Articles Posted in Privacy

Employers in New Jersey use increasingly high-tech methods to monitor their employees throughout the work day. Some of these methods raise concerns about employee privacy, especially systems that collect biometric data. “Biometrics” refers to the automated use of physical characteristics to identify individuals. For example, many smartphones give users the options of unlocking their devices with fingerprint or facial recognition software. Some employers use this kind of technology to control access to worksites or track employees’ time. This means that each time an employee passes a checkpoint or enters the employer’s premises, the employer captures an image of their face, fingerprint, or other unique identifying feature. Employees have an interest in knowing how employers are using this information, and how securely they are storing it. Currently, no law in New Jersey regulates the collection, storage, and use of biometric data. A bill pending in the New Jersey Assembly would address this issue and provide a path forward for New Jersey employment lawyers and their clients.

Under New Jersey law, employers may not intrude into areas where employees have a reasonable expectation of privacy. Unreasonable searches of private areas in the workplace, such as an employee’s locker, may violate an employee’s legal rights. Surveillance of phone or computer use is allowed by law, as long as it is reasonably related to the employer’s business. Video monitoring of common areas is not unusual, particularly in retail or warehouse settings. Intrusive surveillance that serves no legitimate business purpose could be unlawful. In extreme cases, such as video monitoring of a restroom or changing area, it could even be criminal.

Biometric surveillance is, in one sense, an extension of video surveillance. Since it results in the collection of data that could be used to identify specific individuals, it is also analogous to the collection of Social Security numbers and other information best kept private. Few states currently have laws addressing the collection of biometric data. Illinois enacted the first such law, the Biometric Information Privacy Act (BIPA), in 2008. Other states have passed similar laws since then. BIPA remains the only law that allows private causes of action for violations.
Continue reading

The COVID-19 pandemic has now entered its ninth month in the United States. After extensive lockdowns in March and April 2020, cities and states around the country struggled with finding ways to reopen their economies without risking public health. Many New Jersey employees had to adapt quickly to a home office environment. Workers deemed “essential” had to continue reporting to their jobs, often with added safety measures intended to inhibit the spread of the novel coronavirus. Some of the new measures used by employers raise important questions about employee privacy rights in New Jersey.

New Jersey Workplace Privacy Laws

As a general rule, employees do not have an expectation of privacy when they are at work, on the clock, and using their employer’s property. Employers can, with some exceptions, access emails sent by employees using a company email address, or search employees’ desks and other areas in the workplace. Employees’ personal property, such as cell phones, purses, and wallets, are subject to greater legal protection.

New Jersey recognizes several common-law claims for privacy violations, including intrusion upon seclusion, which protects a person’s “private affairs or concerns.” With more workers doing their jobs remotely, often using videoconferencing technologies that allow employers to see into their homes, these concerns have become much more pressing.

Continue reading

Background checks enable employers to obtain a vast amount of information about prospective employees. In order to safeguard people’s privacy, the Fair Credit Reporting Act (FCRA) establishes limitations on the collection and use of people’s personal information during the hiring process. The law regulates both employers and consumer reporting agencies (CRAs), which collect consumer information and compile it into reports for employers and others. Both CRAs and employers are potentially liable to job applicants for violations of the FCRA, but liability generally arises under different circumstances. Two recent decisions from New Jersey federal courts clarify who is primarily liable to a job applicant for FCRA violations. Muir v. Early Warning Svcs., et al., No. 2:16-cv-00521, op. (D.N.J., Sep. 15, 2016); Geter v. ADP Screening & Selection Svcs., et al., No. 2:14-cv-03225, op. (D.N.J., Apr. 23, 2015).

The FCRA defines a “consumer report” as any collection of information about an individual with regard to factors like “credit worthiness,…character, general reputation, personal characteristics, or mode of living.” 15 U.S.C. § 1681a(d)(1). A consumer report may include financial information like delinquent accounts and bankruptcies, as well as arrests, criminal charges, convictions, and other legal information. The statute defines a CRA as any individual or business that routinely compiles consumer information into reports in exchange for financial compensation. Id. at § 1681a(f).

A CRA may not issue a consumer report to an employer until the employer certifies that it has complied and will continue to comply with its obligations under the FCRA. Id. at § 1681b(b)(1). An employer must obtain the job applicant’s written consent to obtain a consumer report, and it must provide the applicant with a written disclosure explaining that the employer may use the report in making a hiring decision. Id. at § 1681b(b)(2).

