Workplace Privacy, Data Management & Security Report : Privacy Lawyers & Attorneys : Jackson Lewis Law Firm : Data Security, HIPAA & Confidentiality Issues

Earlier this year, we posted about new laws in Utah and New Mexico that limit employers' ability to access the online accounts of their employees. Since then, Washington and Colorado have joined these and other states, such as Maryland, Illinois, California, Michigan, that have enacted similar laws. Oregon and New Jersey appear to be not far behind regulating employers in this area. 

Increasingly, employers across the country will need to revisit some of the hiring and monitoring practices they may be following, in particular, those of lower level managers and supervisors who may not be aware of these developments. Companies also need to reconsider what role they want employees to play in the businesses' marketing strategies in social media.  

Colorado. Governor John Hickenlooper signed HB 13-1046 into law on May 11, 2013. Under the new law, employers may not "suggest, request or require" or cause employees or applicants to (i) disclose the means of accessing the employees or applicants' personal account or service through the employees or applicants' electronic communication device, or (ii) change their privacy settings for an associated social networking account. An employer also may not compel an employee or applicant to become a friend, contact or connection of the employer or the employer's agent. Employers may not fail or refuse to hire applicants, or discipline or otherwise penalize employees, who refuse to provide access to their personal accounts or add the employers to their contacts.

The good news for employers is that the law does not prohibit them from requiring employees to provide access, including user name and password, to non-personal accounts or services that allow access to employers' information systems. The law also does not prohibit certain employers (those in certain industries (e.g., securities, finance) who have to comply with certain regulatory requirements) from conducting investigations concerning the use of personal websites, web-based accounts or similar accounts by an employee for business purposes. The same is true for investigations involving the unauthorized downloading of employer proprietary or financial information to a personal website, web-based account or similar account.

The new Colorado law does not provide for a private right of action, but injured persons may file a complaint with the Department of Labor and Employment, which may impose fines of up to $1,000 for a first offense, and not more than $5,000 for subsequent offenses.   

Washington. Gov. Jay Inslee signed a similar law (SB 5211) on May 21, 2013, that contains restrictions on employers concerning the personal online accounts of their employees. The law also contains similar exceptions concerning employee investigations. The law becomes effective on July 28, 2013. 

Oregon. Last week, the Oregon legislature sent HB 2654 to the Governor's desk for signature. Like the two measures above, the law would prohibit employers from requiring or requesting access to the personal social media accounts of employees or applicants, as well as prohibiting employers from requiring employees or applicants to make the employer a contact or connection of the employer. Unlike the laws discussed above, the current version of the bill does not include an investigation exception.

New Jersey. Responding to Governor Chris Christie's concerns about a prior version of the bill (such as objecting to a provision that would have made it illegal to ask an employee if he or she has a Facebook account), the New Jersey General Assembly recently approved unanimously modifications to A2878, making it virtually certain to become law in New Jersey in the short term. The Governor has already signed a similar law protecting access to the social media accounts of university students and applicants.

Similar to the laws described above, A2878 would prohibit employers from requiring or requesting employees or applicants to disclose login information for their personal social media accounts. The law also proscribes retaliating or discriminating against any employee or applicant who fails to provide such information, reports a violation of the law, participates in an investigation or otherwise opposes a violation of the law. However, the new version of the law no longer provides for a private right of action, but civil penalties can be imposed for violations - up to $1,000 for the first violation,  $2,500 for each subsequent violation.

• Email This
• Print
• Comments
• Trackbacks

Shortly after Utah inked its own law, New Mexico Governor Susana Martinez signed S371 into law on April 5, 2013. Similar to the provisions in other states (such as, California, Illinois, Maryland and Michigan), S371 makes it illegal for employers to request or require applicants to provide a password, or demand access in any manner, to an applicant's social media account or profile. Unlike some of the laws in other states, the New Mexico statute appears to apply only to prospective employees, but not current employees.

Additionally, S371 makes clear that certain activities by employers are not affected by the law, namely:

• having electronic communication policies in the workplace addressing internet use, social networking activity and email,
• monitoring use of the employer’s information systems and networks,
• using information that is publicly available on the Internet, although as noted in prior posts there may be other risks to employers engaging in these activities, such as under the Genetic Information Nondiscrimination Act.

• Email This
• Print
• Comments
• Trackbacks

Prepared by Jason Gavejian and Joseph Lazzarotti

In honor of National Data Privacy Day, we have laid out 13 key issues affecting businesses in 2013. While the list is by no means exhaustive, it does provide critical areas businesses will need to consider in 2013.

