Can We Do That?: Answering Questions About Protecting Employee Privacy During a Pandemic

This article was originally published by Hennepin County Bar Association on January 5, 2021. Reprinted with permission.

As the COVID-19 pandemic rages on, employers are forced to cope with established employee privacy laws in novel contexts. Below are some of the difficult employee privacy questions law firms and other legal employers may be facing.

Question 1: Should my law firm or organization use a device or app to help enforce social distancing?

Answer: It depends on the features of the device or app, including what data is collected and how. Additionally, employers should balance any workplace safety benefits with employee perception.

Under the Occupational Safety and Health Act (OSHA), all employers are required to provide their employees with a hazard-free workplace. To lessen the spread of COVID-19, tech companies have released devices and apps designed to prevent, track, and respond to close contact between users. Ranging from least invasive to most, here are several options.

Wearable devices: Perhaps the most basic option is the use of employer-provided wearable devices. These devices use Bluetooth technology to alert employees through a noise or vibration if they are within six feet of another device.

Bluetooth-based apps: Bluetooth-based apps allow users’ phones to sense the presence of other users’ phones. If a user reports a positive COVID-19 test result on the app, notifications are sent to any users whose phones were recently near the COVID-19-positive user, usually subject to length-of-contact requirements.

Satellite-based GPS signal apps: GPS-based apps learn when users have been near others by tracking users’ geographic data. These apps provide more detailed contact-tracing information to users, like a social distance “score” based on how many crowded areas they’ve visited and if they’ve been within six feet of another user for several minutes. They can also be used for alerts when another user has tested positive for COVID-19.

Before implementing one of these devices or apps, employers should consider the following:

Voluntary vs. mandatory use: No contact tracing device or app will be effective unless there is widespread adoption. A voluntary program may cause contention among employees deciding whether to participate, and it risks being ineffective if adoption is low. Mandatory adoption may be perceived as overly intrusive or paternal. Although mandatory adoption is currently permissible, legislation in this area is fluid and employers should consult up-to-date local, state, and federal guidance before implementation.

Employer-provided devices vs. personal devices: Generally, all information collected through these devices and apps is protected and not subject to employer review. Employer provided devices are generally the better option because they do not infringe on employee privacy, and they can be limited more easily to the workplace and on-duty hours. The use of apps on personal devices is likely better suited to workplace realities, but employers may need to reimburse employees for any charges incurred as a result of the additional technology, and they should also be on guard against data overcollection, like off-duty contacts.

Bluetooth vs. GPS location data: The more information that a device or app collects and retains, the more problematic it may be from a privacy standpoint. The leap from Bluetooth technology to satellite-based GPS technology is a large one. While Bluetooth technology reveals where an employee is relative to other employees, GPS technology reveals where an employee is, period. This raises a host of concerns about how geographic location data is used. Many apps on the market say they will not store data in centralized databases and will conceal individual identities and connections. Despite these promises, an employer may be opening itself up to liability if the technology use might support an inference that an adverse employment action was the result of targeting an employee or making assumptions about the employee based on location data.

Practical and privacy constraints may lead to ineffective devices and apps: After accounting for privacy concerns and practical limitations, employers must determine the value of the remaining technology. On the practical side, consider employees who persistently forget their phone or have poor reception. Contact tracing technology will be ineffective under these conditions. And, because employees may be bolstered by a false sense of security, the devices and apps may even do more harm than good. On the privacy side, mandatory device use should be limited to in-office hours, but if workplace contacts are not a major source of COVID-19 spread among employees, the devices and apps will do little to enhance workplace safety.

Employee perception: Employee perception of a privacy violation is as important—and perhaps more important—than whether the law would find an invasion of privacy. As all employers have learned during the pandemic, some employees feel that any inquiry into their personal lives is a gross infringement, while others expect their employer to track and share detailed information in the name of safety. The divide between these two groups must be navigated. Because all contract-tracing methods rely on widespread use to be successful, employers may face a choice between allowing employees to opt-out or being perceived as heavy-handed.

Overall, contact-tracing devices and apps may be an effective way to improve workplace safety, but the decision to implement them should not be made lightly. An employer seeking to implement one of these devices or apps should carefully analyze the options and weigh the privacy risks against the likely safety benefits. Employers should also discuss the potential of using a device or app with their employees before deciding to take the leap.

Question 2: If I’m returning to the office, what information can my firm or organization collect from me, and what does it have to do to protect my information?

Answer: Under the Americans with Disabilities Act (ADA), employers may conduct inquiries and medical examinations in connection with a business necessity, including those related to COVID-19, so long as it remains an ongoing medical emergency in the United States.

Self-reported data: Your employer may ask if you have symptoms associated with COVID-19 or have been tested for COVID-19; whether you have been in contact with, or live with, anyone with COVID-19 or COVID-19 symptoms; and where you have traveled. You may not be singled out for questioning unless your employer has a reasonable belief based on objective evidence that you have COVID-19. While an employer may ask generally about whether anyone you live with has COVID-19 or COVID-19 symptoms, the employer should not specifically ask whether your family members have COVID-19 or COVID-19 symptoms.

