Our colleague Nancy Gunzenhauser Popper at Epstein Becker Green has a post on the Retail Labor and Employment Law Blog that will be of interest to our readers in the technology industry: “April Fools Joke? No. NYC Employers Really Have Two Sets of Training Requirements.”

Following is an excerpt:

Don’t forget – April 1 marks the beginning of a new set of sexual harassment training requirements in New York City. While the training requirement began across New York State on October 9, 2018 (and must be completed by October 9, 2019), the City imposes additional requirements on certain employers. Both laws require training to be provided on an annual basis.

While the State law requires training of all employees, regardless of the number of employees in each state, the City law applies only to employers with 15 or more employees. When counting employees, an employer must count independent contractors who work for the employer. …

Read the full post here.

Our colleague Laura A. Stutz at Epstein Becker Green has a post on the Health Employment and Labor Blog that will be of interest to our readers in the technology industry: “Race Discrimination on the Basis of Hair Is Illegal in NYC.”

Following is an excerpt:

The New York City Commission on Human Rights published legal enforcement guidance defining an individual’s right to wear “natural hair, treated or untreated hairstyles such a locs, cornrows, twists, braids, Bantu knots, fades, Afros, and/or the right to keep hair in an uncut or untrimmed state.”   The guidance applies to workplace grooming and appearance policies “that ban, limit, or otherwise restrict natural hair or hairstyles”:

[W]hile an employer can impose requirements around maintaining a work appropriate appearance, [employers] cannot enforce such policies in a discriminatory manner and/or target specific hair textures or hairstyles. Therefore, a grooming policy to maintain a ‘neat and orderly’ appearance that prohibits locs or cornrows is discriminatory against Black people because it presumes that these hairstyles, which are commonly associated with Black people, are inherently messy or disorderly. This type of policy is also rooted in racially discriminatory stereotypes about Black people, and racial stereotyping is unlawful discrimination under the [New York City Human Rights Law].

A grooming or appearance policy prohibiting natural hair and/or treated/untreated hairstyles to conform to the employer’s expectations “constitutes direct evidence of disparate treatment based on race” in violation of the City’s Human Rights Law. …

Read the full post here.

Washington State is considering sweeping legislation (SB 5376) to govern the security and privacy of personal data similar to the requirements of the European Union’s General Data Protection Regulation (“GDPR”). Under the proposed legislation, Washington residents will gain comprehensive rights in their personal data. Residents will have the right, subject to certain exceptions, to request that data errors be corrected, to withdraw consent to continued processing and to deletion of their data. Residents may require an organization to confirm whether it is processing their personal information and to receive a copy of their personal data in electronic form.

Covered organizations will be required to provide consumers with a conspicuous privacy notice disclosing the categories of personal data collected or shared with third parties and the consumers’ rights to control use of their personal data. Significantly, covered businesses must conduct documented risk assessments to identify the personal data to be collected and weigh the risks in collection and mitigation of those risks through privacy and cybersecurity safeguards.

Washington’s proposal follows the recent enactment of the California Consumer Privacy Act (see EBG’s Act Now AdvisoryCalifornia’s Consumer Privacy Act What Employer’s Need to Know). Washington’s legislation, however, will grant rights beyond those contained in the California Act and is more closely aligned with the GDPR’s framework. The heightened protections are grounded in the sponsors’ recognition of the detrimental effect of data breaches and the resulting loss of privacy. The Act cites to the GDPR as providing for “the strongest privacy protections in the world” and adopts the GDPR’s expansive definition of “personal data” – any information relating to any identified or identifiable natural person.

Businesses that process the personal data of more than 100,000 Washington residents are covered, as well as “data brokers” that derive 50 percent of their revenue from the brokered sale of personal information. Notably, “data sets” (i.e., Protected Health Information (“PHI”)) regulated by the federal Health Insurance Portability and Accountability Act of 1996, Health Information Technology for Economic and Clinical Health (“HITECH”) Act, or the Gramm-Leach-Bliley Act of 1999 are not covered. Financial and health care institutions may need to comply as to other personal data not protected under these statutes. If a health care or financial institution collects or processes other personal data and meets the thresholds above, then it is likely covered.

Employers should take note that data sets maintained only for employment records purposes are excluded. Notably, the Act excludes from coverage “an employee or contractor of a business acting in their role as an employee or contractor.” The Act will impact organizations that use facial recognition technology for profiling consumers with effects on “employment purposes” and “health care services” requiring human review prior to final decisions. Organizations who contract with facial recognition firms may see pass through contractual restrictions prohibiting use for unlawful bias.