1. BYOD. As advancements in technology continue at a breakneck pace, many businesses are confronted with the idea of implementing a Bring Your Own Device (“BYOD”) program. Under these programs, employees are permitted to connect their own personal devices to the company’s networks and systems to complete job tasks either in the office or working remotely. While BYOD programs have advantages, they also have associated risks. Developing a thorough implementation strategy with appropriate policies is critical.
2. Bans On Requesting Social Media Passwords. As we have previously discussed  fourteen states introduced legislation in 2012 which would prohibit employers from requiring current, or prospective, employees to disclose a user name or password for a personal social media account. Six states have passed and/or enacted such legislation and it is anticipated that other states will pass similar measures in 2013.
3. Final HIPAA Regulations. On January 17, 2012, the Office for Civil Rights released final privacy and security regulations under the Health Insurance Portability and Accountability Act. In addition to incorporating the HITECH Act which, among other things, expands the application of the rules to business associates, the final rules also apply the rules to subcontractors and remove the risk of harm trigger for data breaches affecting unsecured protected health information.
4. Disaster Recovery Plans. Hurricane Sandy caused extensive damage on the east coast in 2012, greatly affecting not only personal residences, but many businesses up and down the coast. Unfortunately, protecting information and technology assets from natural disasters and other emergencies is often an afterthought. However, developing a comprehensive disaster recovery plan now can avoid the significant expense, and often irretrievable loss of data, associated with natural disasters.
5. Develop a Plan for Responding to a Breach Notification. All state and federal data breach notification requirements currently in effect require notice be provided as soon as possible. Delays in notification viewed as unreasonable could trigger an inquiry by the state’s Attorney General, or in the case of HIPAA protected health information, the Office of Civil Rights. This is true even when the number of individuals affected is relatively small.
6. Investigating Social Media. As the use of social media continues to grow throughout the world, it is only natural that social media content is being sought to aid in litigation. While public content may generally be utilized without issue, if private content is accessed improperly, serious repercussions can follow. This is especially true for attorneys and their staff who attempt to aid their clients by accessing social media content.
7. International Data Protection. More and more company information is being stored in electronic format and shared with various corporate divisions through company intranets or email. While U.S. law requires some safeguarding of this information, international protections on personal information can be much more stringent. When the transfer of data across international borders is possible, or actively occurring, companies should be advised on the potential risks and requirements associated with same.
8. Develop a Written Information Security Program. Even if adopting a written information security program (WISP) to protect personal information is not an express statutory or regulatory mandate in your state, having one is critical to addressing information risk. Not only will a WISP better position a company when defending claims related to a data breach, but it will help the company manage and safeguard critical information, and may even help the company avoid whistleblower claims from employees. For some companies, a WISP can be a competitive advantage. Of course, in states like Massachusetts, Maryland, Oregon, Texas, Connecticut and others, a WISP in one form or another is required.
9. Risk Assessment. Many businesses remain unaware of how much personal and confidential information they maintain, who has access to it, how it is used and disclosed, how it is safeguarded, and so on. Getting a handle on a business' critical information assets must be the first step, and is perhaps the most important step to tackling information risk. You simply can’t adequately safeguard something you are not aware exists. And failing to conduct a risk assessment may subject the business to penalties under federal and/or state law.
10. Insurance. Like many other risks, information risk can be addressed in part through insurance. More carriers are developing products dealing with personal information risk, and specifically data breach response. This kind of coverage should be a part of any CIO, privacy officer or risk manager’s toolkit for safeguarding information.
11. Training. A necessary component of any WISP and a required element under most federal and state laws mandating data security is training. In addition to meeting compliance requirements, training employees and supervisors also will aid in defending any potential breach of privacy claim that may be asserted against the company.
12. Carefully Integrate New Technologies. As businesses look for new technologies to increase productivity, cut costs, and gain a competitive advantage, how those technologies address information risk must be a factor in the decision to adopt.
13. Watch for New Legislation. Today, managing data and ensuring its privacy, security and integrity is critical for businesses and individuals, and is increasingly becoming the subject of broad, complex regulation. As no national law requiring the protection of personal information has yet to be passed in the U.S., companies are left to navigate the constantly evolving web of growing state legislation. Companies therefore need to stay tuned in order to continue to remain compliant and competitive in this regard.

• Email This
• Print
• Comments (1)
• Trackbacks

Written by Jason Gavejian

One of the hottest topics throughout 2012 was the various states which passed, or enacted, legislation which prohibits employers from requiring current, or prospective, employees to disclose a user name or password for a personal social media account, such as Facebook or LinkedIn. In fact, this issue was recently featured in an article on nbcnews.com.   

