Privacy in the workplace

Privacy and monitoring What are employees’ rights with regard to privacy and monitoring?

Alabama

Bradley Arant Boult Cummings LLP

On the privacy front, Alabama follows the federal wiretapping statute—which stipulates that you only need the consent of one party to a conversation to record it. However, the Alabama tort of invasion of privacy or intentional infliction of emotional distress may apply to egregious violations of privacy, and employers are advised to inform employees in writing regarding their lack of privacy in relation to workspaces or property, including the use of company computers or servers.

Alberta Osler Hoskin & Harcourt LLP

Provincial rules Alberta is one of a few provinces with privacy legislation – the Personal Information Protection Act. The act governs the processes to protect the collection, retention, use and disclosure of personal employee information.

Federal rules Federal privacy law and privacy commissioner decisions require monitoring to be reasonable. Typically, video monitoring is permitted for safety or security reasons in public cases. Video monitoring of work areas is much more controversial and must not be used for productivity or performance issues. 

Arizona Ogletree Deakins

Employees of private employers have limited privacy rights at work. Employers generally have the right to review and monitor employees’ work spaces, computers, email and internet use, and phones. Employers should be mindful not to restrict employees’ privacy in a manner that would violate the National Labor Relations Act.

Although the Arizona Constitution provides a right to privacy, courts have interpreted this right to apply only to public employers and not in the private employment relationship (Ariz. Const. Art. II, § 8).

It is a crime in Arizona to knowingly photograph, videotape, film, record, or secretly view another person without their consent in certain places, including restrooms and locker rooms (A.R.S. § 13-3019). However, Arizona is a one-party consent state as to recordings otherwise.

California DLA Piper LLP

Among the most important restrictions are the limitations on the use of certain background information. Employers should also be aware that California law restricts the unauthorized recording of conversations without the consent of all parties (which has led to a host of class action lawsuits) (California Penal Code, §632).

In addition, California maintains an all-purpose right to privacy, which applies in the employment context. For example, unless employers set clear limits on any expectation of privacy on company computers or using company resources, employees may be able to claim a right to privacy over personal emails, social networking and records. Clear policy language is a requirement for any employer in California. This test also applies in the context of physical searches, such as lockers and desks. 

California law also restricts taking adverse action against an employee based on lawful off-duty conduct (California Labor Code, §96(k)).

Colorado Holland & Hart LLP

No Colorado law specifically addresses the monitoring of employees or employee communications. Employer policies should specify that employees should have no expectation of privacy in any information or items brought onto the employer’s premises or contained on or accessed through the employer’s computer systems or devices.

Colorado requires the consent of one party to a conversation before recording telephone conversations or other wire communications (C.R.S. §18-9-304).

Connecticut Carmody Torrance Sandak & Hennessey LLP

Electronic monitoring Employers generally must give employees written notice of the types of electric monitoring that the employer uses in the workplace. Employees have no right to notice if the employer has reasonable grounds to believe that the employee is engaged in conduct that:

  • violates the law;
  • violates the legal rights of the employer or the employer’s employees; or
  • creates a hostile work environment and the electronic monitoring may produce evidence of this conduct (Conn. Gen. Stat. Section 31-48d(b)(1)).

Employees may not be subject to monitoring in workplace areas designed for the health or personal comfort of the employees or for safeguarding of their possessions, such as rest rooms, locker rooms, or lounges (Conn. Gen. Stat. Section 31-48b).

Polygraphs Employers generally cannot request or require any prospective employee or any employee to submit to, or take, a polygraph examination as a condition of employment or dismiss or discipline an employee for failing, refusing or declining to submit to or take a polygraph examination. This prohibition does not apply to state and municipal law enforcement and corrections officers (Conn. Gen. Stat. Section 31-51g).

Urinalysis drug testing Employers generally may not require any existing employee to submit to a urinalysis drug test unless the employer has reasonable suspicion that the employee is under the influence of drugs or alcohol, which adversely affects or could adversely affect their job performance. An employer may require an employee to submit to a urinalysis drug test on a random basis if:

  • authorized under federal law;
  • the employee serves in an occupation which has been designated, by the labor commissioner, as a high-risk or safety-sensitive occupation;
  • the employee is employed to operate a school bus or a student transportation vehicle; or
  • the urinalysis is conducted as part of an employee assistance program sponsored or authorized by the employer in which the employee voluntarily participates (Conn. Gen. Stat. Section 31-51x).