Continue reading

Employers frequently conduct background checks on job applicants by obtaining a consumer report from a credit reporting agency (CRA). In some cases, such as jobs in law enforcement or jobs requiring security clearances, employers are required to conduct background checks for specific issues. Background checks also make sense for certain types of jobs. For example, an employer hiring for a position that involves handling large amounts of money might want to check for excessive problems with debt or past convictions for offenses like fraud or embezzlement. By relying on CRAs to provide background information on job applicants, employers rely on the accuracy of the information they provide. Since these reports are not always accurate, the federal Fair Credit Reporting Act (FCRA) regulates both CRAs and employers. The Federal Trade Commission (FTC) recently offered some guidance to employers regarding FCRA compliance in a blog post. Job applicants might find the FTC’s post useful as a guide to potential warning signs in the job application process.

In the context of employment, the FCRA requires both CRAs and employers to follow specific procedures. An employer must give a job applicant a “clear and conspicuous disclosure…in a document that consists solely of the disclosure” detailing its intent to obtain a consumer report as part of the hiring process, and it must obtain the applicant’s written consent. 15 U.S.C. § 1681b(b)(2). A CRA may not issue a consumer report to an employer unless it obtains a certification from the employer stating that the employer has fulfilled all of its obligations regarding disclosure and consent and that it will comply with all additional requirements under the FCRA. Id. at § 1681b(b)(1).

If an employer decides not to hire an applicant because of information contained in a consumer report, the FCRA requires it to provide a copy of the report to the applicant, along with a written description of the applicant’s legal rights. Id. at §§ 1681b(b)(3), 1681g(c). This allows the applicant to review the information that the employer saw and to use other legal mechanisms provided by the FCRA to correct incorrect or incomplete information. The employer must allow a reasonable amount of time for the applicant to review the report and communicate with the CRA that issued it.

Continue reading

The U.S. Congress has enacted several statutes addressing unauthorized access to computer systems, commonly known as “hacking.” These statutes include both civil and criminal components. The Stored Communications Act (SCA), 18 U.S.C. § 2701 et seq., deals with digital information stored by third parties, usually internet service providers (ISPs). It comes into play when someone accesses another person’s email or other stored communications data without authorization. The statute allows civil claims in certain cases. 18 U.S.C. § 2707. When an employer accesses an employee’s online information without permission, it could be liable to the employee for damages under the SCA.

Third-party ISPs include companies that provide internet access, email servers, and social media services. The use of a third-party ISP involves voluntarily entrusting personal information to someone else’s care. The SCA seeks to protect people’s privacy rights with regard to this information against both the government and private individuals and entities. The Fourth Amendment to the U.S. Constitution guarantees people’s right to “be secure in their…papers and effects,” but voluntarily turning materials over to a third party can negate the Fourth Amendment’s protection. The SCA extends Fourth Amendment-like protections against government access to stored communications. Since non-government actors are not constrained by the Fourth Amendment, the SCA also prohibits unauthorized access by private actors.

The same principle that excludes voluntarily disclosed information from Fourth Amendment protection also applies to the SCA. The “authorized user exception” states that SCA protection does not apply to “conduct authorized…by a user of that service with respect to a communication of or intended for that user.” 18 U.S.C. § 2701(c).

Continue reading

A plaintiff in a civil lawsuit must establish that they have standing, meaning that they are legally eligible to bring this particular claim against this particular defendant. The method of establishing standing varies considerably among different types of claims. In many cases, a plaintiff must demonstrate that they have suffered actual harm, known as an “injury-in-fact.” The U.S. Supreme Court recently established an injury-in-fact requirement for claims under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., which can include employment-related claims. In a putative class action brought by a group of employees under the FCRA, a New Jersey judge denied class certification on the ground that the plaintiffs had not alleged an injury-in-fact but gave the plaintiffs the opportunity to amend their complaint. In re Michael’s Stores, Inc. Fair Credit Reporting Act (FCRA) Litigation, Nos. 14-7563, 15-2547, 15-5504, opinion (D.N.J., Jan. 24, 2017).

The FCRA regulates the collection, distribution, and use of consumer credit information by credit reporting agencies, employers, and others. Since many employers want to review credit history and related information when making employment decisions, the FCRA regulates how employers may obtain that information. In addition to getting consent from each employee or job applicant, employers make specific disclosures to those individuals about how they intend to use the information. The disclosure must be “clear and conspicuous” and “in writing,” and it must be presented to the individual “in a document that consists solely of the disclosure.” 15 U.S.C. § 1681b(b)(2)(A).

The Supreme Court ruled on the FCRA’s injury-in-fact requirement in Spokeo, Inc. v. Robins, 578 U.S. ___ (2016). The defendant in that case operates a search engine that aggregates personal information from a variety of sources, allowing users to gather information about specific individuals. The plaintiff filed suit under the FCRA after finding that the site created a profile page for him that contained inaccurate information. He alleged that the defendant violated his rights under the FCRA by mishandling his personal credit information. The Supreme Court ruled that the plaintiff had not demonstrated an injury-in-fact, noting three required elements:  (1) “an invasion of a legally protected interest” that is both (2) “concrete and particularized” and (3) “actual or imminent, not conjectural or hypothetical.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992).

Continue reading