The National Labor Relations Board (NLRB) recently took the unprecedented position that an employer violated federal law by failing to engage its employees’ union in collective bargaining regarding its response to a data breach. The U.S. Postal Service (USPS) was the target of a 2014 data breach affecting over 800,000 of its current and former employees. The NLRB filed complaints against the USPS claiming that it executed its response to the breach without engaging in collective bargaining with the union. That’s a violation of National Labor Relations Act (NLRA) provisions mandating collective bargaining for any issue that relates to the “wages, hours, and other terms and conditions of employment,” the NLRA alleged.
The NLRB complaints specifically allege that the USPS violated the NLRA by failing to collectively bargain with the union about the impact of the breach on union members. The USPS also allegedly violated the NLRA by unilaterally providing a remedy for the breach (one year of credit monitoring services and fraud insurance at no cost to employees) without giving prior notice to the union and providing it with an opportunity to negotiate the remedy. The NLRB complaints arose from charges filed by the American Postal Workers Union and the National Rural Letter Carriers’ Association regarding the manner in which the USPS handled the breach.
This marks the first time the NLRB has suggested that data breach response and notification measures affecting employees relate “to the wages, hours, and other terms and conditions of employment” under the NLRA. If the NLRB’s position is found to have merit, that potentially makes the breach response process more complicated and costly for unionized organizations. Union negotiations would need to be conducted at the same time the organization is dealing with fallout from the data breach, such as repairing damage to internal systems, investigating the breach, and complying with breach notification laws. Union negotiations could put tremendous pressure on organizations trying to comply with data breach laws that require notification within a short time period after discovery of the breach. There is also a heightened risk of leaks to the press if organizations must notify unions before giving formal notification as required by law.
The NLRB’s complaints against the USPS reinforce the urgency of developing well-crafted breach response plans. Union organizations might wish to add items to their response plans that engage employee unions in the response process. Another precautionary measure is to solicit the input of the union in developing acceptable breach response protocols before a breach occurs rather than in the midst of a crisis situation.
The New York Times recently reported that Hillary Rodham Clinton used a personal email address for work and personal matters while she served as Secretary of State. Many employees could probably appreciate why Ms. Clinton chose to use a private email address for work purposes. She enjoyed the convenience of carrying one mobile device instead of two. That’s the same reason the Bring Your Own Device movement has been rapidly gaining momentum.
The convenience of commingling professional and personal online accounts comes at a price. One danger is unauthorized disclosure of confidential information. Work-related information stored in an employee’s personal online account is not subject to security measures like firewalls, anti-virus software, and metadata scrubbing programs. Private online accounts may be vulnerable to cyberattacks, putting the confidentiality of their contents at risk. While such records might not concern national security matters as in the Clinton controversy, they could contain personnel information, medical history, or trade secrets, the disclosure of which could violate data privacy laws like HIPAA and the Sarbanes-Oxley Act, not to mention hurting a company’s competitive edge or creating a public relations debacle.
Another risk is noncompliance with recordkeeping policies. Work rules dictating how long work files are kept before they’re disposed help organizations manage the task of responding to information inquiries like discovery requests in litigation. In some jurisdictions, an organization’s failure to produce a document in discovery because it was destroyed in compliance with the organization’s document retention policy generally is not considered unlawful destruction of evidence. (Note: Hawaii’s court rules were amended this year to recognize such a defense). But spotty enforcement of a document retention policy could destroy that defense. Popular ways of transferring work files include forwarding them to a personal email address or uploading them to a personal cloud storage account. Such practices could result in work files being kept beyond their authorized retention period, thus casting doubt on whether an organization actually follows its document retention policy.
Managing these risks begins with adopting a formal policy on use of personal accounts for work purposes and training employees to follow the policy. Without a policy in place, employees might have few qualms about using their personal accounts for work. Consult with a lawyer with data privacy experience to ensure that your policy manages legal risks.
If your company decides to prohibit the transfer of work data to external locations, enforce that policy diligently. Work with your IT department or outside vendors to implement physical and software safeguards against unauthorized transfers. Conduct audits to ensure compliance with the policy.
