Workplace Privacy: New Technology, New Challenges Second Quarter Roundtable June 16, 2015

Transcription

1 Workplace Privacy: New Technology, New Challenges Second Quarter Roundtable June 16, 2015 Susan Kline Kathleen B. Rice What s Keeping You Up at Night? 2 Topics to Cover Employer surveillance and monitoring of employees Applicable laws Practical considerations Data collection, sharing, and retention Understanding the legal requirements Keeping information secure Recordkeeping and discovery obligations Handling a compromise of information 3 1

2 Why This is Important for Employers Data security incidents are on the rise. Billions lost in cyber theft of intellectual property Breach costs as high as $200 per record Impact on product or environmental safety Lawsuits and regulatory enforcement actions Increased focus on privacy Legislative and regulatory responses from policymakers Specific protections required for certain types of information Lawsuits and regulatory enforcement actions Employee morale 4 U.S. Constitution (public employers) First Free Speech Fourth Unreasonable Searches and Seizures Ninth and Fourteenth - Privacy Interests Federal laws EEO and labor laws Electronic Communications Privacy Act Stored Communications Act Federal Wiretap Act Computer Fraud and Abuse Act Sector-specific laws (e.g., HIPAA) 5 ECPA Exceptions (e.g., consent, business purpose) Computer Fraud and Abuse Act Civil and criminal penalties Used to support claims against employees / former employees for misappropriating confidential information Difficult to prove: (1) without authorization; and (2) damage or loss 6 2

3 State constitutions 10 states have explicit guarantee of privacy AK, AZ, CA, FL, HI, IL, LA, MT, SC, WA State laws* ER access to EE online accounts CO, MI Collection / use of SSNs CO IN (public employers only) MI MN 7 Common Law Torts Invasion of Privacy Intrusion upon solitude or seclusion Misappropriation Public disclosure of private facts False-light privacy invasion 8 Data Collection, Sharing, and Retention Know your organization Increased regulatory focus on tone at the top Know your data Understand all the different types of employee, consumer, or proprietary information your company may hold Understand and implement safeguards, as required or appropriate Know your risks Insider threat Including inadvertent Cyber attack Physical threats Natural disaster 9 3

4 Know Your Organization Who in management is responsible for data security and privacy issues? How is that conveyed to employees? Does your organization have an updated incident response plan? Practice, practice, practice Has your organization developed and circulated data security and privacy policies and practices? Update as data sets or circumstances change Convey clearly to employees Does your organization have insurance, or appropriate legal protections, to cover the costs of responding to and mitigating a breach? 10 Know Your Data Who is collecting your data? Employees, vendors, third parties What type of information is it? Personal information Different definitions under state laws Social security numbers Protected health information Proprietary information Where is the data coming from? International privacy considerations Why are you collecting, sharing, or retaining the data? 11 Know Your Risks Is management kept informed about potential threats and vulnerabilities? e.g., data breaches, employee error, natural disasters How is your data being used or accessed? Understand risks from vendors, affiliates, bring-your-own-device Make sure that uses are appropriate and consistent with stated policies Discovery obligations Third-party requests administrative agencies, former employees legal counsel Corporate transactions and personnel files Stock v. Asset purchases 12 4

5 Know Your Risks Are your employees properly trained on privacy and data security? Proper and current training Encourage compliance Immediate reporting of security / data breaches Specific state requirements 13 Here to Help Kathleen Rice Counsel South Bend Compliance and Government Outreach FaegreBD.com/kathleen-rice T: kathleen.rice@faegrebd.com Susan Kline Partner Indianapolis Labor and Employment FaegreBD.com/susan-kline T: susan.kline@faegrebd.com Leita Walker Partner Minneapolis Intellectual Property FaegreBD.com/leita-walker T: leita.walker@faegrebd.com 14 5