 Electronic Monitoring and Surveillance Surveyconducted by theAmerican Management Association and the ePolicy Institute: • 48% of the 304 companies surveyed used some form of video monitoring in the workplace • 66% monitored employee Internet use • 30% reported having terminated employees based on findings from Internet monitoring • 28% of the respondents had terminated employees for misuse of e-mails

13. Video Monitoring Employers can monitor their employees by video except in certain locations.

14. GPS Tracking Does an employee have a reasonable expectation of privacy driving the company van? Does an employee have a reasonable expectation of privacy driving his own car for company business?

15. Company Devices

16. Monitoring Phone Usage • When parties to a call are all in California, state law requires that they be informed that the conversation is recorded or monitored by either putting a beep tone on the line or playing a recorded message. (California Public Utilities Commission General Order 107-B) • Federal law, which regulates phone calls with persons outside the state, allows unannounced monitoring for business-related calls. (See Electronic Communications Privacy Act, 18 USC 2510, et. seq.) • Under federal case law, when an employer realizes the call is personal, he or she must immediately stop monitoring the call. However, when employees are told not to make personal calls from specified business phones, the employee then takes the risk that calls on those phones may be monitored.

17. How to Spy? • A number of companies make keylogger apps. Mobile Spy has an app that works with iOS, Android, BlackBerry and Nokia's Symbian. SpectorSoft has eBlaster, which works with Android and BlackBerry. • These apps silently record text messages, email, Web use, GPS location, contacts, call logs, photos and videos. A company can set geo fences so the company knows whether an employee leaves work during company hours. All the information is emailed to the person who installed the app. • Keylogger apps are invisible and designed to prevent tampering. It's very difficult to detect one and almost as hard to eliminate it.

18. Monitoring Text Messages • In a June 2010 decision, City of Ontario v. Quon, the Supreme Court unanimously upheld the search of a police officer's personal messages on a government-owned pager, saying it did not violate his constitutional rights. The warrantless search was not an unreasonable violation of the officer’s 4th Amendment rights because it was motivated by legitimate work-related purposes. • The city obtained a transcript of Quon’s messages during an investigation to determine whether officers were using their pagers for personal messages. The transcripts showed that Quon had been exchanging sexually explicit messages. • The Court’s decision generally allows government employers to look at workers' electronic messages if employers have reasonable, work-related grounds. • The 4th Amendment would not apply to a private employer. However, the decision could have an impact on future court decisions involving private employers.

19. Usage Policies • For company-provided devices, explain that the employer retains full ownership and the right of access to all electronic communications, including the ability to access and audit device content on a business necessity basis. • Reviewable content should include e-mail, text messages, photos and videos sent, received or stored on the device—whether business-related or personal.

20. Monitoring Emails • In Holmes v. Petrovich Development Company, LLC, a California court ruled that emails sent by an employee to her attorney from a computer in her workplace were not protected by attorney-client privilege.  • The court noted that the employee had been: (1) told of the company’s policy that its computers were to be used only for company business, (2) warned that the company would monitor its computers for compliance with this policy, and (3) advised that employees using company computers have no right of privacy.  

21. Monitoring Computer Usage • To increase productivity • To prevent or remedy harassment • To protect employee data

22. Stored Communications Act Konop v. Hawaiian Airlines, Inc, 302 F.3d 868 (9th Cir. 2002)-Vice President accessed pilot’s private web site by using authorized employee Pietrylo v. Hillstone Restaurant Group, No. 06-5754, 2008 U.S. Dist. LEXIS 108834 (D.N.J. 2008)-Employer accessed chat group on employee’s Myspace account without authorization

23. Can an employer monitor a computer which is given to an employee to use at home? • Can an employer monitor computer use when the company is the employee’s home?

24. Policy Tips • If the employer reimburses employees for some or all business-related use of an employee’s personally purchased electronic device, ensure that the policy establishes the company’s right to similarly access any business-related content. • Clearly and consistently communicate that employees should have no expectation of privacy regarding any transmitted content, if the employer reimburses employees for business-related use of an electronic device. • Include a “No Abuse of Privilege Clause” clearly identifying and prohibiting harmful activities. This type of clause is intended to shield the employer from liability resulting from employee misuse, especially in situations where an employee uses the device in a manner that harms others.

