Businesses are constantly challenged by the ever-evolving landscape of labor and employment law, with new legislation and judicial developments occurring almost daily fueling a seemingly never-ending stream of litigation. For companies operating in multiple states, complying with this patchwork of federal, state, and local laws and developments can be daunting. Knowing these issues are a top concern for management and in-house counsel, Morrison Foerster keeps pace with this rapidly evolving landscape. MoFo ELC equips our clients with the most up-to-date and relevant information on employment and labor law issues covering key judicial, litigation and legislative developments, their implications for employers, and strategies to ensure compliance and avoid lawsuits.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

Editors

turnbull_andrew_blog_150x150.png

turnbull_andrew_common_640x280.jpg

turnbull_andrew_heroretina_2700x1160.jpg

turnbull_andrew_mobileretina_750x1040.jpg

turnbull_andrew_social_600x600.jpg

Co-Chair, Global Employment and Labor Practice

Partner

Andrew Turnbull represents companies on a broad range of labor and employment litigation and counseling matters. He has successfully defended clients in complex employment litigation before federal and state courts and administrative agencies. A primary focus of his practice involves helping companies navigate the unique employment issues that arise when doing business with the federal government, including advising on all aspects of OFCCP compliance, creating and implementing affirmative action plans, defending OFCCP audits and onsite investigations, conducting mock pay equity audits, drafting and developing business ethics policies and programs, and complying with the Service Contract Act, E-Verify, and the Drug Free Workplace Act.

Andrew Turnbull

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

MoFo ELC equips our clients with the most up-to-date and relevant information on employment and labor law issues, covering key judicial, litigation, and legislative developments, their implications for employers, and strategies to ensure compliance and avoid lawsuits. To learn more about our capabilities, please visit the <a href="https://www.mofo.com/capabilities/employment-labor" target="_blank">Employment + Labor</a> practice page and read about our <a href="https://www.mofo.com/people?practices=Employment%20%2B%20Labor" target="_blank">Team</a>.

Welcome to the MoFo ELC Blog

elcblog-header-image.jpg

Welcome to the MoFo ELC Blog

elcblog-header-image

MoFo ELC equips our clients with the most up-to-date and relevant information on employment and labor law issues covering key judicial, litigation and legislati

Announcements

Blog - Terms of Use

Blog - Cookies

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

In-depth analysis of developments and trends impacting government contracting.

Government Contract Insights Blog

Government Contract Insights

Looks behind the headlines to explore the trends, identify the opportunities, analyze the issues, and provide guidance for science and technology-based companies.

MoFo Tech Blog

News and thought leadership from lawyers whoa re adding value to the legal profession and the communities we call home.

 MoFo+ Blog

MoFo+

Read our Employment Law Commentary blog for the latest insights in employment and labor law, covering issues from ADA compliance to trade secrets protection.

Employment Law Commentary

MoFo ELC | Latest Employment Law Developments and Commentary

  Linkedin

MoFo LinkedIN

ELC Blog - RSS

Stay Connected

By submitting your data to subscribe to this blog, you approved Morrison & Foerster LLP to email you future information about MoFo news and events. You may opt-out at any time by sending a request to <a href="mailto:mofonews@mofo.com" target="_self">mofonews@mofo.com</a>. To learn more about how Morrison & Foerster LLP uses and protects your personal data, please view our <a href="https://www.mofo.com/about/privacy-policy.html" target="_self">Privacy Policy</a> at <a href="https://www.mofo.com/">www.mofo.com</a>.

Never miss a post from MoFo ELC. Enter your email below to stay up-to-date.

Subscribe

Practical Answers to Employment Law Issues

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Americans with Disabilities Act (ADA)

Artificial Intelligence

Coronavirus (COVID-19)

Department of Labor (DOL)

Discrimination

EEOC

European Union

Family Medical Leave Act (FMLA)

Immigration

Intellectual Property

Leaves of Absence

Legislation

NLRB

Non-Compete

OFCCP

PAGA

Paid Sick Leave

Pay Equity

Privacy & Data Security

Reductions in force (RIFs)

Trade Secrets

Wage and Hour

Workplace Misconduct

Topics

Blog - Editors

Blog - About

About

Blog - Subscribe

Andrew R. Turnbull

More

The “Preventative Duty”: New Law Places Active Duty on Employers in the UK to Prevent Sexual Harassment in the Workplace

