Insights
Publications

Reopening Businesses Must Consider Employee and Consumer Privacy

June 3, 2020 Articles
Wine Business Monthly

While we’re far from returning to the “normal” that predated the COVID-19 pandemic, states have begun to relax lockdown requirements and some previously “nonessential” businesses are returning to operations. Along with these openings, governmental entities, trade organizations, and others are wisely recommending protocols to reduce the risk of a spike in COVID-19 cases. Such protocols include customer and employee wellness screenings, contact tracing, and questionnaires about compliance with public health orders.

Although these protocols are designed to ensure the health and well-being of employees, customers, and others physically visiting the businesses, businesses collecting data from employees and customers must consider the privacy implications of doing so. This includes compliance with myriad state and federal laws and regulations.

Employee Privacy Considerations

As a result of the COVID-19 pandemic, employers are permitted to make various medical inquiries that were previously impermissible. To assess whether an employee can safely enter the workplace, employers may take the employee’s temperature, ask if they are experiencing COVID-19 symptoms, require the employee to undergo a COVID-19 test, or require the employee to provide medical certification of fitness to return to work. However, consistent with the Health Information Portability and Accountability Act (HIPAA) and the Americans with Disabilities Act (ADA), employers must maintain this information as a confidential medical record separate from the employee’s personnel file, with precautions taken to protect the information.

Although guidance from the U.S. Equal Employment Opportunity Commission (EEOC) expressly permits employers to require COVID-19 testing, the EEOC cautions that the tests must be “accurate and reliable” and such testing must be “job related and consistent with business necessity.” Employers should avoid requiring antibody testing, which could be deemed an unlawful medical history inquiry rather than an assessment of an employee’s present fitness to enter the workplace.

Some employers have begun mandating employees’ use of contact tracing applications. Other employers are administering employee surveys to gauge compliance with public health orders and to assess the risk that an employee has been exposed to COVID-19. Employers must also maintain any information collected through such applications or surveys as a confidential medical record in accordance with the guidelines above. Moreover, employers should narrowly tailor such inquiries for the purpose of assessing risk, and avoid infringing on third parties’ privacy rights (by, for example, asking about family members’ medical conditions or activities).

Finally, employers that are covered by California’s Consumer Privacy Act (CCPA) should review and, if necessary, update their employee privacy policies to ensure that all COVID-19-related inquiries and data uses are disclosed in compliance with the CCPA.

Consumer Privacy Considerations

A common feature of reopening guidelines and plans is wellness screenings of customers. Indeed, various federal agencies (such as the Centers for Disease Control) and state, county, and city governments have issued guidance encouraging consumer wellness screens, including pre-entry symptom questionnaires and on-site and/or home temperature checks.

In connection with contact tracing, businesses are likely to collect email addresses or phone numbers. To the extent a company collects such information and ties it to an individual’s identity, this personal information would be protected under various privacy laws and thus would require companies to take specific actions to properly handle and protect such information. While the health and safety of employees and the public at large is of course of preeminent importance, the privacy requirements relating to the collection and use of personal data should not be taken lightly.

There is no shortage of laws that could be implicated by the collection of customer wellness or contact tracing data. Aspects of the federal Health Insurance Portability and Accountability Act (HIPAA), California’s Consumer Privacy Act, Illinois’ Biometric Privacy Act and various other health and privacy-related laws address the collection and use of such data. Additionally, competing bills in the United States Senate—namely the Republican-introduced COVID-19 Consumer Data Protection Act and the Democrats’ Public Health Emergency Privacy Act—directly address the protection and use of data collected during and in efforts to address the current pandemic. To be sure, both federal and state law will play a key role in how such data is collected, used, and protected.

Guidance for Businesses

No matter the jurisdiction, businesses must exercise caution in collecting and using employee or customer data in their efforts to prevent or limit further spreading of COVID-19 when reopening for business. The legal landscape, forward-facing and internal policies, and contractual relationships all require thoughtful examination sooner rather than later.

