The Landscape of Employee Privacy
Employee privacy in the workplace is a complex area where employer interests in productivity, safety, and security intersect with employees' reasonable expectations of privacy. Unlike many other countries, the United States lacks a single, comprehensive federal workplace privacy law. Instead, privacy protections come from a combination of federal statutes, state laws, common law, and constitutional provisions (for public-sector employees).
For HR professionals studying for the SHRM-CP or SHRM-SCP exam, employee privacy is tested across several competency areas, including employee relations, technology management, and compliance. Understanding the legal boundaries of workplace monitoring, searches, and personal information management is essential.
The fundamental principle is that employees generally have reduced expectations of privacy in the workplace compared to their personal lives, particularly when using employer-owned equipment or operating on employer premises. However, some privacy protections exist regardless of the setting.
Electronic Monitoring and the ECPA
The Electronic Communications Privacy Act (ECPA) of 1986 is the primary federal statute governing electronic monitoring in the workplace. The ECPA includes the Wiretap Act and the Stored Communications Act. Key provisions include:
- Business purpose exception: Employers can monitor electronic communications on company-owned equipment if there is a legitimate business reason. This covers monitoring company email, internet usage, and phone calls made on company systems.
- Consent exception: Employers can monitor electronic communications if the employee has given consent. Most employers obtain this consent through written policies and acknowledgment forms.
- Personal communications: Once an employer determines that a communication is personal, monitoring must cease under the Wiretap Act. However, the Stored Communications Act may permit access to stored personal messages on company systems.
Many states have additional restrictions on electronic monitoring. Some require all-party consent for recording phone calls, and several states require notice to employees before monitoring electronic communications.
On the SHRM exam, questions about electronic monitoring typically test whether the employer has met the legal requirements for monitoring, such as having a policy, obtaining consent, and having a business justification.
Workplace Searches and Drug Testing
Employers may conduct workplace searches, but the legality depends on the circumstances:
- Employer property: Employers generally have broad authority to search company-owned property such as desks, lockers, computers, and vehicles. Establishing a clear policy that reserves this right reduces privacy expectations.
- Personal property: Searching employee personal property (purses, backpacks, vehicles in company parking lots) raises greater privacy concerns. Policies that notify employees of potential searches and obtain advance consent help reduce legal risk.
- Person searches: Physical searches of employees' persons are the most invasive and should be conducted only with consent, by appropriate personnel, and in a private setting.
Drug testing is another area where privacy rights and employer interests intersect. The legality of drug testing depends on federal requirements (for safety-sensitive positions), state law, and the specific circumstances of the test.
Managing Personal Information
HR departments are custodians of vast amounts of employee personal information. Best practices for protecting this information include:
- Collect only what is necessary: Limit the collection of personal information to what is needed for legitimate business purposes.
- Secure storage: Use physical and electronic security measures to protect personnel files, medical records, and other sensitive data.
- Access controls: Restrict access to personal information to those with a legitimate need to know.
- Data retention policies: Establish clear retention schedules and securely dispose of information when it is no longer needed.
- Breach notification: Be aware of state data breach notification laws that may require informing employees if their personal information is compromised.
State privacy laws are expanding rapidly. Several states have enacted comprehensive consumer privacy laws that may affect how employers handle certain employee data, particularly for California-based employees under the California Consumer Privacy Act (CCPA) and its amendments.
Start Practicing Today
Employee privacy questions on the SHRM exam test your understanding of monitoring limits, search policies, and information management. The exam consists of 134 questions over 4 hours at Prometric or OnVUE.
SHRMpractice.com offers practice questions on employee privacy and workplace technology topics. Start with our diagnostic to gauge your readiness, and sign up for full access to our SHRM exam preparation resources.