Historically, job applicants, employees and independent contractors in the United States (US) have enjoyed limited expectations of privacy as it relates to their engagement with hiring entities and employers. There is no comprehensive US data privacy law governing all 50 US states. The issue of data privacy in the workplace is therefore largely left to the 50 US states to govern. For the past several decades, data privacy within the workplace has been limited to sectoral legislation around specific issues of medical and credit related information. That legal landscape, however, is rapidly changing. New laws governing affirmative privacy rights, biometric information, and the use of artificial intelligence are sweeping the US states, granting individuals new and expanded rights in the workplace and placing expanded compliance obligations on organizations.

Below we highlight several areas of growing importance as it relates to data privacy and security in the workplace, and provide key takeaways for organizations looking to navigate this new and growing legal landscape within the US.

Data Security

Cybersecurity has always been a legal priority for employers within the US. All 50 US states have laws on the books governing the security of job applicant, employee, and independent contractor data, including rules governing when to provide notice to individuals and regulators in the wake of a data breach. Indeed, the Federal Trade Commission (FTC) and its sister counterpart regulators in the US states often regulate employers who maintain unfair or lax security around their workplace data. Under this regime, employers have obligations to undertake reasonable efforts to keep job applicant, employee, and independent contractor data secure, and to report breaches as required by applicable law. As a new wrinkle, the California Consumer Privacy Act (CCPA) provides California residents the ability to bring a private right of action against employers in the event of a negligent data breach, with statutory damages and the ability to recover attorneys’ fees.

Medical Privacy

It has long been the case in the US that medical information must be kept private, confidential, and secure. Under the federal Americans with Disabilities Act (ADA) and its US state counterparts, employers are required to keep the medical records and other health-related information of their employees private and confidential. Medical privacy is also generally covered under the federal Health Insurance Portability and Accountability Act (HIPAA) as it relates to employer group health plans and other scenarios in which hiring organizations and employers may be subject to the scope and application of HIPAA and its state counterparts. New privacy laws such as the CCPA further define medical information as “sensitive” personal information, thus subjecting that data to new rights, limitations, and restrictions.

Location Monitoring

A new California law took effect on January 1, 2023 governing how employers may “track” their employees using some level of GPS monitoring. Under this new law, employers are permitted to “monitor” employee movements (including locating, tracking, watching, or surveilling the employee) through the use of GPS technology so long as it is “strictly necessary for the performance of the employees’” job duties, and so long as certain notice is provided to the employee. This law is a first of its kind in the US as it relates to employee tracking. Whether additional states follow in California’s footsteps remains to be seen.

E-mail and Telephone Monitoring

States such as Connecticut, Delaware, and New York have adopted laws governing when and in what circumstances employers may monitor their employee’s e-mail and telephone communications. The FTC and state counterparts may also regulate any monitoring of such communications if they are unfair or deceptive. Additionally, telephone and electronic surveillance laws in states such as California and Florida may restrict how employees can record or monitor conversations. Many of these laws call out specific requirements around notice and consent.

Biometrics

The collection and use of employee biometric information is increasingly becoming complex within the US. In Illinois, the Illinois Biometric Information Privacy Act (BIPA) requires employees who collect the biometric information and biometric identifiers of their Illinois employees to provide notice, obtain consent, and adhere to certain data minimization principles. Other states, such as New York and California, are considering similar laws. The BIPA is particularly challenging for employers because the law allows for a private right of action, and presents significant risk for employers as it relates to damages and litigation exposure.

Artificial Intelligence

Laws and regulations governing the use of artificial intelligence in employment decision making are being developed at a rapid rate throughout the US. At the federal level, the US Equal Employment Opportunity Commission (EEOC) and the US Department of Justice (DOJ) issued guidance in May 2022 indicating that improper use of artificial intelligence in employment decision making that results in discriminatory outcomes may run afoul of the ADA and Title VII of the Civil Rights Act of 1964. California has proposed similar regulations enforcing the California Fair Employment and Housing Act (FEHA), the California law that regulates discrimination in the workplace. New York City has become the first US jurisdiction to adopt a law that governs the use of artificial intelligence, or automated-decision making tools, in making employment decisions concerning recruitment and the carrying out of employment functions. This new law, which will be enforced beginning in April 2023, requires notice and bias audits to be performed on such tools, and the results of such audits to be made publicly available. Additional states are considering similar rules governing the use of artificial intelligence tools when making employment level decisions. Federal legislation is also pending that would prohibit algorithmic discrimination in the use of automated decision making tools.

New Data Privacy Rights

California became the first US state this year to extend consumer-like privacy rights to California residents in their role as job applicants, employees, and independent contractors. Under the CCPA, covered “businesses” must extent rights of access, deletion, correction, opt-out of the sale / sharing of information, and the right to limit the use of sensitive personal information in certain circumstances. Covered businesses must also extend new privacy policies, adhere to data minimization principles, and treat job applicants, employees, and job applicants as they would any consumer under the law.  Although additional states such as Virginia, Colorado, Utah, and Connecticut have likewise adopted comprehensive data privacy laws, they have not extended such laws in the employment context. And although there are several federal data privacy bills pending, whether any such bills will apply in the workplace context remains to seen.

Key Takeaways

Although the legal landscape in the US as it relates to data privacy and the workplace is rapidly changing, there are some steps organizations can take now to mitigate risk.

• Takeaway #1 – Map Your Data and Exposure. Employers with US based employees should carefully review the jurisdictions in which they operate and map their existing privacy related obligations. If organizations are a covered “business” under the CCPA, they should immediately review their privacy program as it relates to California residents who are job applicants, employees, or contractors. If organizations have operations in New York City, they should immediately consider the artificial intelligence law. And if organizations have employees in Illinois and are collecting any level of biometric information or biometric identifiers, they should carefully consider how such information is being collected and processed.
• Takeaway #2 – Ensure Appropriate Notice and Consent Is Provided. Regardless of whether your organization is subject to new privacy laws in the workplace, it’s always beneficial to review existing handbook disclosures, policies, and notices around privacy and bolster those disclosures to align with best practices and existing legal obligations.
• Takeaway #3 – Don’t Sleep on Security or use of AI. Secure your data. An existing area of risk for employers is the security of their data. Coordinate with your security team, and ask the right question – are we being “reasonable”? What security framework are we measuring our practices against? Are we inclusive to account for job applications and contractor materials? Be sure to also carefully carry out due diligence when using vendors that offer and leverage artificial intelligence to make employment level decisions.
• Takeaway #4 – Consider Strategic Advantages. Even if your organization is not covered under any expanded US data privacy laws, it’s helpful to consider whether it would provide a strategic advantage to offer new and expanded rights to your employee and contractor base. As privacy becomes more of a focus in the US, job applicants, employees, and contractors may expect expanded privacy rights and protections.