Employees’ increasing sensitivity to data privacy and security, and widely accepted public policy to protect personal data maintained by businesses, require employers to respond meaningfully to employee data privacy and security complaints or risk whistle blower claims of retaliation.

The U.S. District Court for the District of New Jersey recently held that an employee who voiced concerns regarding his employer’s handling of data security before he was fired may proceed to trial under the New Jersey Conscientious Employee Protection Act (“CEPA”) on the ground that he was engaged in protected whistle blowing activity under CEPA. This is one of the first decisions linking a NJ CEPA or similar claim and data security concerns, and is in line with increased efforts by both the federal and state governments to protect employee data.

Many, if not most, occupations require the movement of information over electronic networks and systems, very often sensitive identifiable information about customers and/or employees. In our electronic environment, employees are increasingly aware of regulations designed to protect personal information, as well as the events that drive legislatures and agencies to action – massive data breaches and troubling reports of the misery caused by identity theft. As a result, employees are likely to expect and even demand employer-established safeguards to protect this information. These include written policies, training, logon and user authentication controls, among others.

Employers should take employee concerns regarding data privacy and security seriously, not only to help assure compliance, but also because subsequent adverse action against that employee could provide the basis for a whistleblowing/retaliation claim. For instance, an employee might express concern to his supervisor that the company provides no privacy training for employees with access to personal information, or that company laptops are not password-protected or encrypted. An employee might even refuse to utilize certain information systems because of a belief, correct or incorrect, that the systems are not adequately safeguarded. An employee that subsequently experiences adverse employment action, such as the termination of employment, could claim the adverse action was in retaliation for complaints concerning the company’s alleged data security deficiencies.

To establish a prima facie CEPA claim under New Jersey law, the plaintiff must offer evidence that he engaged in whistleblowing and was subjected to an adverse employment action causally connected to the protected activity. Additionally, the plaintiff is required to allege he reasonably believed the defendant’s conduct violated a law, rule or regulation, or a clear mandate of New Jersey public policy.

It is conceivable that a New Jersey court could find facts sufficient to support a CEPA claim in the circumstances described above based on an employee’s reasonable expectation that personal identifying information will be kept confidential. In fact, New Jersey’s Identify Theft Protection Act (“ITPA”), 56 N.J.S.A. 56:11-45, calls for the protection of certain personal information including Social Security numbers “in order to detect and prevent identity theft” thus creating a nexus between the employee’s allegations and the ITPA. Of course, a jury would then have to find the employee’s termination was based on impermissible retaliation.

So, in addition to concerns about data breaches and other information risks relating to personal information, employers need to be mindful of employee complaints about data security and address them appropriately. A comprehensive written information security program can go a long way to prevent these kinds of claims.