When crafting your employee monitoring policy, what are the legal limits for just how far you can go? Are California employers subject to increased restrictions since the California constitution has greater privacy protections? Unsurprisingly, the answer is yes. And in addition to that, a new law just went into effect banning employer access to private social media sites that employees use.
Employee monitoring policies in California: Establishing privacy expectations
As an employer, you’ve got some legal leeway to create an employee monitoring policy, but it only goes so far before you’re invading an employee’s privacy and sparking a lawsuit. This is because employee monitoring policies often hinge around the employee’s expectation of privacy.
To ensure the employee does not have an expectation of privacy when it does not exist, California employers should clearly outline to employees what can be monitored by the employer. Be specific and all-inclusive. “The number one thing about employee monitoring that we do know is that you need to have a clear, written policy. It’s the most important thing because it sets the expectation of privacy.” Megan Winter confirmed in a recent CER webinar.
In California, employer-owned devices such as smart phones, iPads, and laptops can be monitored with proper notice to employees. “Your policy should be clear that the employer maintains rights to ownership of all content on employer-owned devices: text messages, data from applications, photos, [and] videos. If you’re providing technology to people, you want to have a section of your [employee monitoring] policy that specifically addresses that.” Winter advised.
Additionally, personal devices that are connected to the employer’s network may be partially monitored. They can be monitored only to the extent that it is an employer-owned email. Other personal items cannot be monitored on a personal device.
Asking for social media passwords is off-limits
Employers in California cannot ask an employee for their passwords. This form of employee monitoring is off-limits, even as a form of a background check. It is a violation of employee privacy. This has been made law through California Labor Code Section 980, which went into effect on January 1, 2013. It states that an employer shall not require or request an employee or applicant for employment to do any of the following:
- Disclose a username or password for the purpose of accessing personal social media.
- Access personal social media in the presence of the employer.
- Divulge any personal social media.
There are, however, some exceptions within the law:
- The employer maintains their existing rights to request social media information that is reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding. This however, leaves the question of what is a “reasonable belief” under this exception? The general consensus is that it is a good-faith belief.
- An employer can also require or request an employee to disclose a username, password, or other method for the purpose of accessing an employer-issued electronic device.
This new California law also provides a retaliation provision. It states that an employer shall not discharge, discipline, threaten to discharge or discipline, or otherwise retaliate against an employee or applicant for not complying with a request or demand by the employer that violates California Labor Code 980. However, this section does not prohibit an employer from terminating or otherwise taking an adverse action against an employee or applicant if otherwise permitted by law.
The above information is excerpted from the webinar “California: HR’s E-Monitoring Rules and Rights: Mastering E-Mail, IMs, Blogs, and Social Networking.” To register for a future webinar, visit CER webinars.
Megan Winter is an attorney in the San Diego office of Fisher & Phillips LLP. She assists employers in developing workplace policies and procedures, and she regularly advises employers regarding day-to-day employment issues and ways to avoid employment claims and litigation.
What about personal devices that are used for business purposes beyond email? Is more extensive monitoring OK?
What about personal devices that are used for business purposes beyond email? Is more extensive monitoring OK?