| Privacy – A Balancing Act for Employers
Robert Fried, a partner in the Pleasanton office of Atkinson, Andelson, Loya, Rudd and Romo, manages the Northern California private sector labor employment practice for the firm’s Employer Services Practice Group. He is the author of some of California’s leading texts on human resources practices. Robert has been consistently named as one of the top litigators in the San Francisco Bay Area by Bay Area Lawyer Magazine.
Marcia A. Ross, a partner in the Fresno office of the Atkinson firm, focuses on assisting employers in compliance with state and federal leaves of absence and reasonable accommodation laws and regulations. She represents employers in all aspects of labor relations and employment law, and is experienced in dealing with union contract compliance, grievances and arbitration, union organizing and union election situations. Marcia is a frequent guest lecturer on labor and employment law topics.
In the increasingly complicated electronic age, employers are faced with new challenges in their efforts to protect their business interests and comply with obligations to protect employee privacy.
Employee privacy rights are derived from a variety of federal and state laws and regulations. In California, privacy is guaranteed to all individuals by Article I, Section 1 of the California Constitution. This law applies to private employers. However, this right of privacy is not unlimited. Employees have a privacy interest in confidential or personal information, which is referred to as “informational privacy,” and a privacy interest in making their own choices and decisions, which is referred to as “autonomy privacy.”
An employee must establish the following elements in order to state a claim against his or her employer for violation of his or her right to privacy: (1) a cognizable privacy interest; (2) a reasonable expectation of privacy; and (3) a serious invasion of that privacy interest. The nature and extent of an employee’s privacy interest is measured using objective standards based on accepted societal norms relating to privacy with consideration of the realities of the workplace.
Once the employee establishes a privacy interest, an expectation of privacy and an invasion of that interest, an employer can defend itself by establishing that it had an important business reason for violating the employee’s privacy and that other, less intrusive means, of satisfying the business purpose were not available. Employer business needs include measures necessary to satisfy productivity and efficiency standards, allow for adequate supervision of the workforce and provide for workplace safety.
Courts apply a balancing test in analyzing whether a privacy violation has occurred. The court will weigh the employee’s reasonable expectation of privacy in the specific situation and circumstances involved in the employee’s claim for violation of privacy against the employer’s need to take the action being challenged. The court will look at the importance of the employer’s business need and whether or not the employer utilized the least intrusive method to achieve its purpose.
Privacy-related lawsuits brought against employers include claims based on alleged violations of the constitutional right of privacy and common law tort claims for invasion of privacy. Employee privacy is also protected under the California Labor Code and federal and state laws prohibiting discrimination and harassment.1
As will be discussed in more detail below, employers can protect their business interests and reduce the likelihood of employee privacy claims by taking specific steps to reduce the employees’ expectations of privacy in the workplace and by ensuring that they utilize the least intrusive methods when they undertake actions that could impact employee privacy rights. Whenever possible, employers should give employees advance notice of the planned action and attempt to obtain employee consent to the action.
Searches of personal property
Under the constitutional right to privacy, employees have a privacy interest in items they bring into the workplace, such as purses and handbags, briefcases, and tool boxes. Employees also have a privacy interest in any work areas that are reserved for their exclusive use, such as desks, offices, lockers and company vehicles.
Employers can reduce employees’ expectation of privacy by maintaining written policies reserving the right to conduct workplace searches and informing employees that anything they bring into the workplace may be searched. Prior to any search of employee property or work areas, an employer should attempt to obtain employee consent to the search. Consent is a defense to any privacy violation claim.
Employers can also protect themselves by ensuring that any workplace search is based on objective evidence of potential work-related misconduct, such as concealed drugs, weapons or stolen property, or that the search was necessary for a significant business reason, such as the need to find work-related documents when the employee was out of his or her office. Employers should limit the scope of any search and limit those involved in any search to those absolutely necessary for a successful result.
Access to employee computers and E-Mail messages
Business use of computers, email and the Internet is widespread and, in many cases, essential. This creates particular problems for employers that need to ensure that employee use of company-provided computer resources is appropriate. Because most computer systems require a password for access, employees may believe that their e-mail messages, information on their work computer and information about their use of the Internet are private.
To reduce employee expectations of privacy relating to their use of company-provided computer resources, every employer should have a written policy reserving the right to access e-mail messages and other information maintained on the computer, as well as the right to audit employee internet access using company resources. The courts have supported employers in such situations finding that employees had no right of privacy in information stored in their workplace computer when the employer had a clearly disseminated computer-use policy.2
The written policy should clearly outline the limitations on employee use of the company-provided computer and prohibit any use for improper or illegal purposes. A written computer policy reserving the right to access all information and requiring all employees to disclose their passwords to the system administrator should diminish any expectation of privacy. Absence of such a policy could significantly undermine the employer’s ability to argue that the expectation of privacy had been diminished. See Zieglar, supra at 9086.
Employers should be aware that this right to access employee computer information carries certain responsibilities. Any employee personal information that is accessed in the course of employer searches should be treated as private information and not disseminated. However, when the information uncovered discloses possible criminal activity very different considerations arise. Courts have held that an employer that who discovered an employee was accessing child pornography on his work computer was required to investigate, report the activity to appropriate law enforcement authorities and to take effective action to stop the employee’s illegal activity.3
Interception of employee emails by employers using certain software programs may risk potential violation of the Federal Wiretap Act. One federal court held that a software program that copies the email while it is being transmitted and then delivers the copy to someone other than the intended recipient creates an “interception” which is prohibited under that federal law.4 In order to avoid violation of the wiretapping laws, employers should be sure that employees are informed that the employer may monitor their emails and that the employees expressly agree to such monitoring.
