People

The debate over workers' electronic privacy is dying right when it’s needed most

This was supposed to be the year employees finally obtained some privacy rights. Thanks to the COVID-19 crisis, they're getting the opposite.

A person getting their temperature checked

Instead of 2020 being the year of debating employee data privacy in California, it's become the year of thermal temperature scanners, software that monitors remote workers' keystrokes and wearable devices tracking employees' locations.

Photo: Getty Images

Back in January, when California's legislative session was getting underway, Jennifer Kramer and her fellow labor attorneys at the California Employment Lawyers Association had one item on their agenda: Passing legislation that protects employee privacy.

Lawmakers in California had punted on the issue when they negotiated the sweeping California Consumer Privacy Act in 2018, largely exempting employee data from being covered under the law until 2021. This was the year that businesses, labor groups, privacy advocates and the legislature were supposed to figure out what would happen after that. If they succeeded in ironing out privacy protections for workers, they would set a new standard in the country's most populous state, which is home to many of the world's most powerful companies and the heart of the tech industry.

But the COVID-19 crisis changed everything. Instead of 2020 being the year of a robust debate about employee data privacy in California — and in America — it's become the year of thermal temperature scanners in warehouses, software that monitors remote workers' every keystroke, and wearable devices tracking employees' locations.

In the rush to keep people safe and productive in an unprecedented time, Kramer said, "Employers have sort of lost their minds."

The turnabout underscores a key distinction of electronic privacy laws that have passed in the past few years: They almost universally exclude data that employers collect on their employees. That information has proven trickier to regulate than consumer data.

But workers have been left without recourse if, say, they're automatically fired as a result of an algorithm, or if their employer tracks their menstrual cycle. Now, as even more invasive employee monitoring systems weave their way into corporate life almost overnight, some fear the debate over worker privacy is dying out at the very time it's needed most.

"We're essentially turning our employers into a form of national surveillance," said Vanessa Wu, general counsel for Rippling, which makes human resources software. "We've been seeing regulators asking employers to be the front line of doing tracing for COVID-19. I find that to be very concerning because it puts a lot of responsibility on employers, who are not health professionals, and presumes a level of data-sharing that I don't think has ever been seen before."

There are, of course, plenty of good reasons why even labor and privacy advocates say employee data shouldn't be regulated in the same manner as consumer data. Consider that under the California Consumer Privacy Act, or CCPA, consumers have the right to see all the data a business of a certain size has collected on them. In a workplace, that could expose sensitive information, such as a sexual harassment complaint against the person requesting the data.

It could also become burdensome for employers, who, on top of responding to consumer requests, could be forced to respond to workers' data requests. And that could ultimately open them up to spurious litigation, said Usama Kahf, who specializes in CCPA compliance as a partner at the Irvine-based law firm Fisher Phillips.

"The concept of giving employees the right to access, free of charge, a copy of all personal information collected about them by their employer is, just, to put it in legal terms, crazy," Kahf said.

For that reason and a slew of others, business groups fought hard to ensure that employee data would be exempted from CCPA altogether. And they might have gotten their way had labor groups like the California Employment Lawyers Association and civil liberties organizations like the ACLU and the Electronic Frontier Foundation not fought back. According to Emory Roane, policy counsel with the group Privacy Rights Clearinghouse, the two sides eventually agreed to the one-year exemption, for fear of rushing through "a weak standard."

"It's unfortunate that it wasn't hammered out," Roane said. "No one could have seen this [pandemic] coming, but this is exactly the kind of situation where it would be great to have stronger protections for employee data."

Even with the exemption, employees do have some limited rights under CCPA. Employers must disclose information they're collecting on workers in California, and if a company has a data breach that exposes employee data, those employees all have the right to sue.

"If an employer wants to turn on the panopticon software, they're going to at least have to turn on the notice," Roane said. But he argues that simply securing data, and notifying employees data is being collected, "falls far short" of the protections privacy groups want, particularly now.

Privacy and labor groups have pushed for policies that would prevent an employer from retaliating against workers who refuse to give consent to different forms of tracking. They've also advocated for concepts like data minimization to be amended into CCPA. That would require companies to limit the data they collect up front to only what's necessary to carry out consumer requests and court orders or to ensure security.

In February, a coalition of privacy groups threw support behind a bill that would have required data minimization for both consumer and employee data. But the California Assembly declined to hear the bill this year. "Allegedly, it wasn't related enough to COVID-19," said Samantha Corbin, a lobbyist for the privacy coalition.

In a statement to Protocol, California Assemblyman Ed Chau, who leads the Committee on Privacy and Consumer Protection, said he is "closely monitoring government and employer practices" with regard to COVID-19 and stands "ready to work" on crisis-related legislation. "While the current pandemic has resulted in complications to the legislative process," Chau said, "there is still some time to work on the employee data exemption from last year where stakeholders are willing to do so."

Yet many of those stakeholders, including labor unions and employment lawyers like Kramer, have had to shift their own focus to basic worker protections like unemployment insurance and paid leave. With millions of Californians out of work and millions more working at considerable risk to their health, Kramer said she and her colleagues have been in "triage" mode. "There's been a big shift in our priorities and what we can tackle," Kramer said.

Complicating matters further is a ballot initiative called the California Privacy Rights Act, or CPRA, that may be headed to a vote this November. The measure is sponsored by Alastair Mactaggart, the real estate mogul who authored a similar ballot measure in 2018 that became the basis of CCPA. This new initiative would rewrite CCPA and extend the employee data exemption for three years.

