Privacy and Security in the Employment Relationship Steve Sheinberg General Counsel and SVP, Privacy and Security Anti-Defamation League SSheinberg@adl.org Blog: workplacetechlaw.com Bret Cohen Privacy & Cybersecurity Group Hogan Lovells bret.cohen@hoganlovells.com Blog: hldataprotection.com October 26, 2016

Privacy and security in the employment relationship Law of employee privacy Building a privacy and security program Hogan Lovells

Law of employee privacy Relatively limited statutory protections for employee privacy In many cases, employee privacy risks can be mitigated by setting proper expectations Be on the lookout for unintended consequences of policies involving the collection of employee information (e.g., discriminatory impact) Hogan Lovells

Employee monitoring: use of corporate IT systems In the U.S., wide latitude for employers to monitor activity on company- owned information systems Liability protection for cybersecurity monitoring Implement an acceptable use policy to set employee expectations Prohibit unlawful uses and describe limits on personal use Preserve the company’s right to inspect and monitor Address off-hours use by non-exempt personnel Notify employees regularly and whenever possible (e.g., banner) Hogan Lovells

Employee monitoring: use of third-party services Corporate security may involve monitoring of third-party services, whether used on the corporate network or outside of work time Be careful about how you gain access to those services State laws prohibiting employers from requesting private passwords from employees Potential liability for accessing password-protected services or personal communications under anti-hacking and wiretapping statutes Case law protecting attorney-client communications Hogan Lovells

Employee monitoring: NLRB and social media National Labor Relations Act prohibits even non-union employers from restricting employee organizing rights Employee organizing rights include communicating with each other about terms and conditions of employment NLRB has focused on employer social media policies, prohibiting: Discipline of employees for protected online communications about workplace Adoption of overbroad rules restricting employee communications about workplace Hogan Lovells

Employee monitoring: audio/video monitoring Some statutes prohibit video monitoring in specific sensitive areas (e.g., bathrooms) Elsewhere, video monitoring will be subject to “intrusion” test Audio monitoring In most states, call or other audio recording requires the consent of at least one party to the communication Be cautious of all-party consent states Hogan Lovells

Employee monitoring: physical and productivity monitoring Increase in metrics, sensors, Internet of Things, and Big Data creates opportunities to measure and increase workplace efficiency Beware of algorithmic bias Geolocation tracking When do asset-tracking and productivity monitoring cross the line? Hogan Lovells

Background checks FCRA and state laws require employee consent prior to conducting a background check for employment purposes Federal law covers use of third parties; some state laws cover employer checks as well Requirements to provide adverse action notices and the opportunity to correct Non-traditional background checks are covered (e.g., social media checks) Be careful to avoid discrimination issues Including non-traditional discrimination (e.g., lawful off-duty conduct) Insulate decision-makers from factors that could be considered discriminatory Hogan Lovells

International issues Stronger privacy protections for employee information in the EU and in countries with EU-style comprehensive privacy laws Employee notices Restrictions on cross-border data transfers Greater restrictions on monitoring of electronic resources Employee hotline regulation (e.g., anonymous reporting) Works council consultation for IT policies Hogan Lovells

Building a privacy and security program The key to mitigating privacy and security risks in the workplace is creating a privacy-aware corporate culture that motivates and trains employees to be part of that culture Hogan Lovells

Building a privacy and security program Create employee policies that recognize that employees are the main threat vector. Teach employees, especially about social engineering. Talk to the CIO. Get good agreements with vendors and key employees. Strive for Cyber Resiliency Follow the principle of least privilege. Update software, install patches, remove non-approved software. Ensure that your physical security is sufficient. Encrypt all data, period. Segregate differing data onto separate networks. Monitor network traffic. Use two-factor authentication. {Most of this is policy, not tech, driven} Hogan Lovells

Questions? Bret Cohen Privacy & Cybersecurity Group Hogan Lovells Steve Sheinberg General Counsel SVP, Privacy and Security Anti-Defamation League SSheinberg@adl.org Blog: workplacetechlaw.com Bret Cohen Privacy & Cybersecurity Group Hogan Lovells bret.cohen@hoganlovells.com Blog: hldataprotection.com Hogan Lovells