Workplace Privacy Counsel : San Francisco Employment Privacy Law Lawyer & Attorney : Littler Mendelson Law Firm : Employment Related Privacy Issues

The European guidance is especially noteworthy for multi-national employers. Although this guidance, as its title suggests, deals almost exclusively with tracking consumers, the guidance contains a short section—which received scant public attention—that squarely addresses tracking employees. The guidance explains that it is unlawful for employers in the E.U. to track their employees unless “it is demonstrably necessary to supervise the exact locations of employees for a legitimate [business] purpose.” Even then, continuous monitoring generally is impermissible, and employees must be able to turn off location tracking during non-work hours. The guidance also discourages employers from using vehicle tracking devices to monitor the behavior of employees by, for example, recording the vehicle’s speed. Given this guidance, multinational employers should closely scrutinize the nature and scope of any location-tracking program before implementing it in the European Union.

The U.S. Supreme Court’s decision next term in U.S. v. Maynard also could have an impact on U.S. employers. As we explained in our blog post on the D.C. Circuit’s decision that is subject to Supreme Court review, a ruling that law enforcement’s 24/7 use of surreptitious location tracking violates the Fourth Amendment arguably could be used to support a claim against employers that engage in 24/7 location tracking without notice to employees. The rationale for such a decision likely would be that continuous tracking establishes a pattern of activity over a period of time which reveals private information about the target of the tracking, such as whether the person is a recovering alcoholic as reflected by regular visits to Alcoholics Anonymous meetings, is considering pregnancy as suggested by weekly trips to a fertility clinic, or is having an extra-marital affair. Despite the distinctions between Fourth Amendment standards and the elements of the common law tort of invasion of privacy, this rationale likely would apply with equal force in the common law context.

Finally, while the Congressional activity to date has focused on consumer privacy, it would not require a substantial leap in legislative drafting to extend the coverage of these bills to location tracking of employees. Alternatively, state legislators, taking the cue from Congress, might implement state-specific requirements, which could result in an unwanted patchwork of requirements for multi-state employers.

While U.S. employers currently are subject to virtually no regulation when tracking employees, the keen focus on the issue in Europe, in the criminal context, and in the consumer sphere very well may spill over to the U.S. workplace. Employers that use, or that are considering using, location tracking in their workplaces should continue to monitor these developments closely.

Photo credit: binabina

The implications of this line of reasoning on E.U. data protection law are potentially profound. Attorneys often will be among the most highly educated members of an employer’s workforce. They have been trained to exercise independent judgment and, of course, have an ethical obligation to their client to do so. If Europe’s highest court has concluded that the employer–employee relationship fundamentally compromises an attorney’s ability to engage in independent decision-making — notwithstanding their education and professional responsibilities, employers can expect to face a heavy burden in persuading E.U. data protection authorities that factory workers, customer sales representatives, or even low- or mid-level managers voluntarily consented to the processing of their personal data.

For further analysis of this development, see Littler ASAP The European Court of Justice Reaffirms that Communications with In-House Counsel May Not Be Privileged in Europe by Nick Linn.

This entry was written by Philip L. Gordon.

Photo credit: FotografiaBasica

According to a report issued last week by the School District’s attorney and recent news reports, the School District installed a program called Theft Tracker on more than 2,000 laptops issued to students. When activated, the program records the laptop’s Internet address, captures an image of anything on the computer’s screen, and takes a Webcam photo every fifteen minutes until the program is deactivated. Theft Tracker downloaded all captured information and images to the School District’s server and erased them from the laptop’s memory. The program reportedly was responsible for taking 56,000 photographs. Approximately two-thirds were related to six laptops that actually had been stolen. The local police relied on at least some of those photos to recover the stolen laptops. Many of the remaining pictures, however, were taken because School District employees forgot to deactivate Theft Tracker after students reported that they found laptops that had been reported stolen.

Since the story broke, the School District has found itself at the center of a maelstrom. At least one student has sued the School District, alleging invasion of privacy. The FBI is investigating for potential criminal conduct. Congress held hearings on surreptitious surveillance, and Senator Arlen Specter proposed the "Surreptitious Video Surveillance Act," to extend the Federal Wiretap Act to video surveillance without prior notice. Editorialists and the media have hammered the School District. What went wrong?

According to one news report and the School District’s attorney, the School District made several mistakes:

• The School District did not have written policies and procedures regulating the use of Theft Tracker.
• Parents and students were not provided with an explanation of the program and not required to consent to its use.
• Students were asked to sign a policy that related only to use of the School District’s own network and did not mention school-issued laptops.
• There was no written policy concerning disclosure to law enforcement authorities of information obtained through Theft Tracker

In addition, the School District apparently conducted no legal analysis before implementing Theft Tracker to identify and assess the potential legal risks.