Good News for Employers: Texas Court Blocks FTC’s Non-Compete Ban

Potential Exceptions Under FTC’s Non-Compete Ban

FTC Issues Final Rule Banning Non-Competes

Maryland Poised to Continue Trend of Jurisdictions Mandating Pay Transparency in Job Postings

LinkedIN

The cybersecurity posture of government contractors was an area of intense focus and ongoing regulatory development for the federal government in 2021. The coming year will also include many anticipated cybersecurity-related changes and developments.Read our full <a href="https://www.mofo.com/resources/insights/220111-top-cybersecurity-considerations.html?utm_source=publication&utm_medium=email">client alert</a>.

reynolds_tina_blog_150x150.png

reynolds_tina_common_640x280.jpg

reynolds_tina_heroretina_2700x1160.jpg

reynolds_tina_mobileretina_750x1040.jpg

reynolds_tina_social_600x600.jpg

Tina is a partner in Morrison & Foerster’s Government Contracts practice. She represents a wide variety of government contractors including information technology, defense, biotechnology, and pharmace

Tina Reynolds

Tina is co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She counsels a wide variety of government contractors on compliance with federal acquisition and ethics regulations. She drafts and negotiates contracts on their behalf and has been involved with numerous internal investigations and compliance reviews, and with bid protest, contract claims, and False Claims Act litigation. She also advises on M&A transactions involving government contractors.

Tina D. Reynolds

elccrosspost1.jpg

Top Cybersecurity Considerations for Government Contractors in 2022

Top Cybersecurity Considerations for Government Contractors in 2022

220103-phone-lock-cyber-security-tile-promo.jpg

220103-phone-lock-cyber-security-tile-promo

The cybersecurity posture of government contractors was an area of intense focus and ongoing regulatory development for the federal government in 2021. The comi

New York recently joined Connecticut and Delaware as one of a small number of states with statutes that require employers that engage in electronic monitoring of employees to provide prior written notice of the monitoring.On November 8, 2021, the State of New York enacted an amendment to the Civil Rights Law creating new section 52-c, which takes effect after 180 days. The new law applies to any private sector employer that monitors or otherwise intercepts an employee’s telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage. The law provides an exception to its requirements when the activity is (a) designed to manage the type or volume of email, telephone, or internet use; (b) not targeted to monitor a particular employee; and (c) performed solely for purposes of systems administration or protection.To learn more, read our <a href="https://www.mofo.com/resources/insights/211115-new-york-enacts-employee-monitoring-notification-law.html?utm_source=publication&utm_medium=email">client alert</a>.

pierce_suhna_blog_150x150.png

pierce_suhna_common_640x280.jpg

pierce_suhna_heroretina_2700x1160.jpg

pierce_suhna_mobileretina_750x1040.jpg

pierce_suhna_social_600x600.jpg

Of Counsel

Suhna Pierce has a rare combination of technical and legal competency. With extensive experience in the information technology industry providing infrastructure engineering and support services, she h

Suhna N Pierce

Suhna Pierce

mofolifesciences-privacy-data-security.jpg

New York Enacts Employee Monitoring Notification Law

New York Enacts Employee Monitoring Notification Law

mofolifesciences-privacy-data-security

New York recently joined Connecticut and Delaware as one of a small number of states with statutes that require employers that engage in electronic monitoring o

When your organization is searching to fill a new position, you understandably want to find out as much as possible about the candidates who apply. Aside from determining whether the candidate has the specific skill set, education, and experience necessary to do the job, you want to make sure that the person will fit in with the team. Do they have a positive attitude and integrity? Are they flexible and hard working? Are they a good communicator and team player? Are they dependable and creative? If possible, you want to hear from references provided by the candidate to confirm that the candidate was sincere and meets your organization’s needs. You might even want to check how they behave on the Internet.It is difficult to figure all of this out through the traditional hiring process, so many companies resort to seeking additional information from the candidate him or herself and by conducting extensive background checks that might even include reviewing the candidate’s social media accounts.The nature of personal information that an organization may collect during the hiring process is, however, quite limited due to the EU General Data Protection regulation (GDPR), the implementing laws of the EU Member States and emerging U.S. laws. Here are seven tips for your international recruiting programs.Read our <a href="https://www.mofo.com/resources/insights/201030-international-recruiting-programs.html" target="_blank">client alert.</a> For more insights about privacy + data security, please visit our <a href="https://www.mofo.com/special-content/gdpr-resource-center/" target="_blank">GDPR Resource Center</a> and <a href="https://www.mofo.com/special-content/california-consumer-privacy-act/" target="_blank">California Consumer Privacy Act Resource Center</a>.

