Legal Mistakes by HR (Part 2)

Many employees are unaware that their computers can be monitored without their knowledge. If they have a computer, it's the employer's window into their workspace. Employers should take steps to notify employees that monitoring is taking place. 

2.  Permitting an expectation of electronic privacy.   Remember to advise your employees that there is no expectation of privacy on their company computers.   "With businesses losing billions to computer crime and employees wasting considerable time on their computers looking at sports updates, the latest fashion trends, and even less appropriate websites, business are cracking down by monitoring their employees.  The efforts are to ultimately reduce scams, identity theft, computer crimes, fraud, sexual abuse, piracy, and threats.  As a result, many businesses have resorted to online monitoring of their workplace computers"  (Texas Business Today, Fourth Quarter 2012). 

While the Electronic Communication Privacy Act (1986) comes close to creating a starting point for a legal foundation of what can and cannot be done, legal and ethical debates on electronic monitoring and surveillance in the workplace continue. 

*There may be additional rights for employees in California given specific statutes of that state.

Employee Actions Off The Clock

In case you missed it, Joseph Andolino, a senior vice president of Halliburton's tax department was arrested in a Harris County prostitution sting along with six other men (reported in the Houston Business Journal).  While there are no reports that he committed the crime on the job, several questions relating to his on-going employment with Halliburton come up.   

 

While I don't think that employers want to overly intrude into the private lives of employees, as an employer do you  have a policy or an employment contract that says an employee may be terminated if s/he engages in criminal conduct?  Do any of your company policies address employees conviction of a crime that indicates unfitness for the job or raises a threat to the safety or well being of fellow employees? 

Texas is an at-will state.  That allows Texas employers a lot of latitude in the hiring and firing decisions.  Essentially an employer can terminate an employee for any reason that is not specifically prohibited by law.  However, state legislation, employment contracts, union contracts or your internal policies may dictate your decision.   An employment clause may provide you with an avenue for dismissal.  But does it mandate the dismissal?

• Do you have to prove that the conduct has a direct impact on the job? 
• Does it compromise the employee's ability to do the job? 
• It is an embarrassment to the organization? 

We all agree that an employer shouldn't keep an employee whose after-work activities affect their job performance.  The general rule is the more off-duty behavior negatively affects the work environment, the more termination and/or discipline becomes a legal and valid option.  But, is failure to take remedial action regarding the off-duty conduct inferring that similar actions are condoned on the job?

 

Companies may face difficulty when dealing with terminating employees for off-duty conduct. Potential results when employee's are fired for off-duty behavior can be negative publicity, low morale and related turnover.   You must consider the nature of the crime and how it affects the workplace.  What effect, if any, does the behavior have to the workplace or the company's image?   Does the behavior justify adverse employment action?

 

If you are considering regulating the off-duty conduct of your employees, there are some things to be considered:

• Is the conduct legal or illegal?
• Is there an applicable law that protects the off-duty conduct of the employee?
• Am I willing to apply this policy consistently?

Jason Bosch, None Of Your Business (Interest):  The Argument for Protecting All Employee Behavior With NO Business Impact: " . . . employees should not have to relinquish autonomy over very aspect of their lives just to get or keep a job.   Employers have a vested interest in controlling those aspects of employee's lives that reasonably affect the employees' performance on the job, but that does not justify giving employers carte blanche to control every aspect of their employees' lives."

The Password Protection Act of 2012 - Part II

Senator Richard Blumenthal (D-Conn.) stated, “Employers seeking access to passwords or confidential information on social networks, e-mail accounts, or other protected Internet services is an unreasonable and intolerable invasion of privacy. With few exceptions, employers do not have the need or the right to demand access to applicants' private, password-protected information."

Beyond the privacy issue, let’s look at the potential ability to discriminate against candidates.  In a statement by Rep. Martin Heinrich (D-N.M.), “Personal information like race, religion, age, and sexual orientation is often accessible on social networking profiles, and by having access to this information employers could discriminate against an applicant who would otherwise be qualified for a job. In an ever expanding world of technology, we need to have clear laws on the books to protect Americans' right to privacy.” 

Under the bill, the employer can’t force an employee to disclose a password even if the employee is using his/her work computer for access.  The PPA reflects the approach (and building on the existing law) of the Computer Fraud and Abuse Act, the federal government’s primary anti-hacking tool.  This Act protects the integrity of internet systems against hackers, including protecting online email accounts and Facebook accounts against the stealing of passwords.  (The online servers where private user information is stored are referred to as “protected computers” in the legislation.)

For the employer, it will protect their system.  It preserves the right of the employer to control access to their hardware, as well as Internet software.  The employer can set policies for employer-operated computer systems and hold workers accountable for stealing data.   

The PPA does not limit its protection to a particular type of service.  It is “technology-neutral.”  This will allow the bill to remain flexible and not be supplanted in a few years by new technology and allow the PPA to continually evolve.  It is designed to adapt to new Internet innovations. 