Personnel records No individually identifiable information contained in the personnel file or medical records of any employee may be disclosed by an employer to a third party without the written authorization of the employee, except where the information is limited to the verification of dates of employment and the employee’s title or position and wage or salary or where the disclosure is made:

  • to a third party that maintains or prepares employment records or performs other employment-related services for the employer;
  • pursuant to a lawfully issued administrative summons or judicial order, including a search warrant or subpoena, or in response to a government audit or the investigation or defense of personnel-related complaints against the employer;
  • pursuant to a request by a law enforcement agency for an employee’s home address and dates of his attendance at work;
  • in response to an apparent medical emergency or to apprise the employee’s physician of a medical condition of which the employee may not be aware;
  • to comply with federal, state or local laws or regulations; or
  • where the information is disseminated pursuant to the terms of a collective bargaining agreement (Conn. Gen. Stat. Section 31-128f). 

Illinois Jackson Lewis PC

The Consumer Fraud and Deceptive Practices Act prohibits:

  • an employer from publicly disclosing an employee’s social security number;
  • printing the number on an employee card;
  • requiring the employee to transmit the number online;
  • requiring an employee to use the number to access a website;
  • printing the number on any materials mailed to the employee unless required by law; or
  • encoding the number on a card or document.

Indiana Ogletree Deakins

Indiana’s employees have limited rights with regard to privacy and monitoring in the workplace.

The Indiana Wiretap Act protects employees by prohibiting employers from intercepting, disclosing, or using employees’ computer or telephone communications without the consent of at least one party to such communications.

Indiana employees may also sue employers for invasion of privacy under the theories of intrusion on seclusion, public disclosure of private facts, “false light,” and misappropriation of name and likeness. However, invasion-of-privacy torts in the employment context have been construed narrowly.

Minnesota Jackson Lewis PC

Generally, employers have the right to monitor employees at work with respect to usage of computers, email, internet, phones and work spaces, so long as appropriate notices of consent are issued to employees and the employer has a clear monitoring policy. Employers should be aware that email and telephone monitoring of employees is subject to the Minnesota Privacy of Communications Act (Minn. Stat. §§ 626A.01-.42).

Video surveillance without audio is permitted, so long as the surveillance does not occur in areas where an employee might be undressed (Minn. Stat. § 609.746).

Minnesota courts recognize three of the four common law torts for invasion of privacy:

  • intrusion on seclusion;
  • appropriation of name or likeness; and
  • public disclosure of private facts (Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231 (Minn. 1998)).

Nevada Holland & Hart LLP

Nevada law on privacy in the employment context is not well developed. However, Nevada courts have given private employers wide latitude in monitoring thier workplace and facilities, especially where employer policies provide for such monitoring (common sense must be followed with respect to areas where privacy can legitimately be expected – e.g., restrooms and changing rooms).

Nevada law requires two-party consent before recording telephone conversations or other wire communications, but only one-party consent is required for recording “in-person” conversations (Nev. Rev. Stat. §§200.620; 200.650).

New Hampshire Cook Little Rosenblatt & Manson pllc

Like most states, New Hampshire has a statute regulating wiretapping and eavesdropping (RSA Ch. 570-A) which prohibits the recording or interception of any telecommunication or oral communication unless otherwise allowed under the statute. Unlike certain other states’ wiretap statutes, New Hampshire law requires the consent of all parties to the communication in order for the recording or interception to be legal (provided that it does not meet one of the exceptions set forth in the statute). 

New York DLA Piper LLP

Generally, an employer may implement soundless video recording, although legislation is pending which would require that written notice be given to employees (N.Y. Assembly Bill A. 3871). Absent a court order, New York prohibits employers from video recording an employee in a restroom, locker room or other room designated for purposes of changing clothes (N.Y. Labor Law § 203-c). It is an unfair labor practice for an employer to “spy upon or keep under surveillance, whether directly or through agents,” employees or representatives engaging in concerted activities (N.Y. Labor Law § 704-a).

With respect to audio recordings, New York’s wire-tapping law, like federal law, requires one party’s consent. It is a crime to record or eavesdrop on in-person or telephonic conversations without the consent of at least one party to the communication (N.Y. Penal Law §§ 250.00, 250.05). 