25. Policy Tips (cont.) • Consider obtaining the employee’s written authorization permitting the employer to seek reimbursement for any charges or liability incurred from the employee’s unauthorized, illegal or excessive use of the device. • Outline the consequences of failing to return company-owned devices upon separation of employment. • Quickly address violations and consistently enforce policies in place. • As technology advances, regularly review and update electronic communications policies to shield the employer from legal liability.

26. Sample Policy Regarding Use of Company Electronic Devices Computer, Network and Telephone Use • The Company's communications equipment such as telephones, computers, networks, and Internet access are important tools for everyday operation and are provided to facilitate Company business. No employee should have any expectation of privacy in his or her use of Company-provided communication resources. The Company reserves the unlimited right to access and review all traffic transmitted through or received by employer-provided equipment and services. The Company intends to engage in such reviews on a regular basis and to take steps necessary to correct inappropriate or unauthorized use Company resources.

27. Limited personal use of these resources is allowed as long as it does not interfere with job responsibilities. In the event charges are incurred for the use of the Company's resources for personal business, then the employee will reimburse the Company and may be subject to disciplinary action. • In addition, the use of the Company's communications equipment for solicitation, religious, or political causes is prohibited. Further, personal use may not violate state or federal laws, including the Health Insurance Portability and Accountability Act. Offensive and or disruptive messages containing sexual, racial, or degrading commentary shall not be tolerated and may be subject to disciplinary action.

28. Monitoring Social Media

29. Legislative Landscape • California, Illinois, Maryland and Michigan adopted social media privacy laws last year. A similar law in Utah takes effect this month. • Social media privacy legislation has been introduced or is underway in 35 states since January of this year.

30. California, Colorado, Connecticut, North Dakota and New York, have laws that prohibit employers from disciplining an employee based on off-duty activity on social networking sites, unless the activity can be shown to damage the company in some way.

31. National Labor Relations Act “Concerted activity", is simply activity undertaken by employees acting together, rather than individually, even if no union is involved, as long as the employees are discussing their work conditions or terms of employment.

32. California Social Media Law THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Chapter 2.5 (commencing with Section 980) is added to Part 3 of Division 2 of the Labor Code, to read: CHAPTER  2.5. Employer Use of Social Media 980. • (a) As used in this chapter, “social media” means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations. • (b) An employer shall not require or request an employee or applicant for employment to do any of the following: • (1) Disclose a username or password for the purpose of accessing personal social media. • (2) Access personal social media in the presence of the employer. • (3) Divulge any personal social media, except as provided in subdivision (c). • (c) Nothing in this section shall affect an employer’s existing rights and obligations to request an employee to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding. • (d) Nothing in this section precludes an employer from requiring or requesting an employee to disclose a username, password, or other method for the purpose of accessing an employer-issued electronic device. • (e) An employer shall not discharge, discipline, threaten to discharge or discipline, or otherwise retaliate against an employee or applicant for not complying with a request or demand by the employer that violates this section. However, this section does not prohibit an employer from terminating or otherwise taking an adverse action against an employee or applicant if otherwise permitted by law. SECTION 2 • Notwithstanding any other provision of law, the Labor Commissioner, who is Chief of the Division of Labor Standards Enforcement, is not required to investigate or determine any violation of this act.

33. Key Points for Social Media Policy • Clearly articulate parameters for use of social media sites during working hours. • Communicate mechanisms by which employees can bring forward work-related complaints before posting to social media sites. • Reiterate policy that company computers and email systems are company property intended for company use and may/will be monitored. • Prohibit use of company logos and trademarks on social media sites without executive approval. • Prohibit disclosure of confidential, proprietary or trade secret information or intellectual property of the employer.

34. Key Points (Cont.) • Prohibit posting information which could be viewed as harassing, threatening or retaliatory. • Prohibit posting false or misleading information regarding company, employees, clients. • Reiterate that conduct that would be grounds for discipline or dismissal if performed at work is also grounds for discipline or dismissal if performed online. • State that misuse is grounds for discipline, including termination. • Require employees to sign a written acknowledgement that they have read and will abide by the policy.