Back in January, when California's legislative session was getting underway, Jennifer Kramer and her fellow labor attorneys at the California Employment Lawyers Association had one item on their agenda: Passing legislation that protects employee privacy.
Lawmakers in California had punted on the issue when they negotiated the sweeping California Consumer Privacy Act in 2018, largely exempting employee data from being covered under the law until 2021. This was the year that businesses, labor groups, privacy advocates and the legislature were supposed to figure out what would happen after that. If they succeeded in ironing out privacy protections for workers, they would set a new standard in the country's most populous state, which is home to many of the world's most powerful companies and the heart of the tech industry.
But the COVID-19 crisis changed everything. Instead of 2020 being the year of a robust debate about employee data privacy in California — and in America — it's become the year of thermal temperature scanners in warehouses, software that monitors remote workers' every keystroke, and wearable devices tracking employees' locations.
In the rush to keep people safe and productive in an unprecedented time, Kramer said, "Employers have sort of lost their minds."
The turnabout underscores a key distinction of electronic privacy laws that have passed in the past few years: They almost universally exclude data that employers collect on their employees. That information has proven trickier to regulate than consumer data.
But workers have been left without recourse if, say, they're automatically fired as a result of an algorithm, or if their employer tracks their menstrual cycle. Now, as even more invasive employee monitoring systems weave their way into corporate life almost overnight, some fear the debate over worker privacy is dying out at the very time it's needed most.
"We're essentially turning our employers into a form of national surveillance," said Vanessa Wu, general counsel for Rippling, which makes human resources software. "We've been seeing regulators asking employers to be the front line of doing tracing for COVID-19. I find that to be very concerning because it puts a lot of responsibility on employers, who are not health professionals, and presumes a level of data-sharing that I don't think has ever been seen before."
There are, of course, plenty of good reasons why even labor and privacy advocates say employee data shouldn't be regulated in the same manner as consumer data. Consider that under the California Consumer Privacy Act, or CCPA, consumers have the right to see all the data a business of a certain size has collected on them. In a workplace, that could expose sensitive information, such as a sexual harassment complaint against the person requesting the data.
It could also become burdensome for employers, who, on top of responding to consumer requests, could be forced to respond to workers' data requests. And that could ultimately open them up to spurious litigation, said Usama Kahf, who specializes in CCPA compliance as a partner at the Irvine-based law firm Fisher Phillips.
"The concept of giving employees the right to access, free of charge, a copy of all personal information collected about them by their employer is, just, to put it in legal terms, crazy," Kahf said.
For that reason and a slew of others, business groups fought hard to ensure that employee data would be exempted from CCPA altogether. And they might have gotten their way had labor groups like the California Employment Lawyers Association and civil liberties organizations like the ACLU and the Electronic Frontier Foundation not fought back. According to Emory Roane, policy counsel with the group Privacy Rights Clearinghouse, the two sides eventually agreed to the one-year exemption, for fear of rushing through "a weak standard."
"It's unfortunate that it wasn't hammered out," Roane said. "No one could have seen this [pandemic] coming, but this is exactly the kind of situation where it would be great to have stronger protections for employee data."
Even with the exemption, employees do have some limited rights under CCPA. Employers must disclose information they're collecting on workers in California, and if a company has a data breach that exposes employee data, those employees all have the right to sue.
"If an employer wants to turn on the panopticon software, they're going to at least have to turn on the notice," Roane said. But he argues that simply securing data, and notifying employees data is being collected, "falls far short" of the protections privacy groups want, particularly now.
Privacy and labor groups have pushed for policies that would prevent an employer from retaliating against workers who refuse to give consent to different forms of tracking. They've also advocated for concepts like data minimization to be amended into CCPA. That would require companies to limit the data they collect up front to only what's necessary to carry out consumer requests and court orders or to ensure security.
In February, a coalition of privacy groups threw support behind a bill that would have required data minimization for both consumer and employee data. But the California Assembly declined to hear the bill this year. "Allegedly, it wasn't related enough to COVID-19," said Samantha Corbin, a lobbyist for the privacy coalition.
In a statement to Protocol, California Assemblyman Ed Chau, who leads the Committee on Privacy and Consumer Protection, said he is "closely monitoring government and employer practices" with regard to COVID-19 and stands "ready to work" on crisis-related legislation. "While the current pandemic has resulted in complications to the legislative process," Chau said, "there is still some time to work on the employee data exemption from last year where stakeholders are willing to do so."
Yet many of those stakeholders, including labor unions and employment lawyers like Kramer, have had to shift their own focus to basic worker protections like unemployment insurance and paid leave. With millions of Californians out of work and millions more working at considerable risk to their health, Kramer said she and her colleagues have been in "triage" mode. "There's been a big shift in our priorities and what we can tackle," Kramer said.
Complicating matters further is a ballot initiative called the California Privacy Rights Act, or CPRA, that may be headed to a vote this November. The measure is sponsored by Alastair Mactaggart, the real estate mogul who authored a similar ballot measure in 2018 that became the basis of CCPA. This new initiative would rewrite CCPA and extend the employee data exemption for three years.
Even before the pandemic hit the United States, the possibility that the measure might pass in November had thrown a wrench into negotiations over CCPA. Mactaggart didn't respond to Protocol's request for comment. "I think there's a lot of businesses quietly sitting on their hands and hoping [voters] sign off on that initiative that will give them another three years," Corbin said.
The labor and privacy advocates who spoke to Protocol said that if CPRA somehow doesn't make it to the ballot (Mactaggart pulled his 2018 ballot initiative at the last minute), they expect the legislature to pass another extension under the wire. Otherwise, come January 2021, employees would have the same data rights as consumers do in California, a shift that voices on both sides of the issue agree could have disastrous consequences.
The advocates are not arguing that workplaces should be barred from putting in place measures to protect worker safety. Quite the opposite: They welcome safety measures, as long as there are limits in place to prevent, say, the use of location tracking technology to monitor union organizing.
Even in the state with the country's most expansive privacy law, none of those limits exists. Not only that, but the window for discussing those safeguards has, at least temporarily, closed.
For now, Kramer said, workers in California can at least take solace in the fact that the state's constitution guarantees them the right to privacy. How that right applies to the workplace during a public health emergency, though, remains unclear.
"The question," Kramer said, "is how creepy is the employer being?"
