USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
4.3 Employment Privacy Law The United States regulates employment privacy through a patchwork of federal and state laws with no single comprehensive federal employment privacy statute. At the federal level, the Electronic Communi - cations Privacy Act (ECPA) generally prohibits inter - cepting communications but allows businesses to monitor their own systems when clear policies reserve that right. The Stored Communications Act protects against unauthorised access to stored electronic communications. The Computer Fraud and Abuse Act criminalises unauthorised access to computers, creat - ing liability when employers access employee devices without authorisation. The Fair Credit Reporting Act (FCRA) establishes strict requirements for background checks, requiring standalone written disclosure, writ - ten authorisation, pre-adverse action notices and cer - tification of compliance with equal employment laws. State laws vary significantly and often impose stricter requirements than federal law. Wiretapping consent requirements differ by state: California, Illinois and Pennsylvania require all-party consent to record con - versations, while many other states operate under one-party consent frameworks. Biometric privacy laws create substantial compliance obligations – Illi - nois BIPA is the most comprehensive, requiring writ - ten notice, disclosure of purpose and retention period and written consent before collecting biometric data like fingerprints or facial scans, with statutory dam - ages of USD1,000–USD5,000 per violation creating significant class action exposure. California’s CCPA employment exemptions became inoperative on 1 January 2023, subjecting employee data to notice requirements, access rights, deletion rights and opt- out mechanisms. Virginia, Colorado, Connecticut and Utah generally maintain employment data exemptions from their privacy laws, though this may change. Workplace monitoring is governed by reasonable expectation of privacy standards, with courts gen - erally finding that clear employer policies reserving monitoring rights eliminate privacy expectations in company-owned systems. However, employees may retain privacy expectations in personal web-based email accounts, attorney-client communications and certain private communications even on company devices. Remote work monitoring raises enhanced
privacy concerns due to home environments where employees have heightened expectations. BYOD (Bring Your Own Device) policies must clearly define employer access rights, specify when device wip - ing may occur, address data segregation between personal and work information, obtain specific con - sent for geolocation tracking and implement mobile device management solutions that protect employer data while respecting employee privacy. Processing applicant data requires clear privacy notices, neces - sary consents (particularly for background checks and biometric screening), FCRA compliance, and in Cali - fornia, CCPA compliance for applicant information. To comply with employment privacy laws, employers should: • implement clear monitoring policies notifying employees of surveillance activities and reserving employer monitoring rights; • obtain appropriate consents for biometric data collection, background checks, and monitoring activities where required by state law; • provide required notices about data collection, use, and employee rights under applicable privacy laws; • conduct data protection assessments for high-risk processing activities; • address multi-state compliance by identifying and applying the most restrictive applicable laws across all jurisdictions; • manage vendor agreements to ensure third-party service providers meet privacy obligations; • implement data segregation in BYOD environments to protect both employer and employee interests; and • maintain detailed records of processing activities, consents and compliance measures Enforcement comes from the FTC, state AGs, private lawsuits (especially under Illinois BIPA), FCRA class actions and the National Labor Relations Board. Given this complex landscape, employers should assess which laws apply to their operations and implement comprehensive privacy programmes addressing the strictest requirements across all applicable jurisdic - tions.
555 CHAMBERS.COM
Powered by FlippingBook