Many thanks to our data privacy colleagues for co-authoring this post: Lothar Determann, Helena Engfeldt and Jonathan Tam.

2022 is looking to be an unprecedented year for California companies’ privacy law obligations. The California Privacy Rights Act (CPRA) takes effect on January 1, 2023, with a twelve-month look-back that also applies to the personal data of employees and business contacts. The new California Privacy Protection Agency is preparing regulations that will sit on top of existing rules from the California Attorney General. Meanwhile, the California Legislature is enacting privacy laws even though it has not repealed or streamlined any of the myriad California privacy laws that continue to apply in addition to the California Consumer Privacy Act (CCPA).

On March 1, we held a webinar focused on the employment law implications stemming from these significant changes and covering a handful of critical hot topics (e.g., how to process vaccination information, the treatment of employees of PEOs, and EORs). If you missed it, here are the major highlights you should know!

Employment Takeaways

Preparing for CCPA / CPRA Compliance
  • CPRA amendments to CCPA take effect January 1, 2023; this ends the transitional exemptions for “HR” and “B2B contact information” and includes a 12-month look-back to January 1, 2022.
  • “At collection notices” have been required since January 1, 2020, with increased disclosure requirements since December 16, 2020. For more detail, click here.
  • Businesses must declare on January 1, 2023, in privacy policies whether they have been selling or sharing personal information of employees and B2B contacts in the preceding 12 months and, if yes, offer opt-out mechanisms and alternatives without discrimination.
  • Businesses must update service provider agreements, including with recruiters and IT, cloud, payroll, benefits, and other providers.
  • Businesses must offer broad access, deletion, rectification, portability and other rights to California employees and B2B contacts, and prepare for what may be the end of confidentiality in the employment area; employers should conduct training, and implement robust data governance policies (incl. deletion and discovery).
Data Access / Deletion Requests from Employees
  • Under existing employment law, California employees (not contractors) have the right to inspect and receive a copy of the personnel files and records that relate to their performance or any grievance concerning them within 30 days of their written request. The existing right to inspect does not extend to records relating to the investigation of a possible crime, letters of reference, or various ratings or reports.
  • By contrast, the new “right to know” under the CPRA/CCPA goes further. It encompasses two distinct rights: (i) the right to a disclosure explaining how the employer collects and handles the individual’s personal information; and (ii) the right to copies of “specific pieces of personal information.” The “right to know” applies to California consumers, which goes beyond employees (i.e., including contractors). In theory, it could extend the scope of the “right to know” from simply the personnel file to include, for example, informal communications about the employee, investigations, etc. Employers must generally comply with such requests within 45 days.
  • The “right to know,” however, is not absolute, and employers can refuse if the request is manifestly unfounded or excessive (e.g., if the purpose is to harass) and does not cover privileged information (e.g., communications with in-house and external counsel).
  • The CPRA/CCPA also introduce a new right to “data deletion.” This right is not absolute either. An exception should apply for most categories of personal information reasonably necessary to managing or administering current or past employment or contract work relationship.
  • Finally, the CPRA/CCPA gives California residents other rights including the right to limit the processing of sensitive information. There are exceptions to the right to limit the processing of sensitive information, but none of the statutory exceptions apply squarely to HR data.

Continue Reading A Quick Primer On New Privacy Law Obligations For California Employers

Wary of wage and hour class actions, many employers have been grappling with whether and how to compensate employees for activities related to COVID-19. After nearly two years of guessing, on January 20, 2022, the US Department of Labor (DOL) posted Fact Sheet #84, “Compensability of Time Spent Undergoing COVID-19 Health Screenings, Testing, and Vaccinations Under the Fair Labor Standards Act (FLSA),” on its website. The next day, and with no explanation, Fact Sheet #84 disappeared.