Even before the pandemic hit the United States, the possibility that the measure might pass in November had thrown a wrench into negotiations over CCPA. Mactaggart didn't respond to Protocol's request for comment. "I think there's a lot of businesses quietly sitting on their hands and hoping [voters] sign off on that initiative that will give them another three years," Corbin said.

The labor and privacy advocates who spoke to Protocol said that if CPRA somehow doesn't make it to the ballot (Mactaggart pulled his 2018 ballot initiative at the last minute), they expect the legislature to pass another extension under the wire. Otherwise, come January 2021, employees would have the same data rights as consumers do in California, a shift that voices on both sides of the issue agree could have disastrous consequences.

The advocates are not arguing that workplaces should be barred from putting in place measures to protect worker safety. Quite the opposite: They welcome safety measures, as long as there are limits in place to prevent, say, the use of location tracking technology to monitor union organizing.

Even in the state with the country's most expansive privacy law, none of those limits exists. Not only that, but the window for discussing those safeguards has, at least temporarily, closed.

For now, Kramer said, workers in California can at least take solace in the fact that the state's constitution guarantees them the right to privacy. How that right applies to the workplace during a public health emergency, though, remains unclear.

"The question," Kramer said, "is how creepy is the employer being?"

Protocol | Workplace

Performance reviews suck. Here's how to fix them.

Slack integrations and keywords and AI, oh my!

Time will tell how smart HR technology has the potential to be, or how smart users want it to be.

Image: Christopher T. Fong/Protocol

Arguably nothing elicits more of a collective groan at work than performance review season. Managers hate giving them. Employees theoretically want them, but dread receiving them. It's as clear how much time and effort they take as it is unclear how useful formal performance reviews actually are in measuring and evaluating performance.

It's an arena ripe for disruption.

Keep Reading Show less
Michelle Ma
Michelle Ma (@himichellema) is a reporter at Protocol, where she writes about management, leadership and workplace issues in tech. Previously, she was a news editor of live journalism and special coverage for The Wall Street Journal. Prior to that, she worked as a staff writer at Wirecutter. She can be reached at mma@protocol.com.


Keep Reading Show less
Nasdaq
A technology company reimagining global capital markets and economies.
Protocol | Workplace

This startup will fire unvaxxed workers. Big Tech won’t say the same.

In an industry built for remote work, will companies fire workers who refuse to get vaccinated?

Several big tech companies stopped short of saying whether they would fire workers for not getting vaccinated.

Illustration: simplehappyart via Getty Images

As employers wait for the Department of Labor to issue a new rule requiring employee vaccine mandates, a big question looms: Will companies fire workers who don't comply?

Many of the tech giants won't say. A couple of companies have confirmed that they won't: Both Hewlett Packard Enterprise and Pure Storage said vaccination is not a condition of employment, though it's required to come to the office.

Keep Reading Show less
Allison Levitsky
Allison Levitsky is a reporter at Protocol covering workplace issues in tech. She previously covered big tech companies and the tech workforce for the Silicon Valley Business Journal. Allison grew up in the Bay Area and graduated from UC Berkeley.

With Andrew Bosworth, Facebook just appointed a metaverse CTO

The AR/VR executive isn't just putting a focus on Facebook's hardware efforts, but on a future without the big blue app.

Andrew Bosworth has led Facebook's hardware efforts. As the company's CTO, he's expected to put a major focus on the metaverse.

Photo: Christian Charisius/Getty Images

Facebook is getting ready for the metaverse: The company's decision to replace outgoing CTO Mike "Schrep" Schroepfer with hardware SVP Andrew "Boz" Bosworth is not only a signal that the company is committed to AR and VR for years to come; it also shows that Facebook execs see the metaverse as a foundational technology, with the potential to eventually replace current cash cows like the company's core "big blue" Facebook app.

Bosworth has been with Facebook since 2006 and is among Mark Zuckerberg's closest allies, but he's arguably gotten the most attention for leading the company's AR/VR and consumer hardware efforts.

Keep Reading Show less
Janko Roettgers

Janko Roettgers (@jank0) is a senior reporter at Protocol, reporting on the shifting power dynamics between tech, media, and entertainment, including the impact of new technologies. Previously, Janko was Variety's first-ever technology writer in San Francisco, where he covered big tech and emerging technologies. He has reported for Gigaom, Frankfurter Rundschau, Berliner Zeitung, and ORF, among others. He has written three books on consumer cord-cutting and online music and co-edited an anthology on internet subcultures. He lives with his family in Oakland.

Protocol | Fintech

Here’s everything going wrong at Binance

Binance trades far more crypto than rivals like Coinbase and FTX. Its regulatory challenges and legal issues in the U.S., EU and China loom just as large.

Binance CEO Changpeng Zhao is overseeing a global crypto empire with global problems.

Photo: Akio Kon/Bloomberg via Getty Images

Binance, the largest global crypto exchange, has been hit by a raft of regulatory challenges worldwide that only seem to increase.

It's the biggest example of what worries regulators in crypto: unfettered investor access to a range of digital tokens finance officials have never heard of, without the traditional investor protections of regulated markets.

Keep Reading Show less
Tomio Geron

Tomio Geron ( @tomiogeron) is a San Francisco-based reporter covering fintech. He was previously a reporter and editor at The Wall Street Journal, covering venture capital and startups. Before that, he worked as a staff writer at Forbes, covering social media and venture capital, and also edited the Midas List of top tech investors. He has also worked at newspapers covering crime, courts, health and other topics. He can be reached at tgeron@protocol.com or tgeron@protonmail.com.

Latest Stories