A summary of the Password Protection Act can be found on Senator Richard Blumenthal’s’ website.  The link is provided here:  www.blumenthal.senate.gov/newsroom/press/release/senators-and-congressmen-introduce-password-protection-act-of-2012

The Password Protection Act of 2012 - Part 1

On April 16^th, the Maryland State Senate unanimously passed a bill titled, “Labor and Employment – Username and Password Privacy Protection and Exclusions.”  If this bill is signed into law, Maryland will become the first state to prohibit employers from requiring potential candidates to provide passwords to their Facebook accounts.   This bill will also prohibit the disclosure of any username, password or other means of accessing a personal account for all Internet accounts such as Twitter and LinkedIn.

It is becoming a common practice for potential employers to snoop around in the private lives of prospective employees, as well as existing employees.  Employers use the information to determine whether or not the candidate is worth hiring based on their “on-line” behavior.  Current employees are even being fired based on their “on-line” behavior.  For example:

• Andrew Kurtz (pierogi and Pittsburgh Pirates mascot) was fired based on his Facebook critique of the team’s management. 
• Sister Mary Jesus Galan (a nun at the Santo Domingo el Real convent in Toledo) was fired for spending too much time on Facebook. 
• Cheryl James, an Oakwood Hospital employee (Detroit), was fired from her job for posting something on her personal Facebook page.  And, the list goes on.

The Password Protection Act of 2012 has been introduced in both the House and the Senate.   The PPA would make it illegal for an employer to compel or coerce access to any online information (stored anywhere on the Internet), if that information is secured against general public access by the user.   This includes private email accounts, smartphones and photo-sharing websites.  Employers violating the PPA could be subject to financial penalties up to $10,000.00. 

This proposed new legislation was introduced in the Senate by Sens. Richard Blumenthal (D-Conn.), Chuck Schumer (D-N.Y.), Ron Wyden (D-Ore), Jeanne Shaheen (D-N.H.) and Amy Klobuchar (D-Minn.), with an identical bill introduced in the House Of Representatives by Reps. Martin Heinrich (D-N.M.) and Ed Permutter (D-Colo.).    Rep. Ed Permutter previously submitted a Facebook user protection amendment that did not pass the House back in March.

(continued in The Password Protection Act of 2012 - Part II)

Facebook Access Demands?

Employers demanding access to employee’s Facebook accounts? Whether or not you have noticed, there is a growing trend where potential employers are demanding that job applicants provide passwords to their private Facebook accounts. The reason? According to employers they want to check for “embarrassing or damaging information.” As an employer, do you really want access to potentially sensitive information? Can it potentially expose the employer who seeks this access to unanticipated legal liability? Doesn’t this practice undermine the privacy expectations and the security of both the user and the user's friends?

Democratic Sens. Charles Schumer (N.Y.) and Richard Blumenthal (Conn.) on Sunday urged federal authorities to investigate whether employers who ask for their workers' Facebook passwords are breaking the law. In a statement, Schumer and Blumenthal called the practice "disturbing" and said it "represents a grave intrusion into personal privacy."

Schumer and Blumenthal asked the Justice Department to investigate whether the practice violates the Stored Communication Act or the Computer Fraud and Abuse Act, which ban unauthorized access to electronic information. "Requiring applicants to provide login credentials to secure social media websites and then using those credentials to access private information stored on those sites may be unduly coercive and therefore constitute unauthorized access under both [laws]," the lawmakers wrote.

And, they didn’t stop there. They also sent a letter to the EEOC asking the agency to review the situation. The concern is that access by the potential employer would give an employer access to "private, protected information that may be impermissible to consider when making hiring decisions." Is there a potential for the private information in a Facebook account to be used to discriminate against otherwise qualified applicants?

Sen. Blumenthal announced last week that he's going to propose legislation to ban employers from requesting access to Facebook accounts as a term of employment. "With few exceptions, employers do not have the need or the right to demand access to applicants’ private, password-protected information,” Blumenthal said. “Employers have no right to ask job applicants for their house keys or to read their diaries — why should they be able to ask them for their Facebook passwords and gain unwarranted access to a trove of private information about what we like, what messages we send to people, or who we are friends with?” Schumer asked.

Facebook condemned the practice in a blog post on Friday. The company's Chief Privacy Officer, Erin Egan, issued the statement: "In recent months, we've seen a distressing increase in reports of employers or others seeking to gain inappropriate access to people's Facebook profiles or private information. The most alarming of these practices is the reported incidences of employers asking prospective or actual employees to reveal their passwords. If you are a Facebook user, you should never have to share your password, let anyone access your account, or do anything that might jeopardize the security of your account or violate the privacy of your friends. We have worked really hard at Facebook to give you the tools to control who sees your information.”

Would any rational person want to turn over his or her passwords? I believe this is a violation of Facebook’s terms of service. If an individual releases their password, it opens up their personal communications to a variety of individuals that are unknown to them.

Currently this activity is legal in most states. Let’s hope we see some change coming.