Workplace Privacy Counsel : San Francisco Employment Privacy Law Lawyer & Attorney : Littler Mendelson Law Firm : Employment Related Privacy Issues

The convictions have wide ranging implications for e-commerce, but what are the implications for global businesses with employees in the European Union?

First, the Google convictions serve as an important reminder that government authorities in the E.U. are serious about enforcing data protection laws. Thus, U.S.-based multi-nationals need to confirm that their local affiliates are complying with local data protection law. Of equal importance, international transfers of employee data to the U.S. — for example, for inclusion in a centralized human resources data base — must satisfy local data protection requirements. Even after the employee data has been received in the U.S., data protection requirements (in addition to any imposed by U.S. law) will apply.

Second, the Google convictions highlight for U.S. employers a critical distinction between U.S. and E.U. privacy law. Under U.S. law, an employer’s legitimate business interests typically trump an employee’s countervailing privacy interests. U.S. employers, for example, have substantial leeway in conducting workplace video surveillance and searches of employees to prevent theft or deter workplace violence. In the E.U., privacy is a fundamental right that, as the Google convictions demonstrate, does not give way even to the freedom of expression so cherished and zealously protected in the U.S. According to the Italian prosecutor, protecting the dignity of the bullying victim took precedence over Google’s commercial interests, including its interest in being a platform for expression and communication over the Internet.

Finally, “privacy” in the E.U. is conceptually far broader than the “right to be left alone” underpinning U.S. privacy law. In the E.U., “privacy” encompasses the notion of data protection. Consequently, any use of individually identifiable information about a natural person — even a business e-mail address and phone number — is presumed unlawful unless the possessor of that information (known in E.U. law as the “data controller”) has a lawful justification for using the information. This prophylactic approach contrasts starkly with U.S. law which permits the use of personal information at the possessor’s discretion unless the law expressly prohibits or restricts the use. Moreover, such prohibitions and restrictions typically are confined to discrete categories of employee information, such as health information.

In short, the Google convictions should serve as a blinking yellow light to every U.S. employer with operations in the E.U., warning employers to consider potential implications under E.U. data protection law before using individually identifiable information about any employee who resides in the E.U.

This entry was written by Philip L. Gordon.

As security manager at a Polaris Industries facility, Troy Schmidt an employee of Polaris’ security provider, was responsible for creating identification badges of Polaris employees using photographs stored on a Polaris database. Schmidt copied the photographs of approximately thirty, female Polaris employees to a flash drive, printed them at home, ejaculated on them, and posted the adulterated photographs on an adult website that he created through Yahoo!.

Polaris promptly took control of the efforts to reverse the harmful effects of Schmidt’s bizarre conduct. Polaris took the following steps:

• Investigated and determined that Schmidt was the likely perpetrator;
• Contacted Yahoo! to request the removal of the photographs;
• Met with Schmidt and obtained his admission to the conduct;
• Obtained Schmidt’s agreement to de-activate the website;
• Obtained confirmation from Yahoo! that Schmidt had de-activated the website;
• Met with police personnel (who declined to prosecute).

After learning of the matter from Polaris, Schmidt’s employer, the security company, offered to provide assistance, participated in the interview of Schmidt, and fired him shortly after hearing his admission. Notably, the ten plaintiffs sued only the security company and not Polaris.

In reversing the large judgment against the security company, the Wisconsin Court of Appeals pronounced a rule that should provide a measure of relief for all employers: “[E]mployers have no duty to supervise employees' private conduct or to persistently scan the world wide web to ferret out potential employee misconduct.”

Beyond that pronouncement, the court emphasized several other factors. Schmidt’s conduct was “bizarre and unexpected,” indeed “unimaginable.” The security company had trained Schmidt in sexual harassment, employee theft, and his duty to comply with Polaris’ computer usage policy. The security company had no reason to know that Schmidt might engage in Internet abuse. The security company cooperated in Polaris’ response to the incident to the extent permitted by Polaris.

The court’s rejection of a duty to monitor employees’ off-duty Internet activities appears to provide employers with an unbeatable defense in cases like this one. Still, the result might have been different had Schmidt’s employer not provided training, or if Polaris and the security company had not acted promptly once the offending conduct became known. Consequently, when there is a tight nexus between an employee’s job duties and an employee’s off-duty Internet abuse, employers should consider taking some of the proactive measures that Polaris and the security company took. Such measures might not only help to defeat liability but prevent the filing of a lawsuit in the first place.

This entry was written by Philip L. Gordon.

Photo Credit: Matthew Bowden

Key to the decision was the following company policy: “[I]nternet use and communication . . . are considered part of the company’s business and client records. Such communications are not to be considered private or personal to any individual employee.” Put another way, Loving Care told its employees that their Internet use is not private. Stengart’s Internet-based e-mail fell squarely within the policy. As a result, she could not claim the e-mail was protected by attorney-client privilege.

There are two important takeaways for employers. First, be specific about online privacy using the company’s electronic resources. In particular, tell employees that they should not use the company’s Internet connection to access personal e-mail accounts for purposes of conducting company business or to send any e-mail that they wish to keep private.

Second, ensure that you can prove each employee knows the rules. Stengart tried to claim that she was not aware of Loving Care’s Internet policy. The trial court rejected that argument because she was a long-time employee with significant management responsibility. Lower-level, shorter-term employees may have a more credible argument. To defeat that argument before it is made, employers should document that each employee has acknowledged receipt of the company’s electronic resources policy.

This entry was co-authored by Philip L. Gordon and Kate H. Bally.