Before it disappeared, Fact Sheet #84 addressed the compensability of time spent undergoing those COVID-19 activities with reference to the Occupational Safety and Health Administration’s COVID-19 Vaccine and Testing Emergency Temporary Standard (the OSHA ETS). Given that the OSHA ETS had been stayed just a week earlier by the US Supreme Court and then was subsequently withdrawn by OSHA on January 26, Fact Sheet #84’s sudden disappearance is perhaps not surprising. Nevertheless, employers should keep their eyes peeled for an updated Fact Sheet #84 that addresses compensability of testing and vaccination time without references to the OSHA ETS, especially since the advice in the now withdrawn Fact Sheet #84 is in line with other prior DOL advice on compensable time for employer-required testing and medical procedures under the FLSA.

What Fact Sheet #84 Said Before It Was Withdrawn

The guidance in Fact Sheet #84 distinguished between testing and vaccination that occurs during regular work hours and after regular hours:

Activities that occur during normal working hours

  • Under the FLSA, employer-required activities during normal working hours are compensable, unless the activity falls within one of the exceptions stated in 29 C.F.R. Part 785 (e.g., bona fide meal breaks and off-duty time).
  • Employees must be paid for time they spend going to, waiting for, and receiving medical attention required by the employer or on the employer’s premises during normal working hours-including COVID-19 related medical attention. Therefore, if an employer requires an employee to engage in COVID-19 activities (such as receiving a COVID-19 vaccine dose, taking a COVID-19 test, or undergoing a COVID-19 health screening or temperature check) during the employee’s normal working hours, the time is compensable time-regardless of where the activity occurs.

Continue Reading Compensability of COVID-related Activities | The DOL May Have Weighed In to Help Employers Avoid Class Actions

Special thanks to Guest Contributor Harry Valetk.

In early May, private sector employers in New York will face new disclosure requirements for electronic monitoring of employees.  Beginning May 7, 2022, New York will join Connecticut and Delaware among the states that now require employers to provide written notice to new hires who are subject to electronic monitoring.  These new disclosure requirements come after Governor Kathy Hochul signed into law amendments to Civil Rights Chapter 6, Article 5, Section 52-C*2.

Here’s what New York employers need to know now about the new law:

Who is covered under the law? All private employers with a place of business in New York regardless of size. “Employer” is defined as any individual, corporation, partnership, firm, or association with a place of business in the state (not including the state or any political subdivision of the state).

What does the law require?  In practice, the law requires employers to (1) provide employees with a notice of electronic monitoring, (2) obtain proof of acknowledgement, and (3) prominently post the notice for all to see.Continue Reading New York’s New Electronic Monitoring Disclosure Law Requires Action Before May

Illinois employers have a plethora of new laws to keep up with for 2022. From new Chicago and Cook County patron vaccination orders, to new laws limiting restrictive covenants, to pay data reporting (and more!), new Illinois laws are certain to make for a busy 2022 for Illinois employers. Here are 10 changes employers should know now as we get the ball rolling in 2022.

  1. Chicago and Cook County Vaccination Orders Require Some Employers to Check Vaccination Status of Employees and Require Testing for Unvaccinated Employees

Employers at restaurants, bars, gyms, and other establishments in Chicago and Cook County have already started scrambling to implement patron vaccination requirements–and requirements that they obtain the vaccination status of their employees and require weekly testing for employees who aren’t fully vaccinated. As of January 3, 2022, Mayor Lightfoot’s Public Health Order 2021-2 and the Cook County Department of Public Health’s Public Health Order 2021-11  took effect. Under the Orders, covered businesses (including establishments where food and beverages are served, gyms and fitness venues, and entertainment and recreation venues in areas where food and beverages are served) must:

  • Turn away patrons age 5 and over entering the indoor portion of an establishment unless they show a CDC COVID-19 Vaccination Record Card or an official immunization record (or a photo of the same) from the jurisdiction, state, or country where the vaccine was administered, reflecting the person’s name, vaccine brand, the date(s) administered and full vaccination status (two weeks after the second dose of the Pfizer or Moderna vaccine, or two weeks after a single dose of the Johnson & Johnson vaccine). There are certain narrow exceptions, such as allowing individuals inside for 10 minutes or less to carry out food or use the bathroom
  • Post signage informing patrons of the vaccination requirement
  • Develop and maintain a written record of the protocol for implementing and enforcing the Orders’ requirements