Another strategy is to offer solutions that allow employees to work outside of the office conveniently without having to use their personal accounts. Consider hosting a private cloud storage site where employees can share files in a secured environment under your control. Also popular is virtual desktop software that allows employees to access their workstation remotely in a controlled environment.
Don’t wait until your employees’ data handling practices make the headlines before taking action to protect the confidentiality of your work files.
In 2007, the National Labor Relations Board (NLRB) issued its Register Guard decision allowing employers to prohibit employees from using company email to engage in discussions about the terms and conditions of their work with other employees or unions for purposes of “mutual aid and protection,” which are protected under Section 7 of the National Labor Relations Act. In April 2014, the NLRB issued a notice and invitation to the parties in a case involving Purple Communications, Inc. and interested amici curiae to file briefs on whether Register Guard should be overruled. The NLRB received numerous amici briefs on the issue. Employers were relieved when the NLRB deferred a decision on overruling Register Guard in September of last year.
The relief was short-lived. Just three months later, the NLRB reversed course and overruled Register Guard, noting that email “has become a critical means of communication” and is “a natural gathering place” for employees to communicate with each other. In a 3-2 decision involving Purple Communications, Inc., the NLRB ruled that employees who have access to their employer’s email system for work purposes presumptively have a right to use the system for protected communications on nonwork time.
Here are answers to some basic questions about how Purple Communications impacts company email policies:
Must employers give all their employees access to the company email system?
No. Employees have a right to use corporate email for protected communications only if they already are given access to the system for work or personal reasons. Purple Communications does not force employers to grant email access to anyone. For that matter, employers are not required to grant email access to non-employees, including unions and union organizers.
May employers put restrictions on use of company email for protected discussions during nonwork hours?
Maybe. Employers may restrict use of company email to engage in protected discussions during nonwork time by demonstrating that there are actual (as opposed to theoretical) “special circumstances” that “make the ban necessary to maintain production or discipline.” This appears to be a difficult standard to meet. Employers must establish a connection between the restriction and their interest in imposing the restriction.
Is it ok to ban all nonbusiness use of company email?
A total ban would be subject to the “special circumstances” test discussed above. According to the NLRB, the existence of special circumstances “will be a rare case.”
May employers impose guidelines on using nonbusiness of company email?
Yes. Employers may establish specific guidelines for nonbusiness use of corporate email. Use of corporate e-mail for protected communications may be restricted to nonworking time. Employers also have the right to establish “uniform and consistently enforced controls over its email system to the extent such controls are necessary to maintain production and discipline.” The single example provided by the NLRB is “prohibiting large attachments or audio/video segments, if the employer can demonstrate that they would interfere with the email system’s efficient functioning.”
May employers monitor their employees’ email use?
Yes. Employers may monitor computer and email systems for legitimate management reasons, such as ensuring productivity and preventing email use for harassment or other activities that could give rise to employer liability. However, employers may not change their monitoring practices specifically in response to union or other protected activity. On that note, any modifications to an email policy that targets protected activity for discrimination is likely unlawful.
Do employers need to change their email policies now?
Purple Communications applies retroactively, so unless the decision is appealed and stayed in the interim, employers should seriously consider modifying their company email policy to comply with the decision.
Does Purple Communications apply to other company electronic communications systems like texting or instant messaging?
Currently no, but the NLRB has signaled that it might extend the reasoning in the Purple Communications decision to other forms of electronic communication in the future.
Purple Haze: NLRB Still Unclear on Whether It Will Stop Employers From Limiting Use of Company Email to Business Purposes
Target. Home Depot. Neiman Marcus. This isn’t a list of places to shop. These companies were hit with some of the biggest data breach incidents of 2014. And, as the recent hack on Sony Pictures Entertainment demonstrates, it’s not just the customer information that gets compromised in cyberattacks—employees can also be the victims.
In November, hackers broke into Sony’s computer systems and stole personal information of over 47,000 current and former employees, celebrities, and freelancers. The information included personal emails, budgets, salary information, human resource records, and other private (and embarrassing) documents. Some of the stolen information was leaked online, including a spreadsheet containing names, birth dates, and Social Security numbers of over 3,000 employees. Buzzfeed reports that the 40 gb data dump contains email exchanges between Sony and its employees regarding very sensitive matters, such as their medical treatments, disciplinary action, and inter-office romance.
