Data Protection and Privacy 2025

USA LAW AND PRACTICE Contributed by: Nancy Libin, David Rice, Spencer Persson, Michael Borgia, Robert Stankey, Kara Trowell and Alexander Sisto, Davis Wright Tremaine LLP

information (eg, FCRA, the Americans with Dis - abilities Act, BIPA (biometrics) and various state personnel file laws). There are also federal and state constitutional, statutory and common law protections for privacy in the employment con - text, as follows. If the employer is a government entity: • courts have applied the Fourth Amendment and required a warrant for searching an employee’s “private” office and files; and • the Wiretap Act and Stored Communications Act will in some cases apply to employer monitoring of employee conversations, telephone calls and electronic communica - tions of a personal nature – some states have analogous laws that may have broader scope, include additional requirements or prohibi - tions, and impose harsher sanctions than their federal counterparts. If the employer is a private entity, the Fourth Amendment does not apply. However, the fol - lowing should be noted. • A handful of state constitutions, including California and Alaska, specify a right to pri - vacy that has been interpreted to apply in the employment context. • The state privacy torts may apply to employer conduct that unreasonably intrudes on an employee’s privacy. The common law inva - sion of privacy claims most common in the employment context are intrusion upon seclu - sion, public disclosure of private facts, and false light publication. • Some states have laws regulating specific employee conduct or employee privacy in certain information and circumstances, such as:

(a) personnel file laws that govern access to and inspection of employee records; (b) surveillance laws that set forth require - ments and limitations on video or biomet- ric monitoring in the workplace; (c) specific laws that protect an employee’s personal online account and activities; (d) laws that govern an employer’s use of GPS, location and vehicle tracking de - vices; and (e) laws that protect employees’ off-duty activities. • Some states require employers to notify employees before electronically monitoring their phone calls, emails or internet usage. New York law requires employees’ written acknowledgement of the notice. • Federal law and some state laws (California) generally prohibit the use of polygraph devic - es by private employers, and both federal and state laws apply to employer monitoring of private employee conversations and commu - nications. • Like the GDPR, the CCPA applies to the processing of personal information in the employment context and grants privacy rights that can be exercised by employees and job applicants. In all cases, employees may have specific pri - vacy rights established in a written employment contract. 4.4 Transfer of Personal Data in Asset Deals Control of personal data is typically transferred between corporate entities as part of a merger, acquisition, asset purchase or other corporate transaction. In many cases, receipt of such per - sonal data by the acquiring entity may be neces - sary for the acquiring entity to provide services or may have substantial value on its own (for

541 CHAMBERS.COM

Powered by