poler-de-zwart-alja-blogheadshot.jpg

poler-de-zwart_alja_common_640x280.jpg

poler-de-zwart_alja_heroretina_2700x1160.jpg

poler-de-zwart_alja_mobileretina_750x1040.jpg

poler-de-zwart_alja_social_600x600.jpg

Clients seek Alja for her no-nonsense approach to resolving complex local legal issues efficiently while providing strong representation for their most important privacy, whistleblowing, and investigatory matters. Alja is the go-to counsel for EU whistleblowing laws and leads strategy for the firms’ advisory efforts for compliance with whistleblowing rules and procedures globally. 

Alja Poler De Zwart

waldmannagarwal_marian_blog_150x150.png

waldmannagarwal_marian_common_640x280.jpg

waldmannagarwal_marian_heroretina_2700x1160.jpg

waldmannagarwal_marian_mobileretina_750x1040.jpg

waldmannagarwal_marian_social_600x600.jpg

Marian Waldmann Agarwal is a partner in the Privacy + Data Security Group at Morrison Foerster. She also co-leads the firm’s Artificial Intelligence Group and is a member of the global Environmental, Social, and Governance (ESG) Steering Committee.

Marian Waldmann Agarwal

Marian A. Waldmann Agarwal

190911-maze-gdpr-tile-promo.jpg

7 Tips for International Recruiting Programs in the Era of GDPR and Emerging U.S. Laws

7 Tips for International Recruiting Programs in the Era of GDPR and Emerging U.S. Laws

190911-maze-gdpr-tile-promo

When your organization is searching to fill a new position, you understandably want to find out as much as possible about the candidates who apply. Aside from d