Employers who consider implementing a program like Theft Tracker or otherwise want to activate Webcams on company-issued laptops should learn the lessons of Lower Merion School District’s disastrous foray into webcam use. The employer must first have a detailed understanding of the technology’s capabilities and subject the technology to a rigorous legal review. If, for example, the technology is capable of recording audio, its use could constitute unlawful wiretapping, especially in states where consent is not a defense unless all parties to the communication have consented. Running afoul of the two-party consent laws is easy especially when family members, house guests, and others who have not consented to the use of the technology could be recorded. Similarly, non-employees could easily be photographed without their knowledge or consent, potentially giving rise to a claim for invasion of privacy.

If an employer determines that the benefits of the technology outweigh the risks, it still should implement detailed, written policies and procedures concerning the technology’s use to mitigate those risks. The guidelines should address at least the following: (1) identification of the employees authorized to activate the program; (2) identification of the management-level employees that must approve activation of the program; (3) circumstances in which the program may be activated; (4) the duration of the monitoring; (5) security for the fruits of the monitoring; (6) identification of the employees permitted to access the fruits of the monitoring; (7) how the fruits of the monitoring may be used; (8) when the fruits of the monitoring may be disclosed to law enforcement; and (9) how long the fruits of the monitoring will be retained.

The employer also should provide employees with full and fair notice of how the technology will be used and obtain the employee’s affirmative consent to its use. The notice should include, at a minimum, an explanation of the technology, the circumstances in which it will be activated, how the fruits of the monitoring may be used, and to whom they may be disclosed. Employers should beware that even after taking all of these precautions, use of webcams might be illegal in certain non-U.S. countries, such as the member states of the European Union.
 

This entry was written by Philip L. Gordon.

The convictions have wide ranging implications for e-commerce, but what are the implications for global businesses with employees in the European Union?

First, the Google convictions serve as an important reminder that government authorities in the E.U. are serious about enforcing data protection laws. Thus, U.S.-based multi-nationals need to confirm that their local affiliates are complying with local data protection law. Of equal importance, international transfers of employee data to the U.S. — for example, for inclusion in a centralized human resources data base — must satisfy local data protection requirements. Even after the employee data has been received in the U.S., data protection requirements (in addition to any imposed by U.S. law) will apply.

Second, the Google convictions highlight for U.S. employers a critical distinction between U.S. and E.U. privacy law. Under U.S. law, an employer’s legitimate business interests typically trump an employee’s countervailing privacy interests. U.S. employers, for example, have substantial leeway in conducting workplace video surveillance and searches of employees to prevent theft or deter workplace violence. In the E.U., privacy is a fundamental right that, as the Google convictions demonstrate, does not give way even to the freedom of expression so cherished and zealously protected in the U.S. According to the Italian prosecutor, protecting the dignity of the bullying victim took precedence over Google’s commercial interests, including its interest in being a platform for expression and communication over the Internet.

Finally, “privacy” in the E.U. is conceptually far broader than the “right to be left alone” underpinning U.S. privacy law. In the E.U., “privacy” encompasses the notion of data protection. Consequently, any use of individually identifiable information about a natural person — even a business e-mail address and phone number — is presumed unlawful unless the possessor of that information (known in E.U. law as the “data controller”) has a lawful justification for using the information. This prophylactic approach contrasts starkly with U.S. law which permits the use of personal information at the possessor’s discretion unless the law expressly prohibits or restricts the use. Moreover, such prohibitions and restrictions typically are confined to discrete categories of employee information, such as health information.

In short, the Google convictions should serve as a blinking yellow light to every U.S. employer with operations in the E.U., warning employers to consider potential implications under E.U. data protection law before using individually identifiable information about any employee who resides in the E.U.

This entry was written by Philip L. Gordon.

• Multinationals must take compliance with all of the Safe Harbor’s requirements seriously; there is now some enforcement risk.

• The nature of the enforcement risk is uncertain. The FTC’s charges required virtually no enforcement resources. The agency had to do nothing more than compare the target’s statements in their publicly posted Safe Harbor privacy policy against the certification records maintained by the Commerce Department. These settlements do not (at least yet) reflect the agency’s intention to perform on-site audits to determine whether the multinational’s internal process for handling personal data actually conforms to the seven Safe Harbor principles embodied in the organization’s Safe Harbor privacy policy.

• The next, most likely enforcement step would be the FTC’s request to review the mandatory, annual self-assessment or third-party assessment of Safe Harbor compliance. The FTC would not have to expend any resources to “look behind” the assessment to find a violation. The failure to conduct the required annual assessment itself would be a violation.

• Given the above, multinationals certified to the Safe Harbor should promptly confirm that their certification is current and conduct an assessment of their compliance with the Safe Harbor if they have not performed one during the preceding year. To the extent the assessment reveals any gaps in compliance, the gaps should be closed.

This entry was written by Philip L. Gordon.

Photo Credit: S. Solberg J.