That's Private? The Employee Online Privacy Act of 2014

Are there any two words that don’t belong in the same sentence more than “online” and “privacy”? Online activity, especially social media posts, are by their nature intended for a broad audience.  But that didn’t stop the Tennessee legislature from passing the “Employee Online Privacy Act of 2014” which was signed into law by Governor Haslam earlier this year.
This new law could have an impact on employers who check an employee’s or applicant’s online activity before making a hiring, promotion, or other employment decision.

The Employee Online Privacy Act prohibits employers, including state and local government entities, from requesting or requiring an employee or an applicant to disclose online activity, like email, Facebook, and twitter accounts. Specifically, the new law prohibits employers from doing the following:

1. Requesting or requiring an employee or an applicant to disclose a password that allows an employer to access the employee’s or applicant’s personal internet account;
2. Compelling an employee or an applicant to add the employer to his or her list of contacts associated with a personal internet account;
3. Compelling an employee or an applicant access a personal internet account in the employer’s presence in a way that enables the employer observe the contents of the employee’s or applicant’s personal internet account; or
4. Taking an adverse action, failing to hire, or otherwise penalizing an employee or applicant because of a failure to disclose information or take an action specified above.

A "personal Internet account" is an online account used by an employee or applicant exclusively for personal communications unrelated to any business purpose of the employer. It doesn’t include an online account created, maintained, used, or accessed by an employee or applicant for business-related communications or for a business purpose of the employer.

In addition to setting out prohibitions, the Employee Online Privacy Act also identifies actions that employers are not prohibited from taking. Specifically, under the new law, employers are explicitly permitted to:

1. Request or require an employee to disclose a username or password required to access an electronic communications device that was provided by or paid for (in whole or in party) by the employer, or an account or service that was provided by the employer that was obtained by virtue of the employee’s employment relationship with the employer, or used for the employer’s business purposes;
2. Discipline or discharge an employee for transferring the employer’s proprietary or confidential information or financial data to an employee’s personal internet account;
3. Conduct an investigation or require an employee to cooperate in an investigation in certain situations;
4. Restrict or prohibit an employee’s access to certain websites while using equipment or systems provided by the employer;
5. Monitor, review, access, or block electronic data stored on equipment or a network provided by the employer;
6. Comply with a duty to screen employees or applicants before hiring or to monitor or retain employee communications as required by federal or state law, for purposes of employment in law enforcement, or for purposes of an investigation into law enforcement officer conduct performed by a law enforcement agency; or
7. View, access, or use information about an employee or applicant that public or is available in the public domain.

The law has teeth. An employee or applicant who alleges that an employer has violated the Act may file a civil action against an employer for injunctive relief and may recover up to $1,000 in damages for each violation against the individual plus reasonable attorney fees and court costs.   Additionally, the attorney general may file a civil action against an employer on behalf of an employee or applicant. If the court finds a violation, it must award the state up to $1,000 for each violation found.

The law also specifically states that it does not create a duty for employers to search or monitor the activity of a personal internet account, and states that an employer shall not be liable for a failure to request or require an employee or applicant to allow access to an employee’s or applicant’s personal internet.

The new law is effective January 1, 2015.

Next year, employers will need to exercise additional caution when reviewing an employee’s or applicant’s online activity when making employment decisions.  It is significant that the law does not prohibit employers from accessing publicly available information.  However, employees and applicants are likely to misinterpret the scope of the law’s restrictions, which could result in additional headaches for employers.

Before the law becomes effective, employers should examine their policies for accessing online information in connection with making employment decisions to ensure that the employer is following best practices that not only comply with the law but also minimize the employer’s exposure to litigation risks.

When on the phone means on the clock

I remember the days before smartphones, when I could only access my e-mail remotely from a laptop. I yearned for one of those cool little phones that would let me immediately respond without the need for lugging around my laptop, opening a VPN connection and logging on. And now I have it--check that: I've had it for several years. And I find that I now yearn for those times when I can power down the cool little phone and disconnect from work. But that's about all I need to worry with as an exempt employee.

What about those employees who are non-exempt and have those cool little phones with remote e-mail access? They, too, may have the longing to disconnect and not do work. Employers should have that desire for the non-exempt employees as well. Otherwise, employers could be facing unpaid time claims (including overtime claims) for time spent by non-exempt employees checking their work e-mail accounts.

Even in situations where the smartphone is the non-exempt employee's personal phone and not company-issued, the employer can still have liability for time spent on the smartphone performing work-related tasks. If the employee uses it to do work on the company's behalf, that is compensable time under the Fair Labor Standards Act (that whole "suffer or permitted to work" thing).

So, what to do? Here are a couple of thoughts:

• check your e-mail use/electronic communications policy to ensure that you have advised employees that they have no expectation of privacy in their company e-mail accounts--regardless of how the accounts are accessed
• update your timekeeping policy, e-mail policy, etc. to prohibit unauthorized time worked after hours, and remind employees that any work which might result in overtime should be approved first
• most e-mail programs have a setting that allows you to schedule when particular messages will be delivered. Train your supervisors how to use that setting so that e-mails which are being sent to non-exempt employees are delivered during normal working hours
• prohibit employees (exempt and non-exempt alike) from having remote access to the e-mail accounts without prior permission (which gives you some control over who has the ability to check e-mail during off hours)
• remind non-exempt employees that they are to record ALL time worked, including those seemingly small, incremental periods during off hours when they are accessing e-mail remotely
• perform overtime/timekeeping audits periodically; this will also help you discover any patterns in e-mail usage that you can then use to better control remote access
• if you find an employee has violated your policies and established expectations, counsel the employee on the appropriate conduct.

If you haven't updated your electronic communications policy recently, or your timekeeping/overtime policy, now is a great time to do that. It provides you with a forum to remind employees of the company's expectations.

When TMI becomes TMI4TW

I just read several posts on Facebook by an acquaintance speaking to a recent medical procedure she had.

Right below that was a posting by a friend who was asking for prayers for a family member who had "taken a turn for the worse".

Scrolling a little more led to the discovery that another friend was pregnant and experiencing complications from it.

Finally, I had a post by someone who was insulted that he had to sign the book at the drugstore when he picked up his prescription for Cymbalta.

I, like many of you, shake my head at some of the discussions people hold publicly (via Facebook, Twitter, on mobile phones while walking through the mall). I could find humor amongst the not-so-newfound-openness more easily because none of these posts were by co-workers or my employees.

But what if they had been?

These entries are all reminders as to why I do not friend, follow or otherwise social network with co-workers. Let's face it--I'm on these sites to keep up with people whom I don't see on a regular basis or talk to as frequently as I would like. I can walk down the hall, dial an extension, or (if I'm sore from a long run) zip an e-mail to a co-worker to find out what is happening if I am so inclined.

Who would have thought that e-mail now feels like one of the safest ways to interact?

(TMI4TW = TMI for the workplace)