LegalTXTS – A Luminate Law Blog – Page 9 – Cybersecurity, Privacy & Internet Law

Are You Prepared For E-Discovery of Data on Your Employees’ Personal Devices?

February 24, 2014 by Elijah Yip·1 Comment

Suppose an email from your company’s in-house attorney instructs you to preserve all documents relating to an ex-employee who is threatening to sue for wrongful termination. In the days before smartphones and cloud storage, this would have been a relatively limited exercise: paper documents would be set aside and files on the company server would be backed up. But work-related data can be stored in many places today, including personal devices of employees. Is a company required to preserve such data?

Costco Wholesale recently faced that issue in an employment discrimination and retaliation lawsuit. See Cotton v. Costco Wholesale Corp., 2013 WL 3819974 (D. Kan. July 24, 2013). The plaintiff asked Costco to produce text messages on the personal cell phones of two of its employees who mentioned the plaintiff or his allegations. Costco objected on the grounds that the discovery request required it to invade the privacy of its employees, and there was no indication that the employees sent inappropriate text messages or used their personal phones for work purposes. The court denied the request, determining that Costco did not have possession, custody, or control of the text messages.

Although the court in the Cotton case ruled that the employer had no duty to produce information stored on the personal devices of the employees in question, the outcome might have been different if the facts had changed even slightly. Courts in other jurisdictions might also have taken a contrary approach.

The law in this area is far from clear, but following the guidelines below will help a company address e-discovery issues in their policy on personal electronic devices. An easy way to remember the guidelines is to think of the acronym “APPS”:

Access: Reserve the right to access personal devices that store work-related data. Access is crucial if the company is legally required to collect and produce data residing in the personal devices of an employee.
Permission: Clearly specify what personal devices employees are authorized to use for work-related purposes, if any. Consider keeping a log of authorized personal devices and require employees to update the log whenever they start using a new authorized device or retire an existing one. Your company’s document retention policy should extend to authorized devices.
Privacy: Notify employees that they should have no expectation of privacy to data stored on a personal device if they use the device for work purposes. This prevents the company from being liable for invasion of privacy should it need to search the contents of a personal device to respond to a discovery request.
Segregation: If possible, segregate work-related content from personal content on personal devices. Segregation can be implemented with software solutions, but if that is not feasible, at a minimum, instruct and train employees who use a personal device for work on how to keep their personal information separate from work data stored on the device. For example, storage of work-related data in a personal cloud storage account should be prohibited.

Follow the above guidelines to avoid getting caught off-guard by e-discovery requests.

Hawaii Legislature 2014 — Summary of Proposed Computer Tech Legislation

January 31, 2014 by Elijah Yip·0 Comments

It’s time to roundup the bills related to computer technology that the Hawai‘i legislature is considering in its 2014 regular session. Click here for a chart summarizing the proposed legislation. Here are the highlights:

Social Media and Internet Account Passwords: Several bills to prohibit improper requests for access to personal social media accounts of employees and students were introduced in the 2013 session. None of the them passed. This year, HB2415 renews the effort to outlaw improper social media password requests.

Internet Sales Tax: HB1651 would require online companies with arrangements with Hawaii merchants for referral of business to collect use taxes on sales made in Hawaii. This bill would affect online retailers like Amazon, who allows local merchants to sell their products through Amazon Marketplace.

Restrictive Covenants: In an effort to encourage the development of technology business in Hawai‘i, a state with a relatively small geographic area, two bills (HB2617 and SB3126) would prohibit technology businesses from requiring employees to enter into noncompete agreements and restrictive covenants. “Technology business” is defined as “a trade or business that relies on software development, information technology, or both.”

Cybersquatting: SB2958 would put the burden on a cybersquatter to prove that it did not register a domain name in bad faith or with intent to use it in an unlawful manner, provided that the person claiming cybersquatting can demonstrate the potential of immediate and irreparable harm through misuse of the domain name.

Cybersecurity Council: SB2474 would establish the Hawai‘i cybersecurity, economic, education, anfrastructure security council.

Mobile Devices: Three bills (HB1509, HB1896, and SB2729) would make it a State offense to use a mobile electronic device while operating a motor vehicle. Certain counties already have similar laws.

3D Printing: In response to the rising availability of 3D printers, HB1802 would make it a crime to create, possess, sell, trade, or give another person a firearm made with digital manufacturing technology.

Computer crimes: A series of bills criminalizes various kinds of computer activity, including unauthorized access to a computer or network and damage to a “critical infrastructure computer” (HB1640); theft of a computer (HB1644); or personal electronic device for storing or retrieving personal information (HB2080); and revenge porn (SB2319).