North Carolina Poyner Spruill LLP

North Carolina law does not provide employees with a specific right to privacy in the employment context. While there is no statute addressing employees’ right to privacy, an employee could make a successful common law claim for invasion of privacy or intentional infliction of emotional distress in extreme (and rare) circumstances.

With respect to monitoring, North Carolina follows the “One-Party Consent Rule” (N.C. Gen. Stat. § 15A-287), which provides that employee communications—both oral and electronic—may be intercepted (monitored or recorded) when one party to that communication consents to the interception or when the nature and circumstances of the communication do not give rise to an expectation of privacy. 

Consent may be obtained by prior warning that an employee’s communications may be monitored. Employees may be warned in their employment contract, a public posting, or any other means reasonably calculated to notify them that their conversations and communications may be monitored. For instance, in North Carolina v. Price, 170 N.C. App. 57, 66 (2005), the North Carolina Court of Appeals affirmed the trial court’s finding that an employer’s telephone surveillance was proper because the parties knew “that the call was subject to monitoring and recording and that they consented, at least impliedly, by continuing with the conversation in the face of that warning”.

Ontario Osler Hoskin & Harcourt LLP

Provincial rules While no private sector privacy legislation is in place, several cases have found video monitoring – particularly in less public places – to breach the employment contract. The Ontario Court of Appeal recently introduced the tort of 'intrusion on seclusion'; it is unclear whether it will be extended to the workplace or monitoring in the workplace. Privacy rules in the broader public sector (including education and healthcare) exist.

Federal rules Federal privacy law and privacy commissioner decisions require monitoring to be reasonable. Typically, video monitoring is permitted for safety or security reasons in public cases. Video monitoring of work areas is much more controversial and must not be used for productivity or performance issues. 

Quebec Osler Hoskin & Harcourt LLP

Provincial rules The right to privacy is a fundamental right protected by Quebec’s Charter of Human Rights and Freedoms, which requires monitoring to be reasonable. Typically, video monitoring is permitted for safety or security reasons (eg, if money or property is stolen or if the employer needs to protect a trade secret). However, in some places (eg, bathrooms), cameras are never allowed. Video monitoring should be used only as a last resort and must not be used for productivity or performance issues.

Employees should be informed of the monitoring measures taken by their employer.

Federal rules Federal privacy law and privacy commissioner decisions require monitoring to be reasonable. Typically, video monitoring is permitted for safety or security reasons in public cases. Video monitoring of work areas is much more controversial and must not be used for productivity or performance issues.

Tennessee Bass, Berry & Sims PLC

Under Tennessee’s Employee Online Privacy Act of 2014, employers are prohibited from requesting or requiring that applicants or employees disclose their passwords for personal internet accounts. This law also prohibits employers from requiring that applicants or employees:

  • add the employer to their list of contacts associated with personal internet accounts; or
  • permit the employer to observe their restricted online content after they have accessed an online account. 

However, this law provides exceptions pertaining to the use of any electronic communication device, account, or service provided or paid for by the employer, or a personal account used for the employer’s business purposes.

Employees are also protected under the Wiretapping and Electronic Surveillance Act, unless the person is party to the communication.

Texas Ogletree Deakins

There are no statutory rights. Common law claims for invasion of privacy and related torts may arise in some circumstances. A properly worded policy can help prevent and/or defend such a claim.

Utah Holland & Hart LLP

Utah law mirrors the federal Electronic Communications Privacy Act. Monitoring phone calls, video or audio recordings requires on-party consent (Utah Code §77-23a-1 et seq.).

Wyoming Holland & Hart LLP

Wyoming law on privacy is not well developed. The Wyoming Supreme Court has ruled that an employee cannot sustain an invasion of privacy claim against his or her employer based on the employer’s comments related to the manner and reasons for discharging the employee (Jewell v. North Big Horn Hosp. Dist., 953 P.2d 135 (Wyo. 1998)).

Intercepting any oral, wire, or electronic communication is unlawful, except when the person intercepting is a party to the communication or when one of the parties has given prior consent (Wyo. Stat. §7-3-702(a)(i)).

Are there state rules protecting social media passwords in the employment context and/or on employer monitoring of employee social media accounts?  

Alabama Bradley Arant Boult Cummings LLP

No.