While covered businesses that are employers do not have to require employees to be vaccinated, they must:

  • determine the vaccination status of each employee by requiring each vaccinated employee to provide acceptable proof of vaccination status (including whether the employee is fully or partially vaccinated), and maintain a record of each employee’s vaccination status; and
  • require COVID-19 testing for employees who are not fully vaccinated. Employees who are not fully vaccinated and who report at least once every 7 days to a workplace where there are others present must be tested for COVID-19 at least once every 7 days and must provide documentation of the most recent COVID-19 test result to their employer no later than the 7thday following the date on which the employee last provided a test result.

Employers with 100 or more employees must also comply with the Occupational Safety and Health Administration Emergency Temporary Standard (OSHA ETS), at least for now. The US Supreme Court heard oral argument on whether to block the ETS at a special January 7 session, but until the Supreme Court issues its ruling, the ETS stands, requiring employers with at least 100 employees to implement and enforce a policy that mandates employees to be fully vaccinated or to submit to weekly COVID-19 testing and mask-wearing. For more on the Chicago and Cook County Orders and the OSHA ETS, see our blog here.Continue Reading Illinois Employers: Ten Top Developments for 2022

California has always kept employers on their toes when it comes to changing employment laws. This year is no exception. Here is our roundup of the top 10 developments California employers need to know. (And scroll down to see what’s on the horizon!)

  1. Minimum Wage Increases

Effective January 1, 2022, the California state minimum wage increased to $15.00 per hour ($14.00 per hour for employers with 25 or fewer employees). As a result, the minimum monthly salary for California exempt employees increased to $5,200, or $62,400 on an annual basis (which is two times the state minimum wage for full-time employment).

For computer software employees, their minimum hourly rate of pay increased to $50.00 and the minimum monthly salary increased to $8,679.16 ($104,149.81 annually).  And for licensed physicians and surgeons, the minimum hourly rate of pay increased to $91.07 .

Some counties and cities have imposed their own higher minimum wage rates, including Los Angeles, where a $15 minimum wage for all employers took effect in July 2021. The following local minimum wages took effect on January 1, 2022, regardless of employer size:Continue Reading Top 10 California Employment Law Updates for 2022

Many thanks to Lothar Determann and Jonathan Tam for this post.

Some of your job applicants and employees in California may be alarmed if you tell them you sell their personal information. But you will have to say you sell their personal information if you disclose their personal information to third parties after January 1, 2022 without including certain data processing clauses in your contracts, as required by the California Consumer Privacy Act (CCPA). So we recommend reviewing these contracts to ensure they include the prescribed clauses if you wish to avoid being a “seller” of personal information.

You should also get ready to field data access, deletion, correction, portability and other requests from your employees and other personnel in California starting January 1, 2023. This will require implementing new protocols and training up your human resources and compliance teams. We also recommend tightening up your data retention and deletion protocols to limit the amount of information you have to review when handling data subject requests.

Do you use employee monitoring software or algorithms to help you evaluate job applicants? You should ensure that your use of these and similar tools address upcoming requirements regarding automated decision-making, risk assessments and the use of sensitive personal information. Note that the CCPA also currently requires employers to issue privacy notices to their California employees pursuant to a California Privacy Rights Act (CPRA) amendment that took effect on December 16, 2020.