NLRB Approves Rule Shuttering Cameras in the Workplace

January 27, 2014 by Elijah Yip·1 Comment

(Photo credit: Wikipedia)

“Smile, you’re on Candid Camera.” Originally coined on the eponymous TV show, that catchphrase is becoming more of common refrain in the workplace. Any employee with a smartphone can easily record an office conversation in secret. But are such covert recordings legal? And what control, if any, does management have over the making of such recordings?

The Law of Recording Face-to-Face Conversations

A majority of states (approximately 37) follow the one-person consent rule for recording face-to-face conversations. This rule authorizes the recording of a conversation so as long as one person in the conversation consents. The consenting party can also be the person recording the conversation. Practically speaking, this means it is legal to record a conversation with another person without his or her knowledge.

Most other states require the consent of all participants in the conversation. Covert recording of face-to-face conversations would not be permitted in states that follow the all-party consent rule.

Workplace Bans on Covert Recordings

Even if covert recordings are legal, management may regulate the practice if done so consistently with the right of employees to engage in concerted activity, which is protected under Section 7 of the National Labor Relations Act (NLRA). A recent National Labor Relations Board decision illustrates this. Whole Foods Market, Inc., Case No. 01-CA-096965 (Oct. 30, 2013). The case involved a challenge to a company policy that banned employees from recording conversations without prior management approval. The company’s stated purpose for the policy was “to eliminate a chilling effect to the expression of views that may exist when one person is concerned that his or her conversation with another is being secretly recorded.”

The administrative law judge (ALJ) in the case upheld the policy. The ALJ noted that there is no protected right to record conversations in the workplace, but even if there were such a right, management may regulate the exercise of that right. It was not adopted in response to union activity, and it was clearly tied to the company’s core value of fostering open and honest dialogue about company matters. The ALJ disagreed that the policy could reasonably be interpreted as a restriction on using social media to communicate and share information about work conditions through video recordings made at the workplace. The policy regulated a means of communication as opposed to the protected activity itself. It also did not prohibit employees from making recordings during non-work time. The policy therefore did not violate Section 7 rights.

Takeaways

The Whole Foods Market decision suggests questions that management should consider when drafting a work rule against covert recordings to ensure that the rule does not violate the NLRA:

Is the rule clearly linked to a purpose besides preventing employees from engaging in Section 7 activity?
Does the rule leave open alternative channels for employees to communicate about Section 7 activity?
Does the rule allow employees to make recordings during non-work hours?

A ban on covert recordings is more likely to withstand a legal challenge if management can answer “yes” to each of these questions.

The Sacco Saga and Four Myths That Get Professionals Into Social Media Trouble

December 23, 2013 by Elijah Yip·0 Comments

With a single tweet, an employee of IAC (owner of websites like Match.com and Vimeo) went from relative obscurity to the target of an Internet inquisition. Before boarding a plane, Justine Sacco posted this message on Twitter: “Going to Africa. Hope I don’t get AIDS. Just kidding. I’m white!” The tweet went viral while Sacco was en route to South Africa, oblivious to the controversy brewing online. Death threats landed in her inbox. Someone opened a parody Twitter account for Sacco. A hashtag (#HasJustineLandedYet) was created to help people keep track the arrival of her plane. IAC quickly condemned Sacco’s tweet in a press release and on social media. The New York Times published an article about the controversy later the same evening. The next day, IAC fired her. Sacco issued an apology on Sunday.

Social media meltdowns are nothing new, but the story highlights four myths that can get professionals into social media trouble.

“I’m a pro—I know what I’m doing.” Sacco worked as a communications director for IAC. One might expect a PR professional to be sensitive about what their public expression, but Sacco’s expertise apparently didn’t save her from posting a message that many found offensive. Before posting, think twice (or thrice) about how the message will be received by the public.

“No one will ever find out.” Sacco’s Twitter account didn’t have many followers at the time she posted the controversial tweet—less than 200. Having a small following can create a false sense of security that the public will never see the contents of the account. But one doesn’t need to be an Internet rockstar to get into trouble. Posts can go viral if a follower shares it with someone else, who in turn shares it with another person, and so on …

“No worries, it’s my personal account.” Just because a social media account is designated as personal doesn’t mean it should have no filter. Although Sacco used her personal Twitter account to make the infamous post, her account profile listed IAC as her employer. This made it easy for readers to associate IAC with Sacco’s post. As a result, IAC was involuntarily drawn into the controversy. The moral of the story is that the lines between personal and professional are very blurry on the Internet.

“Just this one time.” Bad judgment on social media is seldom an isolated incident. Earlier in 2013, Sacco had tweeted: “I can’t be fired for things I say while intoxicated right?” Because social media extends brand management beyond official company channels, companies should keep track of employees who publicly identify their employer and periodically check if those employees regularly interact in ways that damage the company brand.

The Sacco incident teaches that the value of training on good social media practices cannot be overemphasized. The old adage about an ounce of prevention is no less true in the digital age.

Related articles