Employee blogs
The increase in employee use of “blogs” and websites intended for sharing personal information creates other potential risks for employers. Employers have a valid interest in ensuring that such websites and blogs are not used to defame the employer or co-workers or to reveal private company or co-worker information.
Employees have protected rights to engage in legal on-work conduct. Consequently, employers can include limited restrictions on employee work-related communications on these personal websites and blogs, but such policies cannot prohibit employees from personal use of the Internet during off-work hours. Employers should also be cautious about use of information that they might obtain by accessing employees’ private websites.
Labor rights - a privacy trump card?
Although not “privacy” rights in a traditional sense, the National Labor Relations Act guarantees employee rights to freely engage in concerted or union related activity, including the right to discuss such matters away from the employer’s eyes and ears. The separate statutory source for these rights means that situations can arise where, even though the civil courts might view an employee’s privacy rights as diminished, or the employer’s right to access and review information on workplace computers as clear, the NLRB might nonetheless conclude that the actions of the employer in doing so are unlawful. In a potentially landmark case presently pending after oral argument case,5 the NLRB posed the questions for decision:
- Do employees have a right to use their employer’s e-mail system (or other computer-based communication systems) to communicate with other employees about union or other concerted, protected matters? If so, what restrictions, if any, may an employer place on those communications? If not, does an employer nevertheless violate the Act if it permits non–job-related e-mails but not those related to union or other concerted, protected matters?
- Should the Board apply traditional rules regarding solicitation and/or distribution to employees’ use of their employer’s e-mail system? If so, how should those rules be applied? If not, what standard should be applied?
- If employees have a right to use their employer’s e-mail system, may an employer nevertheless prohibit e-mail access to its employees by non-employees? If employees have a right to use their employer’s e-mail system, to what extent may an employer monitor that use to prevent unauthorized use?
Work place surveillance
Employers have a variety of business reasons why they may want to monitor their workplace. Depending upon the nature of the business, surveillance may be utilized to prevent theft or to provide enhanced security for the business and its employees. Employers should be aware that there are restrictions on video and/or audio taping in the workplace.
The California Labor Code contains a provision prohibiting audio or video recording of an employee in a restroom, locker room or room designated for changing clothes, unless the taping is authorized by a court order. Video surveillance using a device that records both audio and visual signals has also been found to violate federal law.6 California law also recognizes a tort claim for invasion of privacy, including claims for intrusion into seclusion, which utilizes the “reasonable expectation of privacy” standard for determination of the validity of the claim.
Employers can limit potential liability for such invasion of privacy claims by limiting workplace surveillance to public areas and by giving employees advance notice of the use of surveillance devices.
The danger of using surveillance devices in private areas is illustrated by a recent California case involving installation of motion-activated video surveillance devices in a private office. The employer was using these devices to try to identify individuals who were accessing workplace computers at night to view pornographic websites. The employer did not warn employees about the camera or that they could be subject to video recording in offices. Two female employees sued for violation of privacy asserting that they used the private office to change clothes before going to the gym. The court held that the employees had a reasonable expectation that they would not be videotaped in the office and that the employer had not demonstrated that there were not less intrusive methods of conducting its investigation.7
Employers should also be aware of potential privacy violations created by the use of cellular telephones equipped with digital cameras. Improper use of digital image devices could give rise to harassment claims as well as invasion of privacy claims involving co-workers or other individuals in the workplace. Employers should include prohibitions against improper use of such cameras in the workplace, including use in private areas such as restrooms or locker rooms, in its work rules and/or employee handbook.
Other electronic devices that create the potential for employee privacy violations are global positioning system (GPS) devices or radio frequency identification (RFID)-enabled security badges. These devices allow an employer to monitor employee locations and movement inside and outside of the workplace. If such monitoring occurs during non-work time, including meal and rest periods, employees may assert invasion of privacy claims. Employers should limit the use of such devices and, if possible, use devices which can be turned off when the employee is off duty.
There are many other potential employee privacy issues that are beyond the limited scope of this article. Employers should be aware that privacy issues may arise in situations involving drug and alcohol testing, background checks, credit checks, criminal history checks, and employee medical examinations.
Employers also have obligations to protect employee personnel information, including social security numbers, medical information and other personal information disclosed by the employee during employment and retained in employer records and files.
1 Title VII of the Civil Rights Act, Americans with Disabilities Act and the California Fair Employment and Housing Act.
2 United States v. Ziegler, 456 F.3d 1138 (9th Cir. 2006). Significantly, the Ninth endorsed the rationale of a carefully worded CA appellate case, TBG Ins. Services Corp. v. Superior Court, 96 Cal. App. 4th 443 (Cal Ct. App. 2002) which, in the special context of California’s consti- tutional privacy protection, nonetheless viewed the “diminished expectation of privacy” in work place computers as the “societal norm.”
3 Doe v. XYC Corp., 887 A.2d 1156 (N. J. Super. Ct. Dec. 27, 2005).
4 United States v. Councilman, 418 F.3d 67 (1st Cir. 2005).
5 The Guard Publishing Company dba The Register-Guard and Cases 36-CA-8743-1 36-CA- 8849-1 Eugene Newspaper Guild, 36-CA-8789-1 CWA LOCAL 37194 36-CA-8842-1
6 Electronic Communications Privacy Act of 1986.
7 Hernandez v. Hillsides Inc. , 142 Cal.App. 4th 1377 (Cal Ct. App. 2006). |