In a welcome development for U.S. employers, the U.S. Equal Employment Opportunity Commission (EEOC) has issued an updated <a target="_blank" href="https://templatelab.com/ada-rehabilitaion-act-coronavirus/">announcement</a> and updated <a target="_blank" href="https://www.eeoc.gov/facts/pandemic_flu.html">guidance</a> for employers about what they can and cannot ask their employees as they seek to protect their workforces against COVID-19. These updates provide valuable clarity to employers about the EEOC’s position on the types of health-related inquiries that an employer can make in light of the “direct threat” posed by COVID-19, without running afoul of the restrictions typically imposed by the Americans with Disabilities Act (ADA). Below, we highlight key clarifications that the updated EEOC guidance provides to employers about how they can screen current employees for COVID-19:1) Can an employer take employees’ temperatures during the COVID-19 pandemic?Yes, but treat the information as confidential medical records. The ADA restricts an employer’s ability to take employees’ temperatures, but the EEOC’s updated guidance clarifies that the COVID-19 pandemic now rises to the level of a “direct threat” that allows employers to take employees’ temperatures as a screening measure during this pandemic.When may an ADA-covered employer take the body temperature of employees during the COVID-19 pandemic?Generally, measuring an employee’s body temperature is a medical examination. Because the CDC [Centers for Disease Control] and state/local health authorities have acknowledged community spread of COVID-19 and issued attendant precautions, employers may measure employees' body temperature. However, employers should be aware that some people with COVID-19 do not have a fever.The EEOC cautions that the information collected from the temperature checks must be protected as a confidential medical record under the ADA, which restricts disclosure of such information.2) Can an employer ask employees whether they are experiencing symptoms consistent with COVID-19?Yes, but treat the information as confidential medical health records. The ADA typically limits what an employer can ask employees about medical conditions, but the EEOC’s updated guidance states that an employer can make certain inquiries if an employee calls in sick or reports feeling ill at work.How much information may an employer request from an employee who calls in sick, in order to protect the rest of its workforce during the COVID-19 pandemic?During a pandemic, ADA-covered employers may ask such employees if they are experiencing symptoms of the pandemic virus. For COVID-19, these include symptoms such as fever, chills, cough, shortness of breath, or sore throat. Employers must maintain all information about employee illness as a confidential medical record in compliance with the ADA.The EEOC’s guidance also suggests that an employer can make similar inquiries of employees who report feeling ill at work. Again, employers are required to treat such information as a confidential medical record under the ADA.3) Can an employer require an employee with COVID-19 symptoms to stay home?Yes, in fact the CDC says that you should do so. The EEOC’s new guidance provides that an employer can require an employee to stay home if the employee displays symptoms consistent with COVID-19.Does the ADA allow employers to require employees to stay home if they have symptoms of the COVID-19? Yes. The CDC states that employees who become ill with symptoms of COVID-19 should leave the workplace. The ADA does not interfere with employers following this advice.The EEOC notes that if an illness is sufficiently serious that it poses a “direct threat,” like COVID-19 at present, an employer may send an employee home without violating the ADA.4) Can an employer require an employee returning from sick leave to provide a doctor’s note?Yes, but be flexible. The EEOC’s guidance states that an employer can require an employee returning from sick leave to provide a doctor’s note verifying the employee’s fitness to return to work, although the EEOC encourages employers to be flexible in seeking such verifications in light of the burden on healthcare providers.When employees return to work, does the ADA allow employers to require doctors' notes certifying their fitness for duty? Yes. Such inquiries are permitted under the ADA either because they would not be disability-related or, if the pandemic influenza were truly severe, they would be justified under the ADA standards for disability-related inquiries of employees. As a practical matter, however, doctors and other health care professionals may be too busy during and immediately after a pandemic outbreak to provide fitness-for-duty documentation. Therefore, new approaches may be necessary, such as reliance on local clinics to provide a form, a stamp, or an e-mail to certify that an individual does not have the pandemic virus.5) If a COVID-19 vaccine is developed, can employers require their employees to take the vaccine?No, if the employee requires accommodation for a disability or sincere religious belief. According to the EEOC, employers cannot implement an across-the-board requirement for employees to get a COVID-19 vaccine, if/when a vaccine is developed and available.May an employer covered by the ADA and Title VII of the Civil Rights Act of 1964 compel all of its employees to take the influenza vaccine regardless of their medical conditions or their religious beliefs during a pandemic?No. An employee may be entitled to an exemption from a mandatory vaccination requirement based on an ADA disability that prevents him [or her] from taking the influenza vaccine. This would be a reasonable accommodation barring undue hardship (significant difficulty or expense). Similarly, under Title VII of the Civil Rights Act of 1964, once an employer receives notice that an employee’s sincerely held religious belief, practice, or observance prevents him [or her] from taking the influenza vaccine, the employer must provide a reasonable accommodation unless it would pose an undue hardship as defined by Title VII (“more than de minimis cost" to the operation of the employer’s business, which is a lower standard than under the ADA).Generally, ADA-covered employers should consider simply encouraging employees to get the influenza vaccine rather than requiring them to take it. As of the date this document is being issued, there is no vaccine available for COVID- 19.In other words, the EEOC advises that employers may consider encouraging employees to receive an influenza vaccine, but that the ADA and Title VII of the Civil Rights Act will restrict employers from requiring all employees to receive a vaccine, even if/when one is available.Closing ThoughtsThe EEOC has underscored that this guidance is contingent on the current state of affairs and that the range of permissible inquiries by employers may expand or contract based on recommendations from the CDC and other public health officials. Although this guidance is not static, it provides valuable information to U.S. employers as they seek to protect their workplaces from COVID-19, particularly when they operate essential activities that require employees to continue reporting to the workplace.

200302-coronovirus-covid-19-promo.jpg

EEOC Issues Updated Guidance for Employers on COVID-19

Practical Considerations for Requiring Employees to Report to Work in Light of COVID-19 Stay-at-Home Orders

200302-coronovirus-covid-19-promo

In a welcome development for U.S. employers, the U.S. Equal Employment Opportunity Commission (EEOC) has issued an updated announcement and updated guidance for

EEOC Issues Updated Guidance for Employers on COVID-19

The World Health Organization (WHO) has now declared the current outbreak of the new coronavirus first identified in Wuhan, Hubei Province, China as a “Public Health Emergency of International Concern.” As more countries announce quarantine measures for travelers returning from Wuhan, businesses need to ensure that they are prepared to deal with the impact of the coronavirus in the workplace. In this alert, we share our recommendations for employers and answer some of the questions that businesses are likely to be asking. Read our <a href="https://www.mofo.com/resources/insights/200131-coronavirus-employers.html?utm_source=publication&utm_medium=email">client alert</a>.

gillham_annabel_blog_150x150.png

gillham_annabel_common_640x280.jpg

gillham_annabel_heroretina_2700x1160.jpg

gillham_annabel_mobileretina_750x1040.jpg

gillham_annabel_social_600x600.jpg

Managing Partner, London

Annabel is a partner at Morrison Foerster and co-Managing Partner of the London office.