Alberta Osler Hoskin & Harcourt LLP

Provincial rules Any employer monitoring of employee social media accounts is subject to provincial privacy legislation and must be reasonable. At the very least, employers should develop a social media policy that notifies employees that monitoring is ongoing and explains how the personal information collected will be used (ie, performance management or discipline). However, employers should balance the desire to monitor social media against the risk that they will inadvertently obtain information from social media accounts that discloses information concerning a protected ground under the Human Rights Act.

Federal rules The same human rights considerations apply for federally regulated employers. However, the federal privacy commissioner has expressly stated that employers should have social media policies that advise employees as to whether social media will be monitored. Failure to warn employees that their personal information is being collected by way of social media monitoring could violate federal privacy legislation.

Arizona Ogletree Deakins

As of 2016, no Arizona law restricts an Arizona employer’s ability to review potential employees’ social media information. However, employers should be mindful not to restrict employees’ social media in a manner that would violate employees’ Section 7 rights under the National Labor Relations Act.

California DLA Piper LLP

Yes. California employers are prohibited from requesting the disclosure of a social media username or password, or requiring an applicant or employee to access social media or to divulge any personal social media (subject to a limited exception for investigations of employee misconduct or violations of the law) (California Labor Code, §980. In addition, information learned over social media (even if shared publicly) may give rise to issues concerning discrimination, harassment, retaliation and/or protected concerted activity under the National Labor Relations Act.

Colorado Holland & Hart LLP

Colorado employers may not suggest, request, or require that an employee or applicant disclose any user name, password, or any other information that provides access to the individual’s personal accounts or personal electronic communications devices. Employers may not compel an employee or applicant to add anyone as a “friend” or to their list of contacts and may not require, request, suggest, or cause an employee or applicant to change their privacy settings associated with a social networking account. Finally, employers may not discharge, discipline, or discriminate against any employee or applicant for refusing or failing to disclose such information. A few exemptions exist related to conducting workplace investigations regarding compliance with applicable laws or the unauthorized downloading of the employer’s proprietary information (C.R.S. §8-2-127).

Connecticut Carmody Torrance Sandak & Hennessey LLP

With limited exceptions, an employer is prohibited from requesting or requiring employees or applicants to:

  • provide the employer with a user name, password, or other means to access the employee’s or applicant’s personal online account;
  • authenticate or access a personal online account in the presence of the employer; or
  • invite or accept an invitation from the employer to join a group affiliated with any personal online account.

Employers are also prohibited from taking adverse action against an employee or applicant who refuses one of the requirements set forth above or who files or causes to be filed a written or verbal complaint with a public or private body or court concerning the employer’s violation (Conn. Gen. Stat. Section 31-40x(b)).

This general prohibition does not apply to any account or service that is provided by the employer, and permits the employer to request or require access to any electronic communications device supplied or paid for, in whole or in part, by the employer. The law also does not prohibit an employer from disciplining or discharging an employee for unauthorized misappropriation of the employer’s proprietary information, confidential information, or financial data to or from a personal online account (Conn. Gen. Stat. Section 31-40x(c)).

Further, the law does not affect an employer’s ability to conduct certain workplace investigations involving an employer’s personal account (Conn. Gen. Stat. Section 31-40x(d)).

Illinois Jackson Lewis PC

The Illinois Right to Privacy in the Workplace Act allows employers to access employees’ professional social media accounts. However, the act generally prohibits employers from requesting that any employee or prospective employee provide a password or other account information to enable the employer to gain access to an employee’s personal social networking accounts.

Indiana Ogletree Deakins

Indiana has no state laws protecting social media passwords in the employment context. Nor does Indiana have state laws on employer monitoring of employee social media accounts.

Minnesota Jackson Lewis PC

As of the end of 2015, no Minnesota law restricts an employer’s ability to monitor social media accounts for an applicant or employee. However, employers should be mindful not to restrict social media use by employees in such a way as to violate employees’ Section 7 rights under the National Labor Relations Act.

Nevada Holland & Hart LLP

Nevada employers may not directly or indirectly require, request, suggest, or cause any employee or applicant to disclose the user name, password, or any other information that provides access to the individual’s personal social media account. Employers also may not discharge, discipline, or discriminate against any employee or applicant for refusing or failing to disclose such information (Nev. Rev. Stat. §613.135).