Notably, fourteen states introduced such legislation in 2012, with Michigan becoming the most recent state to enact such legislation when Governor Rick Snyder signed his state’s equivalent law (HB 5523) last Friday. As we have discussed, California, Delaware (dealing with students at colleges and universities), Illinois, Maryland, and New Jersey (pending Governor's signature) also enacted laws on this issue in 2012.

We anticipate that other states will address this issue through legislation in 2013 and beyond. It is essential for businesses to be conscious of these new laws, and to carefully consider this issue whether or not the state in which they operate currently prohibits such conduct.
 

• Email This
• Print
• Comments
• Trackbacks

Leaving single copies of email on the server of one's web-based email account (in this case Yahoo!) without downloading them or saving them to another location does not constitute storing the emails for backup protection under the Stored Communications Act (SCA), according to the South Carolina Supreme Court. Jennings v. Jennings, S.C. Sup. Ct. Oct. 12, 2012, No. 27177. This case arises out of civil litigation relating to a domestic dispute, but can affect how the SCA is applied in other contexts where a person's or employee's email account is accessed by an unauthorized third party. The case also highlights the difficulty courts have had with consistently applying this somewhat dated law to current technology.  

When the plaintiff's spouse learned her husband was having an affair, she confided in her daughter-in-law who then gained access to the husband's Yahoo! account which contained emails corroborating the affair. When these emails became part of the divorce proceedings, the husband sued and alleged, among other things, that his Yahoo! account had been illegally hacked under the SCA. The court of appeals found that the e-mails were in electronic storage, therefore triggering the SCA. The state's Supreme Court disagreed. 

The SCA is violated when a person:

(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or

(2) intentionally exceeds an authorization to access that facility;

and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.

18 USC 2701(a). However, the decision came down to the meaning of "electronic storage," defined in 18 USC 2510(17) to mean:

(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and

(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication;

The Court acknowledged differing views on how this definition has been interpreted - noting that the Department of Justice prefers the interpretation that both (A) and (B) be established to constitute electronic storage, while a majority of courts have found only one of the two prongs needs to be met. Because the plaintiff only alleged storage under (B), the Court focused on when electronic communications are stored for purposes of backup protection.

In that connection, the Court noted that the plaintiff left single copies of his e-mails in his Yahoo! email account, without saving or downloading them elsewhere. Looking to a dictionary definition of "backup" - "one that serves as a substitute or support" - the Court held that use of a backup presupposes the existence of another copy. Since there was no other copy according to the Court, the plaintiff could not have been storing the email for backup protection and, therefore, the defendant could not have violated the SCA.  A concurring opinion by Judge Kittredge, however, suggests a more in-depth analysis.

This case make clear that businesses, attorneys and individuals need to proceed with caution when conducting investigations that involve electronic communications, a necessary source of information for just about any investigation. Something that may appear to be clearly in or not in "storage," may not hold true should the matter be analyzed by a court, or a state or federal agency.     

• Email This
• Print
• Comments
• Trackbacks

. . . A Potential Headache for Employers of Younger Workers

Written by Lillian Moon

Retail, entertainment, hospitality and other industries that traditionally employ large numbers of younger workers may soon get dragged into criminal proceedings because of “sexting” by their younger workers. Florida has joined 20 other states — Alaska, Arkansas, California, Hawaii, Indiana, Iowa, Kansas, Mississippi, Nevada, New Jersey, New York, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Texas, and Guam — which have all enacted similar legislation addressing teen sexting. Because employees frequently transmit these materials using their employer’s networks, criminal prosecutions under these laws may require employers to respond to discovery requests and subpoenas, or permit searches pursuant to warrants obtained by law enforcement authorities, which, in turn, may unexpectedly trigger disciplinary proceedings.

On June 21, 2011, Florida Governor Rick Scott signed into law H.B.75/S.B. 888. Under this law, which will take effect beginning October 1, 2011, a minor (anyone under the age of 18) commits the criminal act of “sexting” if he or she knowingly uses a computer, cell phone, or other transmission device (1) to transmit or distribute to another minor a photograph or video of any person which depicts nudity; or (2) possesses such photograph or video which was transmitted or distributed by another minor, unless the photograph was unsolicited, the minor took reasonable steps to report the photograph or video to their legal guardian, school official, or law enforcement, and the minor did not transmit or distribute the video or photograph to a third party. A minor’s first offense is considered noncriminal and is punishable by 8 hours or community service or a $60 fine. The minor’s second offense is a misdemeanor in the first degree, punishable with imprisonment not to exceed one year or a $1,000 fine; and the minor’s third offense is a felony of third degree, punishable with up to five years’ imprisonment or a $5,000 fine.