Annabel Gillham

spratt_olly_blog_150x150.png

spratt_oliver_common_640x280.jpg

spratt_oliver_heroretina_2700x1160.jpg

spratt_oliver_mobileretina_750x1040.jpg

spratt_oliver_social_600x600.jpg

Oliver Spratt is Of Counsel based in the London office of Morrison Foerster. 

Oliver Spratt

02_28_elc_blog_600px_v24.jpg

Coronavirus: Steps Employers Should Be Taking

Coronavirus: Steps Employers Should Be Taking

02_28_elc_blog_600px_v23.jpg

coronavirus-blog-image

The World Health Organization (WHO) has now declared the current outbreak of the new coronavirus first identified in Wuhan, Hubei Province, China as a “Public H

Increasing digitalisation of the workplace means that many routine activities nowadays entail the processing of employees’ personal information. Sophisticated data management tools allow for greater efficiency and help to identify and contain business risks. What often follows is harmonisation of HR data platforms within an employer’s group of companies, seeking to deliver consistent and seamless HR management across business units and national borders.With the growth of workplace digitalisation, employers need to ensure that their policies and procedures adapt to a growing awareness amongst the general population of privacy rights and to expanding regulatory requirements and oversight, especially in the European Union (EU). As of 25 May 2018, privacy law within the EU will be governed by the EU General Data Protection Regulation (GDPR). This framework updates and modernises the principles enshrined in the 20-yearold EU Data Protection Directive, and will be directly applicable in all EU Member States. Notably, the GDPR provides for an unprecedented sanctions framework, with fines of up to 4% or EUR 20 million of an undertaking, whichever is higher.In this article, we consider three key areas that can become data privacy minefields for employers in the EU:<ol><li>Conducting background checks, or vetting staff or potential hires: in the EU, in-depth screening is only permitted on an exceptional basis;</li><li>Monitoring IT equipment and workplace correspondence, both on a systematic basis and as a one-off (e.g., into suspected misconduct): getting it wrong can be costly, as EU laws can require significant works-council involvement and may result in criminal liability in some cases; and</li><li>Transferring employee data outside the EU: where an employer seeks to integrate its workforce planning tools with affiliates in the EU, it will need to be mindful of the restrictions on data transfers under the EU privacy regime.</li></ol>The UK will leave the EU in March 2019. In the sidebar adjacent, we consider the impact of Brexit on UK employee data privacy rights and wider UK employment law.Pre-Employment Screening It has become common practice for employers to check the internet for publicly available content about job candidates. However, just because information is publicly available does not mean an employer should review it. A recently published opinion by the Article 29 Working Party (WP29), an advisory body made up of a representative from the data protection authority of each EU Member State, provides useful guidance in determining whether employers may use information collected online. As far as social media platforms are concerned, a distinction is made between social media for mainly private purposes and social media for mainly professional purposes. The WP29 stresses that employers should not assume that merely because an individual’s social media profile is publicly available they are then allowed to use that information for their own purposes. Much depends on the source of the information. Employers will typically have a legitimate interest in reviewing candidates’ profiles on LinkedIn and other sites, which contain information relevant to the candidates’ professional qualifications. Social media such as Facebook and Twitter, on the other hand, contains private content that is typically irrelevant to the candidate’s application and is therefore offlimits. Searches on public websites and via search engines such as Google serve a legitimate interest, if they are limited to information relevant to a candidate’s position.Information provided by the candidate during the application process may be used, and the employer is free to verify this information and contact references provided by the candidate for this purpose. However, this process should again focus on relevant information and should not be used as an opportunity to gather unrelated information, such as on the candidate’s private life or any health issues (save where the information is necessary in order to make reasonable adjustments to the recruitment or interview process for disabled candidates) or union activities. In the UK, questions about health (other than information necessary to make reasonable adjustments for disabled candidates) would only be defensible after an offer of employment has been made.Whether information is relevant will depend on the specific position in question. For example, checks on a candidate’s financial probity or criminal background checks may be appropriate for some positions, e.g., to screen delivery staff for past road traffic offences. For other positions, such as in securities trading, they may even be required by local law. For most jobs, however, a criminal background check will not be relevant and is prohibited. Similarly, drug tests will only be permitted on an exceptional basis, e.g., where the position requires the employee to operate heavy machinery or vehicles.The “relevance test” will also inform the applicable retention periods for data collected in the recruitment process. Personal information collected during the recruitment process should generally be deleted as soon as it becomes clear that an offer of employment will not be made or is not accepted by the candidate. If data is required to justify the employer’s rejection of a candidate, however, it may be kept for a longer period of time (not longer than the applicable statute of limitations). If employers wish to retain the candidate’s information for future vacancies, they should obtain explicit consent (e.g., in their rejection notification). Consent is also required if, within a group of companies, affiliates intend to share candidates’ information.Candidates must receive fair notice about the processing of their data. Art. 14 GDPR provides a list of specific items to include in this notice and requires that notice be given, at the latest, one month after the processing. For reasons of transparency, it is advisable to provide notice beforehand by way of a privacy policy or similar document posted on the recruitment page. Where employers have established uniform recruitment policies or staff questionnaires, these may require works-council approval in some EU jurisdictions. Moreover, the employer’s data protection officer, if there is one, may have to be involved when conducting background checks.Employee MonitoringMonitoring employees has become standard practice in many workplaces, and the rapid adoption of new information technologies provides employers with an ever-increasing visibility over employee behaviours. At the same time, the reasons for monitoring can vary greatly. In some industries, monitoring may serve to ensure workers’ safety in hazardous working environments or even be required by industry-specific regulation (e.g., in the financial services sector). Employers may monitor to check the smooth operation of their IT systems. For many employers, however, the primary motive for