Testing: Employers may take your body temperature and can administer or require a COVID-19 test. If you have disability-related or religious objections to testing, you should discuss accommodations with your employer. Your employer may not administer or require antibody testing because such testing does not meet the business necessity standard.

Documents containing medical information: Employers can require a doctor’s note certifying fitness for duty if you have been out sick with COVID-19. If you seek leave under the Family and Medical Leave Act (FMLA), your employer is allowed to seek medical certification of the underlying serious health condition. And if you request a disability accommodation, your employer can request information to determine if the condition is a disability and why the accommodation is needed.

Your employer must keep all medical information confidential and separate from other personnel records. The use of data is restricted to the business necessity for which it was gathered, so COVID-19-related medical information cannot be used for tracking worker productivity or gathering information for a disciplinary investigation, for instance.

Question 3: What can my employer disclose when there is a positive case of COVID-19 in our firm or organization? And to whom?

Answer: When an employee tests positive, information about that employee falls into one of three categories: information the employer must disclose; information the employer may disclose; and information the employer may not disclose.

Must disclose: Close contact with employees. If the COVID-19-positive employee has been in “close contact”—defined by the Centers for Disease Control (CDC) as 15 minutes within six feet of each other—with any other employees, the employer must educate these employees on how to prevent the continued spread of COVID-19. Because the employer may require these employees to stay home, the employer may need to disclose that the employees were close contacts of an infected person, although there is no guidance or law that specifically requires this disclosure.

May disclose: Close contact with visitors. If the COVID-19-positive employee has been in close contact with any non-employee visitors, the employer may disclose the close contact to those visitors. However, if the employer has a policy stating it will inform visitors with close contact of a positive COVID-19 test result in the workplace, this changes from “may disclose” to “must disclose.”

All employees: Similarly, the employer may disclose the positive test result to its entire workforce. Doing so fosters confidence in transparency and provides an opportunity to reiterate the firm’s safety precautions. Again, if there is a policy that the employer will inform all employees of a positive COVID-19 test result in the workplace, this changes from “may disclose” to “must disclose.”

Certain details of the diagnosis: The employer may also disclose to either employees or non-employees the date on which the employee was diagnosed with COVID-19, the last date on which the employee was in the office, and whether the employee’s symptoms are “mild,” “moderate,” or “severe.” Before deciding to do so, the employer should be mindful that while this employee’s symptoms may be mild, another employee’s may be severe. Disclosing that an employee has severe symptoms may cause panic, while excluding the information intermittently may undermine the firm’s desire to be transparent, fostering confusion rather than trust.

May not disclose: Name of employee and additional details of the diagnosis. The employer may not disclose the COVID-19-positive employee’s name and other details of the diagnosis, including any treatment the employee is undergoing. Doing so would be a violation of the ADA’s requirement that all employee medical information, including results of a COVID-19 test, gathered by an employer  must be kept confidential.

Question 4: I work from home and my children are distance learning which requires me to attend weekly meetings with them and their teachers. What do I need to tell my employer so I can have this time off?

Answer: Because employees must accurately report time working and not record time spent performing personal tasks, you likely need to share something with your employer about missing work for these activities. Granting of personal leave is at the complete discretion of the employer, must be on a non-discriminatory basis, and subject to certain laws. Therefore, employers may ask for a reason for the request. Here, you may have a statutory right for unpaid leave to attend the weekly meetings with your children’s teachers under Minnesota’s School Conference and Activities Leave law. When requesting time off for this reason, you should make clear the time is needed to attend a school conference.

This law grants eligible employees—those who work at least half of their employer’s criteria for full-time hours—up to 16 hours of unpaid leave each year, per child, to attend school conferences and activities. If the leave is foreseeable, employees must provide their employer with reasonable prior notice of the leave and make a reasonable effort to schedule the leave during a time less disruptive to work. Employers cannot require eligible employees to use paid time off (PTO) or vacation time; however, the employee may substitute any accrued paid vacation leave or other appropriate paid leave for any part of the leave, subject to their company’s PTO or vacation policy.

Alternatively, you may be eligible for paid leave under the Families First Coronavirus Response Act (FFCRA). Under the FFCRA, covered employers are required to provide eligible employees up to 12 weeks of paid leave, with a daily monetary cap, if the employees are unable to work or telework due to their child’s school or place of care being closed. The U.S. Department of Labor has stated that when school days are designated for distance learning, the school is effectively “closed” to students for the purpose of the FFCRA. Here, too, your employer is permitted to gather some information about the need for FFCRA leave in order to confirm your eligibility. Your employer may ask you for a certification stating that your children’s school is closed and that you must care for them during the needed leave time.

If none of these leaves applies, your employer is permitted to ask for the information required under its policy for personal leave for appointments, childcare, education, or other non-work responsibilities.