There is no private right of action. Enforcement actions may be brought by the Attorney General to obtain injunctive relief and to impose civil penalties. If enacted, the Act, scheduled to become effective December 31, 2020, will have wide-ranging impacts requiring significant advance planning, risk assessments and consideration of privacy and security by design principles.

As we previously reported, since 2017 employees have filed dozens of employment class actions claiming violations of Illinois’ 2008 Biometric Information Privacy Act (“BIPA”). In short, BIPA protects the privacy rights of employees, customers, and others in Illinois against the improper collection, usage, storage, transmission, and destruction of biometric information, including biometric identifiers, such as retina or iris scans, fingerprints, voiceprints, and scans of face or hand geometry. Before collecting such biometric information, BIPA requires an entity to: (1) provide written notice to each individual of the collection; (2) obtain a signed release from each individual for the collection of biometric data; and (3) make available a policy that contains a retention schedule and guidelines for the permanent destruction of the biometric data.

One of the unresolved legal issues was whether an entity’s failure to comply with BIPA’s requirements, absent an actual injury, was sufficient to sustain a claim under that law. On January 25, 2019, the Illinois Supreme Court weighed in on this issue in Rosenbach v. Six Flags Entertainment Corp., holding that mere collection of an individual’s biometric information may be enough to state a claim under BIPA.

In Rosenbach, a parent sued on behalf of her child after he was fingerprinted entering a Six Flags theme park. Neither the parent nor the child signed a release, Six Flags did not provide a written notice provided to the child or the parent, and Six Flags did not have a publicly available policy regarding the retention or destruction of the biometric information. Nonetheless, there have been no known data breaches on Six Flags systems, and the complaint did not allege any other harm to the parent or her son.

The Illinois Supreme Court found that the legislative intent behind BIPA dictated that a technical violation of the law, such as failure to provide notice or obtain a release, is sufficient to state a claim under the Act. Under BIPA, an “aggrieved” party is similar to the concept of the injury-in-fact requirement for standing in federal court. There, the Court found that the “injury is real and significant.”

In light of the Rosenbach decision, it is even more important that employers with operations in Illinois consider taking the following action:

(1)  First, determine if your company collects, uses, stores, or transmits any employee’s (or other individual’s) biometric information or identifiers that may be covered by BIPA (e.g., using fingerprint recognition technology for time keeping purposes or to access a company-issued property or devices).

(2)  If your company does collect, use, store, or transmit biometric data/identifiers, you should:

(a)  develop or review existing, written policies concerning the collection, storage, use, transmission, and destruction of that information, consistent with industry standards;

(b)  implement policies concerning proper notice to employees (and other affected individuals) about the company’s use, storage, etc., of such data and obtain written and signed consent forms from all affected persons; and

(c)  establish practices to protect individuals’ privacy against improper disclosure of biometric data/identifiers, using the methods and standard of care that they would apply to other material deemed confidential and sensitive.

Importantly, providing proper notice includes identifying the specific reason for the collection, storage, and use of the biometric data, as well as how long the employer will use or retain such data. 740 Ill. Comp. Stat. 14/15(a), (b); 14/10.

Our colleagues at Epstein Becker Green have a post on the Hospitality Labor and Employment Law blog that will be of interest to our readers in the technology industry: “Mayor de Blasio Proposes Mandatory Paid Personal Time Law.”

On January 9, 2019, Mayor Bill de Blasio announced his plan to make New York City the first city in the country to mandate that private sector employers provide paid personal time (“PPT”) for their employees. Under the proposal, employers with five or more employees would be required to grant their employees 10 days of PPT to use for any purpose, including vacation, religious observance, bereavement, or simply to spend time with their families. It is unclear whether the proposed legislation would apply to only full-time workers, or whether, similar to the Earned Safe and Sick Time Act (“ESSTA”), it would include many part-time employees as well. The Mayor said he would work with the New York City Council to develop the legislation, and several Council members have already voiced their support for the proposal. …

Read the full post here.

There is a visceral and palpable dynamic emerging in global workplaces: tension.

Tension between what is potentially knowable—and what is actually known.   Tension between the present and the future state of work.  Tension between what was, is, and what might become (and when).  Tension between the nature, function, and limits of data and technology.

