Workplace Privacy & Employee Monitoring Flashcards

Under the Electronic Communications Privacy Act (ECPA), which exception most commonly allows employers to monitor employee email on company systems?

Answer: The business extension exception

The business extension exception under ECPA permits employers to monitor communications over equipment provided in the ordinary course of business.

An employer wants to conduct pre-employment background checks. Under the Fair Credit Reporting Act (FCRA), what must the employer provide to the applicant before taking adverse action based on the report?

Answer: A pre-adverse action notice and a copy of the report

FCRA requires employers to provide a pre-adverse action notice, a copy of the consumer report, and a summary of consumer rights before taking adverse action.

Which of the following best describes the general legal standard for employee privacy expectations in the workplace?

Answer: Employees have a diminished expectation of privacy compared to the general public

Courts generally recognize that employees have a reduced expectation of privacy in the workplace, particularly when using employer-owned equipment and systems.

A company implements keystroke logging software on all employee computers. What is the most important step the company should take to limit privacy risk?

Answer: Provide clear notice to employees through an acceptable use policy

Providing clear notice through an acceptable use or monitoring policy reduces privacy risk and supports the business extension exception under ECPA.

Under the ADA (Americans with Disabilities Act), when may an employer require a medical examination of a current employee?

Answer: Only when it is job-related and consistent with business necessity

The ADA allows medical examinations of current employees only if they are job-related and consistent with business necessity, protecting employee medical privacy.

Which federal law primarily governs the privacy of employee polygraph testing in the private sector?

Answer: The Employee Polygraph Protection Act (EPPA)

The Employee Polygraph Protection Act (EPPA) generally prohibits most private employers from using polygraph tests for pre-employment screening or during employment.

An employer in California wants to monitor employee social media accounts. Which California law most directly addresses this practice?

Answer: California Labor Code Section 980, which prohibits employers from demanding access to personal social media accounts

California Labor Code Section 980 prohibits employers from requiring employees or applicants to disclose their personal social media usernames or passwords.

What does the concept of 'reasonable expectation of privacy' from Katz v. United States mean in the context of public-sector workplace monitoring?

Answer: Government employees may have Fourth Amendment protections against unreasonable searches of their workplace spaces

The Katz standard establishes that government employees can have Fourth Amendment protections against unreasonable workplace searches, subject to balancing tests.

Under the FCRA, how long before taking adverse employment action must an employer wait after providing the pre-adverse action notice?

Answer: A reasonable period of time (generally interpreted as at least 5 business days)

FCRA requires a 'reasonable period of time' between the pre-adverse action notice and final adverse action, which the FTC has interpreted as approximately five business days.

Which of the following is an accurate statement about drug testing in the workplace under federal law?

Answer: There is no comprehensive federal law mandating private-sector drug testing, though certain industries are federally regulated

No single federal law mandates drug testing for all private-sector employees; however, sector-specific regulations (e.g., DOT for transportation workers) require testing in certain industries.

An employer collects biometric data (fingerprints) for employee time-and-attendance tracking. Which state law is most commonly associated with strict regulation of biometric data collection in employment?

Answer: Illinois Biometric Information Privacy Act (BIPA)

The Illinois BIPA is the most prominent and strictly enforced biometric privacy law in the U.S., requiring informed consent, written policies, and limiting data retention and disclosure.

The National Labor Relations Act (NLRA) intersects with workplace privacy because it:

Answer: Protects employees' rights to engage in concerted activities, which can limit how employers monitor and discipline workers for discussing wages or working conditions

The NLRA protects concerted activity, meaning employer monitoring policies that chill employees' rights to discuss wages or working conditions may constitute unfair labor practices.

A terminated employee requests access to their personnel file. Under which legal framework are they most likely to have this right?

Answer: State law, as there is no federal law granting private-sector employees access to their personnel files

The right of private-sector employees to access their personnel files is governed by state law; states like California, Michigan, and Illinois have specific personnel file access statutes.

When an employer uses a third-party vendor to conduct social media screening of job applicants, the employer must be aware that this practice may trigger obligations under:

Answer: The FCRA, if the vendor is considered a consumer reporting agency compiling consumer reports

If a third-party vendor compiles social media information into a report used for employment decisions, it may constitute a consumer report under FCRA, triggering disclosure and adverse action requirements.

Under HIPAA, how must an employer handle employee health information obtained through a self-insured health plan?

Answer: It must be kept separate from other personnel records and accessed only by those who need it to administer the plan

HIPAA requires employers who sponsor self-insured health plans to maintain health information separately and limit access to plan administration personnel only.

An employee notifies their manager of a disability and requests a reasonable accommodation. Under the ADA, the employer's privacy obligation regarding this disclosure is to:

Answer: Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis

The ADA requires that medical information obtained through the accommodation process be kept confidential and disclosed only to those with a legitimate need to know.

Which of the following is the best practice when an employer wants to implement video surveillance of the workplace?

Answer: Provide employees with advance notice of the surveillance through a written policy, avoiding placement in areas where employees have a heightened expectation of privacy such as restrooms

Best practice requires advance notice to employees and avoidance of locations (restrooms, changing rooms) where employees retain a reasonable expectation of privacy, balancing business interests with employee rights.

What is the primary purpose of an employee privacy notice under the California Consumer Privacy Act (CCPA) as amended by the CPRA?

Answer: To inform employees about the categories of personal information collected about them and the purposes for which it is used

The CPRA requires employers to provide a privacy notice at or before collection informing California employees about the categories of personal information collected and the purposes of use.

An employer conducts an internal investigation of an employee suspected of misconduct. From a workplace privacy perspective, which approach best balances employer and employee interests?

Answer: Limiting the investigation to relevant evidence, informing only those with a need to know, and documenting the process to demonstrate proportionality

A proportionate, confidential investigation that collects only relevant evidence and limits disclosure to those with a need to know minimizes privacy risk while serving legitimate business interests.

Under the Stored Communications Act (SCA), which of the following employer actions would most likely be permissible?

Answer: Accessing emails stored on the company's own email server without employee consent

The SCA generally permits system operators (including employers) to access communications stored on their own systems, as they are considered an authorized party.