There is an HR exception under the CCPA but it is not comprehensive and expires January 1, 2023. When the CCPA originally passed in 2018, it included a limited, temporary carve-out for personal information of job applicants, employees, independent contractors and other personnel, who only needed to receive a brief “notice at collection.” The CPRA extended the limited carve-out until January 1, 2023 and immediately expanded the list of disclosures that employers have to provide to employees and candidates at or before the time of collecting their personal information.[1] Such “notices at collection” must include details about the types of personal information collected, the purposes for which the information is collected, and how long the personal information is retained or the criteria for determining the same. The California Attorney General’s CCPA Regulations also require notices at collection to indicate whether the business sells California residents’ personal information and a notice of the their right to opt-out of sales if so, and a link to the business’s privacy policy.[2] You should begin to address these requirements immediately if you have not done so already.Continue Reading Employers Must Prepare Now For New California Employee Privacy Rights

This year New York employers have had to scramble to keep up with many new employment laws, and next year promises more of the same. The latest: New York City Mayor Bill de Blasio’s December 6 mandate that private sector employers require COVID-19 vaccines for their workers in NYC. If it survives expected legal challenges and takes effect December 27 (Happy Holidays!), the rule will be the broadest mandate of any state or large city in the US. From minimum wage increases, to regulations on the use of artificial intelligence tools in employee recruitment, to notice requirements for electronic employee monitoring, to New York’s fulsome response to COVID-19 through the HERO Act—private sector employers in New York have a laundry list of changes to implement and prepare for.

Below we highlight the 10 major employment law changes and updates that businesses need to know.

  1. New York City Vaccine Mandate To Hit All Private Employers December 27

By the end of the month, all in-person private sector New York City employees must have at least one dose of a COVID-19 vaccine, according to an announcement by Mayor de Blasio. The mandate, which will take the form of an order issued by the NYC Department of Health and Mental Hygiene, will apply to nearly 184,000 businesses and will not be limited to businesses in certain industries or based on company size. The mandate will most likely parallel the city worker mandate in that employers will, in certain instances, be permitted to make reasonable accommodations to mandatory vaccination policies for employees with legitimate religious or medical reasons, but will not permit any testing options in lieu of the vaccine. The mandate will not apply to fully remote employees or those who are alone at a worksite. The city has not yet announced whether employers will face inspections or fines if they fail to follow the mandate, but it intends to release implementation and enforcement guidelines by December 15, 2021.

The new mandate is the first of its kind on a local level while the federal vaccine rule for private employers with 100 or more employees remains on pause amid several legal challenges. The city mandate is also set to go into effect only days before the New York City mayoral transition, leaving future enforcement of the mandate uncertain.

 Employer Takeaways

  • Stay abreast of further city announcements concerning additional guidance on the vaccine mandate.
  • Operate under the assumption that the vaccine mandate will take effect December 27, 2021, and notify employees of the new mandate so unvaccinated employees have sufficient time to get vaccinated.
  • Implement procedures to verify applicable in-person employees vaccination status and prepare to collect vaccination records as confidential medical information.
  • Prepare to establish a mandatory vaccination policy and a process for employees to request exemptions, to the extent your business has not already done so.
  • Begin considering operational contingency plans if your business expects that a significant portion of the workforce will not get vaccinated.

Continue Reading Top 10 New York Employment Law Updates For 2021/2022

What’s scarier than Halloween? For Illinois employers, it could be that they now have only approximately two months to prepare for Illinois’ new limits on employee restrictive covenants. On August 13, 2021, Illinois Governor Pritzker signed Senate Bill (SB) 672 (now Public Act 102-0358) into law, imposing new conditions on employers’ use of noncompete agreements and nonsolicitation agreements in Illinois. The law goes into effect on January 1, 2022, with Illinois joining the tide of states (as well as the federal government–see our blog on President Biden’s recent Executive Order addressing restrictive covenants here) cracking down on employers’ use of restrictive covenants.

Here’s what Illinois employers need to know now.

Employers have a couple of months to prepare–and don’t need to look back at prior agreements

The Act is effective for any contract entered into after January 1, 2022, and does not apply retroactively. Therefore, employers will not be required to inventory and assess agreements signed prior to the Act’s effective date.