The present-future of work is being shaped daily, dynamically, and profoundly by a host of factors—led by the exponential proliferation of data, new technologies, and artificial intelligence (“AI”)—whose impact cannot be understated.  Modern employers have access to an unprecedented amount of data impacting their workforce, from data concerning the trends and patterns in employee behaviors and data concerning the people analytics used in hiring, compensation, and employee benefits, to data that analyzes the composition of the employee workforce itself.  To be sure, AI will continue to disrupt how virtually every employer views its human capital model on an enterprise basis. On a micro level, employers are already analyzing which functions or groups of roles might be automated, augmented, or better aligned to meet their future business models.

And, yet, there is an equal, counterbalancing force at play—the increased demand for accountability, transparency, civility, and equity.  We have already seen this force playing out in real time, most notably in the #MeToo, pay equity, and data privacy and security movements.  We expect that these movements and trends will continue to gain traction and momentum in litigation, regulation, and international conversation into 2019 and beyond.

We have invited Epstein Becker Green attorneys from our Technology, Media & Telecommunications (“TMT”) service team to reflect and opine on the most significant developments of the year.  In each, we endeavor to provide practical insights to enable employers to think strategically through these emergent tensions and business realities—to continue to deliver value to their organizations and safeguard their goodwill and reputation.

Continue Reading <i>Take 5</i> Newsletter – The Present-Future of Work: 2018 Trends and 2019 Predictions

Our colleague at Epstein Becker Green has a post on the Retail Labor and Employment Law blog that will be of interest to our readers in the technology industry: “DOJ Finally Chimes In On State of the Website Accessibility Legal Landscape – But Did Anything Really Change?

Following is an excerpt:

As those of you who have followed my thoughts on the state of the website accessibility legal landscape over the years are well aware, businesses in all industries continue to face an onslaught of demand letters and state and federal court lawsuits (often on multiple occasions, at times in the same jurisdiction) based on the concept that a business’ website is inaccessible to individuals with disabilities. One of the primary reasons for this unfortunate situation is the lack of regulations or other guidance from the U.S. Department of Justice (DOJ) which withdrew long-pending private sector website accessibility regulations late last year. Finally, after multiple requests this summer from bi-partisan factions of Members Congress, DOJ’s Office of Legislative Affairs recently issued a statement clarifying DOJ’s current position on website accessibility. Unfortunately, for those hoping that DOJ’s word would radically alter the playing field and stem the endless tide of litigations, the substance of DOJ’s response makes that highly unlikely.

DOJ’s long-awaited commentary makes two key points…

Read the full post here.

Join Epstein Becker Green attorneys, Brian G. Cesaratto and Brian E. Spang, for a discussion of how employers can best protect their critical technologies and trade secrets from employee and other insider threats. Topics to be discussed include:

  • Determining your biggest threat by using available data
  • What keeps you up at night?
  • Foreseeing the escalation in risk, from insider and cyber threats to critical technologies
  • New protections and remedies under the Trade Secret Protection Act of 2014
  • Where are your trade secrets located, and what existing protections are in place?
  • What types of administrative and technical controls should your firm consider implementing for the key material on your network to protect against an insider threat?
  • What legal requirements may apply under applicable data protection laws?
  • How do you best protect trade secrets and other critical technologies as information increasingly moves into the cloud?
  • Using workforce management and personnel techniques to gain protection
  • The importance of an incident response plan
  • Developing and implementing an effective litigation response strategy to employee theft

Wednesday, October 3, 2018.
12:30 p.m. – 2:00 p.m. ET
Register for this complimentary webinar today!

Our colleagues at Epstein Becker Green has a post on the Retail Labor and Employment Law blog that will be of interest to our readers in the technology industry: “NYC Commission on Human Rights Issues Guidance on Employers’ Obligations Under the City’s Disability Discrimination Laws.”

Following is an excerpt:

The New York City Commission on Human Rights (“Commission”) recently issued a 146-page guide titled “Legal Enforcement Guidance on Discrimination on the Basis of Disability” (“Guidance”) to educate employers and other covered entities on their responsibilities to job applicants and employees with respect to both preventing disability discrimination and accommodating disabilities. The New York City Human Rights Law (“NYCHRL”) defines “disability discrimination” more broadly than does state or federal disability law, and the Guidance is useful in understanding how the Commission will be interpreting and enforcing the law. …

Read the full post here.

This extended interview from Employment Law This Week will be of interest to many of our readers. Attorney and co-editor of this blog, Michelle Capezza explains how recent legal developments have prepared employers for their future workforce, which will include artificial intelligence technologies working alongside human employees. She also looks at the strategies employers should start to consider as artificial intelligence is incorporated into the workplace.