Of course, sexting is not only an issue for minors. It is fast becoming an easy and well-utilized mechanism for sexual and other workplace harassment. Accordingly, employers should review and update their anti-harassment policies to include a prohibition of harassment via e-mail, text messaging, or use of social networking sites; and they should review their electronic communications policies to include a prohibition against using any employer-provided electronic device to transmit or retain any sexually suggestive or explicit pictures, texts, videos or any other derogatory material regarding race, ethnicity, age, disability, religion, or any other protected category. Employers should also educate and train employees on the revised policies and continue to enforce all policies in a fair and consistent manner. At the same time, employers should remain mindful of any limitations on such policies (as written or as applied) that may be imposed under the National Labor Relations Act.
 

• Email This
• Print
• Comments
• Trackbacks

What is a company’s recourse when a former employee deletes e-mails and other company electronic information before he leaves? A case from Indiana provides a lesson.

When Meridian Financial Advisors began serving as Receiver for bankrupted OCMC, Inc., it took possession of a number of OCMC computers, including one belonging to Joseph A. Pence, OCMC's President and CEO. In the course of its investigation, Meridian learned that OCMC employees, including Mr. Pence, had deleted e-mails and computer documents detailing improper conduct just before leaving OCMC. Meridian filed suit against Pence and others in connection with OCMC's collapse, including a claim for civil damages under the Computer Fraud and Abuse Act (“CFAA”) for damaging OCMC’s protected computers. Meridian Fin. Advisors Ltd. v. Pence, No. 07-995 (S.D. Ind. 1/14/11).

A person violates CFAA by:

knowingly caus[ing] the transmission of a program, information, code, or
command, and as a result of such conduct, intentionally caus[ing] damage without authorization, to a protected computer. 18 U.S.C. § 1030(a)(5)(A)(i).

Civil penalty provisions under the CFAA allow for recovery of compensatory damages when the damage exceeds $5,000.

Pence argued that even if a deletion occurred there was no damage to OCMC computers and, therefore, no damage under the CFAA. The federal district court rejected this argument, pointing out that the statute defines "damage" as:

any impairment to the integrity or availability of data, a program, a system, or information 18 U.S.C. § 1030(e)(8). 

The court reasoned that a "deletion of files impairs the availability of data and, as such, is covered under the statute" (citing other cases with similar holdings, Monson v. Whitby Sch., Inc., No 3:09-CV-1096, 2010 WL 3023873, at *3 (D. Conn. Aug. 2, 2010) (under some circumstances, deletion of an employee’s own e-mail can give rise to a CFAA claim); and Condux Int’l, Inc. v. Haugum, No. 08-4824, 2008 WL 5244818, at *8 (D. Minn. Dec. 15, 2008) (same with deletion of evidence of computer use)).

The court went on to address whether Pence deleted the e-mails without authorization, a required element for recovery under the CFAA. While the courts are not in agreement on this issue, the U.S. Court of Appeals for the Seventh Circuit (which has jurisdiction over Illinois, Indiana, and Wisconsin) recognizes that previously authorized use of a computer system may become unauthorized when an employee breaches his duty of loyalty to his employer. Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418, 420 (7th Cir. 2006). The district court in Pence followed the holding in Citrin, although a question of fact remained as to whether Pence actually deleted the e-mails. Because of the open question of fact, the court could not grant Meridian's motion for summary judgment.

Deletion of files is becoming common practice when employees, typically key employees, leave an organization. Where possible, employers should try to prevent the deletions and take steps to better manage their important data. However, when these kinds of deletions happen, in the right cases, the CFAA can be a valuable tool for employers to remedy their damages. 

• Email This
• Print
• Comments
• Trackbacks

Co-author: Joseph J. Lazzarotti

The New Jersey’s highest Court has concluded that an employee, Marina Stengart, could reasonably expect that e-mail communication with her lawyer through her personal, password-protected, web-based e-mail account would remain private, and that sending and receiving them using a company laptop did not eliminate the attorney-client privilege that protected them. The Court went on to say that her employer’s counsel had violated the rules of professional conduct by reading her e-mails. The Supreme Court decided Stengart v. Loving Care on March 30, 2010 upholding the June 2009 decision of the state Appellate Division. 

This case makes two important points for employers: 

1) The Court stated that even a more clearly written and unambiguous policy regarding employer monitoring of emails would not be enforceable. That is, a clear policy stating that the employer could retrieve and read an employee’s attorney-client communication, accessed through a personal, password-protected e-mail account using the company’s computer system will not overcome an employee’s expectation of privacy and the privilege would remain. 