Noncompete agreements banned for employees making $75,000 per year or less

The Act does not ban noncompetes for all Illinois employees, but instead for those making $75,000 per year in earnings or less. This salary threshold will increase by $5,000 every five years until it reaches $90,000 in 2037.

“Earnings” includes what employers might expect: earned salary, earned bonuses, earned commissions, or any other form of compensation reported on an employee’s IRS Form W-2.Continue Reading Don’t Get Spooked By the New Restrictions on Restrictive Covenants in Illinois

Special thanks to Jeffrey Martino and Bradford Newman for their contributions to this post.

On July 9, 2021, President Biden issued his Executive Order on Promoting Competition in the American Economy (EO) (Fact Sheet here) signaling support for severe limitation of post-employment noncompete restrictions–a move likely to add fuel to the fire of states passing laws to limit the use of post-employment noncompetes. The EO Fact Sheet states that the banning or limiting of noncompetes will “[m]ake it easier” for employees to “change jobs[.]” Though employers may balk, given Biden’s campaign promises and support for passage of the Protecting the Right to Organize (PRO) Act (see our prior blog here), employers should not be surprised.

The EO encourages the Chair of the Federal Trade Commission (FTC) to exercise the FTC’s statutory rulemaking authority to “curtail the unfair use of non-compete clauses and other clauses or agreements that may unfairly limit worker mobility.” It is uncertain whether that rulemaking will entirely ban or just limit noncompete agreements; focus on restricting noncompetes for all workers or just those considered more vulnerable (such as low wage earners); restrict nonsolicit agreements along with noncompetes; or preempt state law.

The EO also encourages the Attorney General and the Chair of the FTC to consider revising the October 2016 Antitrust Guidance for Human Resource Professionals “to better protect workers from wage collusion” by (as the Fact Sheet explains) strengthening antitrust guidance to prevent the suppression of wages or reduction of benefits through employer collaboration and sharing of wage and benefit information. As we explained in a recent client alert, a push to scrutinize competition issues in labor markets was already in play, tracing back to the 2016 Antitrust Guidance, in which the Department of Justice and FTC alerted companies that “naked” wage-fixing and no-poaching agreements could be prosecuted criminally, and that employers competing to hire or retain the same employees are “competitors” from an antitrust perspective.Continue Reading Goodbye to Employer Protections? Biden Issues Executive Order Encouraging Curtailing of Post-employment Noncompetes

Employers have been awaiting guidance from the EEOC on vaccine-related incentives since the EEOC stated in April 2021 that it would issue new guidance (but declined to state when). Now, they have it. On May 28, 2021, the EEOC issued updated and expanded COVID-19 guidance in its technical assistance document “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws.” The updated guidance provides clarification and supplements the original December 2020 version of Section K (“Vaccines”) of the technical assistance.

Key updates regarding incentives include:

  • From a federal EEO standpoint, employers administering vaccines to their employees can offer incentives for their employees to be vaccinated, as long as the incentives are not coercive-but a large incentive could make employees feel pressured to disclose protected medical information by way of pre-vaccination disability-related screening questions.
  • Federal EEO laws do not prevent or limit employers from offering incentives to employees to voluntarily provide documentation or other confirmation of vaccination obtained from a third party (not the employer) in the community, such as a pharmacy, personal health care provider, or public clinic. Employers must keep vaccination information confidential pursuant to the ADA.

Notably, the EEOC stated in this update that it is beyond the EEOC’s jurisdiction to discuss the legal implications of the Emergency Use Authorization (EUA) status of the three COVID-19 vaccinations or the Food and Drug Administration’s (FDA) approach to vaccine authorization–a response to “many inquiries” the EEOC received about the type of authorization granted the vaccines by the US Department of Health and Human Services (HHS) and the FDA.Continue Reading EEOC Updates its COVID-19 Technical Assistance: Employers Administering Vaccines Can Offer Non-Coercive Incentives to Employees