First, it will be necessary to determine exactly which laws apply to your business. As noted above, there are various federal and state laws that could apply depending on the nature of information collected and the jurisdiction. Under most of these laws, notice will likely be required before collecting any personal information from an individual. As such, businesses must work now to prepare appropriate disclosure documents detailing the information to be collected, how that information will be used, and with whom it will be shared. While actual consent is not usually required to collect personal data under current privacy laws in the United States, getting such consent for data collection and use should be considered.

Businesses must also create and implement internal policies and controls that limit the sharing of data arising from wellness screenings. To the extent such data includes COVID-19 status (i.e., recording whether an individual has tested positive for the disease), anonymizing and aggregating data will provide the best privacy protection and better insulate the company against potential privacy law violations.

To the extent personal data from such screenings is shared with third parties such as vendors, businesses must ensure that recipients have appropriate confidentiality and privacy controls in place to safeguard downstream protection.

Balancing Act

Data privacy considerations will necessarily have to be balanced against ensuring the safety of employees, customers, and other business visitors in connection with the reopening of businesses as lockdown restrictions are lifted. With advanced planning, companies can give appropriate weight to the competing sides of the scale.

Firm Highlights

Publication

Senate Democrats Release Competing COVID-19 Privacy Bill

Democratic Senators Richard Blumenthal and Mark Warner have introduced the  Public Health Emergency Privacy Act  in response to  the bill of the same subject released by Senate Republicans  (the  COVID-19 Consumer Data Protection Act...

Read More
Publication

Federal “COVID-19 Consumer Data Protection Act” Proposed

A group of Republican senators has proposed a new privacy law to govern the collection and use of certain personal information thought to be both important and at risk during the current coronavirus crisis...

Read More
Publication

Signatures Submitted for Inclusion of New California Privacy Law on November Ballot

Californians for Consumer Privacy has announced that it has secured and submitted enough signatures to qualify its California Privacy Rights Act (“CPRA”) for inclusion on California’s November 2020 ballot. Alistair Mactaggart, the architect behind...

Read More
Publication

Reopening Plans and Recommended Protocols Beg New Privacy Issues

While far from getting us back to any kind of normal that predated the COVID-19 pandemic, states have begun to relax lockdown requirements and some previously closed “nonessential” businesses are returning to operations. With...

Read More
Publication

A Roadmap to Litigating Privacy Claims? A Look at a Recent Order From the Google Assistant Privacy Litigation

As privacy-related litigation continues to heat up, Judge Beth Freeman (ND Cal.) recently laid out in In re Google Assistant Privacy Litigation (Case No. 19-cv-04286) [1] a potential roadmap for surviving or winning a...

Read More
Publication

Private Rights of Action and the CCPA—Unlimited Limitation?

As we are all well aware by now, the California Consumer Privacy Act (CCPA) (Cal. Civ. Code Sections 1798.100 et seq.) went into effect on Jan. 1. Through its amendments and regulations (the latter...

Read More
Publication

Trademark Office Deadlines and Coronavirus-Related Delays (Updated)

With all of the business interruption caused by the COVID-19 pandemic, many worldwide trademark offices have taken steps to recognize the issues caused by the crisis. The offices in which applicants from the U.S...

Read More
News

In Novel Case, Insurer Sues Own Law Firm After Data Breach

Tyler Gerking was quoted in the Law360 article "In Novel Case, Insurer Sues Own Law Firm After Data Breach." In the article Tyler said, "This case shows some of the hazards that all companies face...

Read More
Publication

Twists in the Plot: California AG Releases Final CCPA Regulations

With a little time to consider the  finalized California Consumer Privacy Act regulations  released by the California Attorney General on August 14, 2020, it is clear that some last-minute negotiations (or perhaps just some...

Read More
Publication

Zoom Successfully Addresses New York’s Privacy and Security Concerns

A few weeks ago on this blog, we addressed some of the legal issues that have arisen for Zoom , as it becomes a significant part of American daily life during the COVID-19 pandemic. ...

Read More