New Hampshire Cook Little Rosenblatt & Manson pllc

Yes. Under a law passed in 2014, employers cannot:

  • request or require applicants and employees to disclose login information to their personal social media and electronic accounts; or
  • compel any applicant or employee to add anyone to his or her personal social media or electronic accounts or reduce the privacy settings on such accounts (RSA 275:74).

There are exceptions under the law to allow employers to:

  • monitor employee use of the employer’s social media accounts and electronic systems;
  • conduct certain workplace investigations;
  • obtain access to accounts that were created by virtue of the employment relationship or that were paid or sponsored by the employer; and
  • obtain information about an employee or applicant that is in the public domain.

The law applies to all employers.

New York DLA Piper LLP

Legislation regarding the privacy of employees’ and applicants’ social media accounts is pending (N.Y. Senate Assembly Bill S. 3927, N.Y. Assembly Bill A. 2891).

North Carolina Poyner Spruill LLP

North Carolina does not restrict employers from requesting access or requiring access to employee or applicant social media accounts.

Ontario Osler Hoskin & Harcourt LLP

Provincial rules Ontario has no private sector provincial privacy legislation. However, the Ontario Human Rights Commission warns that social media monitoring increases the risk of discrimination complaints, as employers may inadvertently obtain information from social media accounts that discloses information concerning a protected ground under the Human Rights Code.

Federal rules The same human rights considerations apply for federally regulated employers. However, the federal privacy commissioner has expressly stated that employers should have social media policies that advise employees as to whether social media will be monitored. Failure to warn employees that their personal information is being collected by way of social media monitoring could violate federal privacy legislation.

Quebec Osler Hoskin & Harcourt LLP

Provincial rules There are no specific provincial rules protecting social media passwords.

As mentioned above, the right to privacy is a fundamental right protected by Quebec’s Charter of Human Rights and Freedoms and regulated by the Quebec Act Respecting the Protection of Personal Information in the Private Sector. Social media monitoring increases the risk of discrimination complaints, as employers may inadvertently obtain information from social media accounts that discloses information concerning a prohibited ground under the charter.

Federal rules The same human rights considerations apply to federally regulated employers. However, the federal privacy commissioner states that employers should have social media policies that advise employees as to whether social media will be monitored. Failure to warn employees that their personal information is being collected by way of social media monitoring could violate federal privacy legislation.

Tennessee Bass, Berry & Sims PLC

Yes. Tennessee’s Employee Online Privacy Act of 2014 prohibits an employer from requesting or requiring that applicants or employees disclose their passwords for personal internet accounts. This law also prohibits employers from requiring that applicants or employees:

  • add the employer to their list of contacts associated with personal internet accounts; or
  • permit the employer to observe their restricted online content after they have accessed an online account. 

However, this law provides exceptions pertaining to the use of any electronic communication device, account, or service provided or paid for by the employer, or a personal account used for the employer’s business purposes.

Apart from Tennessee’s Employee Online Privacy Act of 2014, no state rules governing an employer’s ability to monitor an employee’s social media account exist.

Texas Ogletree Deakins

No.

Utah Holland & Hart LLP

Utah’s Internet Employment Privacy Act (Utah Code §34-48-101 et seq.) prohibits employers, with limited exceptions, from requesting an employee or an applicant for employment to disclose a username and password, or password that allows access to the individual’s personal online account. It also prohibits employers from taking adverse action, failing to hire, or otherwise penalizing an employee or applicant for failure to disclose usernames or passwords for personal online accounts. 

Exceptions under which an employer can request or require usernames or passwords include:

  • when access to an electronic device or account provided by the employer is required;
  • when disciplining or discharging an employee for transferring the employer’s proprietary or confidential data to an employee’s personal online account without authorization; and
  • when conducting an investigation based on specific information about activity on the employee’s personal online account that may violate applicable laws or policies against work-related misconduct, or about an unauthorized transfer of the employer’s proprietary information to an employee’s personal online account.

Employers are not restricted from viewing, accessing, or using publicly available information. Employers are not prohibited from complying with a duty to screen employees and applicants before hiring or monitoring and retaining employee communications under applicable law.

The law provides for a private right of action, but caps damages at $500. 

Wyoming Holland & Hart LLP

There is no Wyoming law on the access or use of social media in the employment context.

 

Use the Lexology Navigator tool to compare other answers.

For more information on how to contribute for your jurisdiction, please contact Sophie Kernohan (skernohan@GlobeBMG.com)