2) The Court's opinion seems to suggest that employers cannot discipline employees for simply spending some time at work receiving personal, confidential legal advice from a private lawyer, although the Court noted that an employee who “spends long stretches of the workday” doing so may be disciplined. 

Loving Care's employee handbook’s “Electronic Communication” policy governed employees’ use of company computers. The policy stated, among other things, “internet use and communication … are considered part of the company’s business” and “such communication are not to be considered private or personal to any individual employee.” However, the policy also provided, “[o]ccasional personal use is permitted.”

The Court found the Policy does not give express notice to employees that messages exchanged on a personal, password-protected, web-based e-mail account are subject to monitoring if company equipment is used. Although the Policy states that the company may review matters on “the company’s media systems and services,” those terms are not defined. The prohibition of certain uses of “the e-mail system” appears to refer to a company e-mail account, not personal accounts. Similarly, the Policy does not warn that the contents of personal, web-based e-mails are stored on a hard drive and can be forensically retrieved and read. The Court also found the Policy creates ambiguity by declaring that e-mails “are not to be considered private or personal,” while also permitting “occasional personal use” of e-mail.

The Court determined that an employee’s reasonable expectation of privacy in a particular work setting must be addressed on a case-by-case basis, but stated that by using a personal e-mail account and not saving the password, Stengart had a subjectively reasonable expectation of privacy in the e-mails exchanged with her attorney on her personal, password-protected, web-based e-mail account, which was accessed on a company laptop. This subjective expectation of privacy was objectively reasonable in light of the ambiguous language of the Policy and the attorney-client nature of the communication.

This decision, and others highlighted previously in this blog, present numerous issues for employers.  While it may not be enforceable in New Jersey, we recommend, in light of the reasoning in this decision, that employers consider modifying their existing electronic communication policies to include:

• Clear notice that personal, web-based emails accessed using company networks and stored on company networks or company computers can be monitored and reviewed by the company (of course, care should be taken here to avoid concerns under the Electronic Communications Privacy Act and the Stored Communications Act);
• Definitions of the specific technologies and devices to which the policies apply;
• Warnings that web-based, personal e-mail can be stored on the hard-drive of a computer and forensically accessed;
• No ambiguities about personal use. 

See our sample electronic communication policy outline for more information. However, even with such a policy in place, employers and their lawyers must be aware of the potential liability they face for improperly accessing information on the employers' systems which may later be deemed “private” or subject to a privilege.

• Email This
• Print
• Comments
• Trackbacks

As reported by Ameet Sachdev, of the Chicago Tribune, a jury found an employer responsible for the actions of its investigators who obtained a former employee’s phone records through “pretexting.” Of the $1.8 million awarded to the former employee for breaches of her privacy, the jury awarded $1.75 million in punitive damages. Regardless of whether this verdict survives on appeal, the lesson for employers is to be mindful of their internal investigatory techniques, but also those of their hired investigators.

Pretexting “is the act of creating and using an invented scenario (the pretext) to persuade a targeted victim to release information or perform an action.” As in many cases, the pretexting in Lawlor v. N. Amer. Corp. of Ill., Ill. Cir. Ct., No. 08 L 5931 (jury verdict rendered 9/19/09) involved use of the telephone to obtain telephone records. This case involved a key company saleswoman who, during a dispute over her compensation, was about to land a significant new account for the company. Concerned that Lawlor would take this new account to a competitor magnified the dispute and a company investigation ensued. The jury found one of the investigators hired by the employer called Lawlor’s telephone carriers and pretended to be her.

Both the federal and state governments have taken action to prevent pretexting. In 2006, the Telephone Records and Privacy Protection Act of 2006 (HR 4709) was enacted. This federal law criminalizes a number of actions related to pretexting. For example, it is a crime for a person to knowingly and intentionally obtain, or attempt to obtain, certain phone records under false pretenses. Violations of this law can result fines and/or imprisonment for up to 10 years. A number of states also have laws prohibiting pretexting. In 2006, the Consumer Communication Records Privacy Act became law in New York which provides similar protections against pretexting.

Employers frequently conduct investigations involving issues such as theft of company assets or trade secrets, disability fraud, harassment, and other sensitive matters where phone records and other information can be critical to obtain. Given how much sensitive information can now be obtained electronically, it is critical to understand the methodologies and techniques of third-party vendors and to ensure there are appropriate representations and indemnity provisions in service agreements.

• Email This
• Print
• Comments
• Trackbacks