Steps to Avoid Violating Employee Privacy Rights

In my first Insight, I introduced you to employee privacy rights and what companies need to be aware of.

Companies need to draft policies and procedures that protect employee data. At the same time, companies should have a policy letting employees know they have no expectation of privacy when using company systems.

Know the Law
The first thing a company needs to do is make sure that policies and procedures are written with employee privacy rights laws in mind. Employees need to understand so they don’t get upset and think the company is setting certain rules in place because they’re trying to be “nosey” or to have control or gain control of employees.

By reducing the employees’ expectations of privacy from the beginning, you will ensure employees understand their privacy rights and are also aware of where the company has control over the amount of privacy allowed.

Implement Well-Written Policies and Procedures
The key to employers maintaining compliance with their policies is to make sure they have well-written policies and provide notification of these policies to all employees—new and current.

For example, employers should make employees aware of any monitoring or surveillance so as to avoid an invasion of privacy claim. Since this could present potential for a violation, the employer should make employees aware of any monitoring prior to taking action. This policy would also need to be in the employee handbook so employees have knowledge of it.

Monitoring should not be conducted in restrooms or changing areas where individuals would have a reasonable expectation of privacy.

Contact an HR Specialist and/or Legal Counsel
When it comes to employee privacy rights, it’s a good idea to consult an HR Specialist or legal counsel, since many companies don’t have an in-house HR person. These types of people are usually well-versed in employment law and will be able to make companies aware of privacy laws pertaining to them. 

Here are some things you should contact a professional regarding: 

• Reviewing company policies relating to the various areas that may impact employee privacy rights.
  
• If you should hire someone—either an internal HR professional or a third-party HR provider. These professionals are trained to be aware of employment laws and regulations, and they can help ensure compliance with state and federal laws.
  
• How to get your entire management team fully supporting and involved in maintaining this compliance and implementing and protecting employee privacy rights that will, in turn, also help protect the company.
  
• If you should include, and how to include, all employees that deal with personal data in maintaining compliance, such as the IT department, benefits department, etc., because they are in charge of collecting and storing employees’ personal data. Gathering, correct distribution and proper disposal of that kind of personal information are the key responsibilities of employers, which is why privacy policies are extremely important.
  
• How to create either a comprehensive workplace privacy policy or policies for specific areas needing privacy coverage. For example, it’s important to cover the electronic communications policy your company has in place. Companies should publish and update policies regarding employee use of e-mail, Internet and instant messaging. Include proper conduct on such programs and any restrictions. The policy should clearly state employees should have no expectation of privacy when using company equipment including computers, laptops or BlackBerries. Companies need to refer employees to these policies frequently, and especially when updates are made. 

Companies should obtain employee consent to all privacy policies implemented and renew employee consent often (once or twice a year). Employees need to be made aware of the policies that they are required to follow.   

It’s also important for companies to continually review their employee data handling practices and procedures to ensure compliance with all policies, as well as local, state and federal laws.

Companies need to draft policies and procedures that protect employee data.