monitoring is to check employees’ performance, detect misconduct, or ensure compliance with specific company policies and procedures.Under the EU’s privacy regime, any processing of personal information is permitted only if either the individual consents or the employer can rely on a basis stipulated under statutory privacy law. The WP29 has, however, consistently stressed that employers should not rely on employees’ consent to workplace monitoring (with few exceptions). This is because of the inequality in bargaining power between employer and employee, which calls into question whether employees can ever validly consent. The WP29 reasons that employees are in a situation of dependence and might fear adverse consequences if they refuse to consent. Monitoring may be permissible where it is required in order to perform the employment contract or serves legitimate interests of the employer, provided the monitoring is strictly necessary for a legitimate purpose and complies with the “principles of proportionality and subsidiarity.” The “proportionality test” requires the employer to balance its business needs with the counterweighing privacy interests of the affected employees, taking into account, inter alia, the degree of invasiveness and potential consequences for the employee’s private life. “Subsidiarity” means that the employer should first investigate other, less invasive means to protect its interests. For example, monitoring of every online activity of the employees is usually disproportionate. The WP29 stresses that prevention should be given much more weight than detection, as the employer’s interests are better served by preventing IT misuse through technical measures (such as blocking certain websites) than by expending resources in detecting misuse.These principles have been confirmed by a recent judgement of the European Court of Human Rights in Strasbourg (ECHR – not to be confused with the Court of Justice of the European Union in Luxembourg). In the case before the Court, a Romanian employee, Mr. Bărbulescu, had used his workplace email account to exchange private messages with his fiancée and his brother – and was subsequently dismissed. His employer had recorded his messages and introduced the transcriptions as evidence in the dismissal procedure. While the employer had expressly forbidden personal use of company resources, it was unclear whether he had been given adequate notice of this policy. The Court ruled that the monitoring had breached Mr. Bărbulescu’s right to respect for private life per Article 8 of the European Convention on Human Rights. The Court recurred to the principles of proportionality and subsidiarity and held that the employer had failed to substantiate a legitimate reason for the monitoring and take into account potential repercussions for the employee (his fiancée had subsequently decided to end their relationship). The Court also stressed the need for proper notification, in particular of (i) the possibility that the employer may take measures to monitor communications, (ii) the implementation of such measures, and (iii) the extent of the monitoring (including whether it applies only to the flow or additionally to the content of communications and any limits in volume/portion, time, space, and number of individuals accessing the monitoring results).As an example of good practice, monitoring should be subject to a prior privacy impact assessment. This vetting mechanism has been introduced under Art. 35 GDPR for high-risk processing activities and requires the employer to, inter alia, identify safeguards and security measures for the privacy risks arising from the anticipated processing (irrespective of the technology concerned or the capabilities the technology possesses). In addition, the conditions of potential monitoring should be transparently set out in a privacy policy, and employers should introduce acceptable-use policies, outlining the permissible use of the company’s IT equipment, as well as its limits. In some countries, such as Germany, the introduction of technology capable of monitoring (even if it is not intended for that purpose) must also be negotiated with the works council. More generally, employers should be aware that the monitoring of employee communication is subject to country-specific regulation, in particular by local telecommunications and telemedia law. These regulations may impose even more stringent requirements, including criminal liability for violations of telecommunication secrecy.Transfer of Employee DataMost US employers with UK operations are likely already aware of the potential barriers to data flows between the EU and the US In 2015, the once commonly used mechanism, known as the Safe Harbor regime (under which organisations receiving data in the US self-certified adherence to certain data privacy principles), became defunct after a ruling by the Court of Justice of the European Union that the regime did not provide adequate protection to personal information transferred from the EU. Whilst a replacement framework and self-certification regime (the “Privacy Shield”) has now been approved by the European Commission, most multinational employers deal with cross-border transfers of employee data using “binding corporate rules” (if the transfer is intra-group) or European Commission–form “standard contractual clauses” (if the transfer is between the employer and a third party, and one of them is based outside the EU).As part of preparation for GDPR, multinational employers should audit what employee data is transferred outside the EU and the purpose for which it is transferred and ensure that, to the extent such transfers are necessary, data is transferred securely and adequate mechanisms are in place (such as those described above) allowing the non-EU recipient to receive the data.Employers are also well advised to keep an eye on Brexit negotiations to see what approach will be taken to UK data privacy standards post-Brexit. The UK will be subject to the GDPR prior to Brexit, but it remains to be seen whether it will be deemed to provide adequate protection post-Brexit to receive employee personal information from the EU.ConclusionWorkplace digitalisation presents employers with vastly growing opportunities but brings along an array of new compliance risks as well. Within the European Union, the processing of employee data is subject to a number of stringent tests set out under statutory law. Most often, employees cannot waive the protection afforded to them by the law. Consequently, while employers are required to provide transparent notice, they will typically not be able to rely on employees’ consent for their data processing.As the GDPR enters into force on 25 May 2018, introducing an unprecedented catalogue of financial sanctions, the stakes will be rising considerably. Employers are advised to review their processing operations, and implement any necessary changes, well before this deadline. Depending on the type of data processed, employers may be required to consult their data privacy officer (if there is one) and conduct a prior privacy impact assessment. Under local law in various EU Member States (such as Germany), the processing may also trigger works-council codetermination rights and even potential criminal liability, in particular where employee data falls under the protection of local telecommunication and telemedia law. The latter will typically be the case if the employer introduces technology that permits the monitoring of workplace communication, via phone, email, or other devices.