The ease with which the hackers did their dirty work is eye-opening. The attack was carried out with widely available malware. It didn’t help that Sony’s security measures were shockingly subpar. Sony had failed to encrypt the leaked files. One of the stolen files containing login credentials to Sony computers and servers and other online accounts was quite obviously named “Passwords.”
Sony apparently made a conscious decision not to beef up its security. In 2007, Sony’s then-executive director information security, Jason Spaltro, said in an interview that it was a “valid business decision to accept the risk” of a security breach, and that he would not invest $10 million to avoid a possible $1 million in loss. A team of just 11 employees was responsible for maintaining the security systems for Sony’s 7,000 employees. A September 2014 security audit report showed gaps in Sony’s security procedures, such as failure to monitor one firewall and more than 100 other devices.
In the aftermath of the attack, Sony is facing four lawsuits. Three of the lawsuits allege that Sony failed to take adequate precautions to guard against known weaknesses in the security of its computer systems. Another lawsuit accuses Sony of waiting too long to notify employees that their personal data had been stolen.
What should companies do to protect themselves against a data breach like Sony’s? Be sure to develop administrative, physical, and technical safeguards over personal information handled by your company. At minimum, use encryption technology. If a third party handles personal information of your employees or customers, contractually require them to exercise reasonable care and to report security breaches immediately. Another precautionary measure is to conduct periodic security audits and risk analyses of information systems.
If a data breach involves a business located in Hawaii or one that does business in Hawai‘i and maintains or possesses personal information of Hawaii residents, Hawaii law requires the business to notify persons affected by the breach. If notice is provided to 1,000 persons or more at once, the State Office of Consumer Protection and credit reporting agencies must also be notified. Companies should prepare data breach procedures in advance so that a clearly charted process for complying with applicable notification laws is available in the chaos ensuing after a data breach incident.
Federal law clearly gives employees the right to communicate with each other and with unions about work-related matters for purposes of “mutual aid and protection.” Commiseration among co-workers about working conditions, work policies, wages, and the like are concerted, protected activity under the National Labor Relations Act (NLRA). But must an employer allow employees to use its computer equipment for such communications? Employers breathed a sigh of relief when the National Labor Relations Board (NLRB) answered “no” in its Register Guard decision issued in 2007. Under Register Guard, employees generally don’t have a right to use their employer’s electronic equipment and systems to engage in protected activity, and employers may adopt a policy prohibiting employees from using company email for non-work purposes, including communications concerning protected activity.
Seven years later, the Register Guard rule is cast into doubt. In Purple Communications, Inc., an employee handbook declared that all company computers, Internet access, voice mail, and the e-mail system were the exclusive property of the company and were to be used only for business purposes. The employer prohibited employees from using such company property to engage in activities on behalf of organizations or persons with no business affiliation with the company. Appling Register Guard, the Administrative Law Judge in the case dismissed a union’s claim that Purple Communications’ employee handbook violated the NLRA. The NLRB’s General Counsel appealed the decision, asking the NLRB to overrule Register Guard.
The NLRB invited interested groups to file briefs addressing whether the Register Guard rule should be overturned. Over twenty organizations representing a broad range of union and management interests accepted the invitation and filed amicus briefs with the NLRB. However, the NLRB ultimately chose to defer deciding the issue. See Purple Communications, Inc., 361 NLRB 43 (Sept. 24, 2014).
The NLRB decided the appeal without reaching the controversial issue of whether to overturn Register Guard because it found that the employer had committed other unfair labor practices. A footnote in the decision noted that the NLRB would “sever and hold for further consideration the question whether Purple’s electronic communications policy was unlawful.” This signals that the NLRB is still open to overruling Register Guard, perhaps when a case involving what it considers a more appropriate factual scenario comes along.
For now at least, employers may lawfully adopt work rules restricting use of its email and other electronic equipment and systems to business purposes, and employees may be disciplined for violating such rules. How much longer such rules will stand remains to be seen.