Hot Topics For Multinational Employers: Privacy In The Workplace, The EU General Data Protection Regulation, And Brexit

timner-hanno-blogheadshot.jpg

timner_hanno_common_640x280.jpg

timner_hanno_heroretina_2700x1160.jpg

timner_hanno_mobileretina_750x1040.jpg

timner_hanno_social_600x600.jpg


For more than two decades, Hanno has advised and represented leading domestic and international corporations in a wide variety of industries, including technology, consumer products, automotive, and 

Hanno Timner

Hanno Timner is a partner in the Berlin office and head of the Employment and Labor practice group in Germany. He advises and represents national and international employers in all labor law issues and disputes.

sirimanne_lara_blog_150x150.png

sirimanne_lara_common_640x280.jpg

sirimanne_lara_heroretina_2700x1160.jpg

sirimanne_lara_mobileretina_750x1040.jpg

sirimanne_lara_social_600x600.jpg

Associate

Lara Sirimanne is an associate in the London employment practice of Morrison & Foerster. She advises domestic and international clients on the full spectrum of both contentious and non-contentious emp

Lara M. King

Lara King

elcblog-october-_2017.jpg

Hot Topics For Multinational Employers: Privacy In The Workplace, The EU General Data Protection Regulation, And Brexit

elcblog-october- 2017

Increasing digitalisation of the workplace means that many routine activities nowadays entail the processing of employees’ personal information. Sophisticated d