Policy Vs Law: Who Wins?

Company policies are often implemented to maintain employee confidentiality and privacy. However, there are instances where a company's policy may conflict with federal or state laws. In such cases, it is important to note that a company's policy cannot override federal or state laws and must comply with the minimum requirements of the law. When it comes to privacy, the law considers what an individual would expect, and employees may have varying expectations of privacy in different situations. Therefore, it is recommended that companies seek legal counsel to ensure their policies do not infringe upon the privacy rights of their employees and are in line with applicable laws.

Company policy and employee privacy rights

Company policies are specific to the industry and worksite and cover a range of daily work activities, wages, and benefits. They can be written or unwritten and may include a handbook and human resources policies, as well as informal rules that are part of the workplace culture. However, company policies cannot violate federal and state employment laws.

Employee privacy rights are the guidelines that control how much an employer can monitor an employee's activities, words, or messages. They focus on protecting personal data, confidentiality, and minimizing excessive monitoring. Federal and state laws guide privacy standards and require transparency and proper consent. Clear policies, documented monitoring practices, and staff training are essential to maintain compliance and trust.

In most cases, employees must be notified before being subjected to drug or alcohol testing, and some states require written consent. Employers typically cannot conduct testing secretly or without cause unless in safety-sensitive industries where random testing is allowed.

When sharing an employee's personal data with external parties, employers are required to assess the third party's privacy practices and their compliance with relevant data protection laws. For example, the California Consumer Privacy Act (CCPA) gives workers substantial control over their personal information. Similarly, Singapore's Personal Data Protection Act (PDPA) has several provisions governing the collection, disclosure, use, and care of personal data, aiming to guarantee its protection.

In summary, company policies and employee privacy rights must be compliant with federal and state laws. While companies have the flexibility to create policies specific to their industry and workplace culture, they cannot override legal requirements. Employees have rights to privacy and protection of their personal data, which are enforced through relevant data protection laws.

Employee privacy rights and expectations

While people expect to have some privacy at work, even when using their employer's equipment, it is normal that working for someone entails giving up some privacy. Employers need basic information about their employees for payroll and benefits, and to ensure work is being done efficiently and safely. However, the possibilities for infringing on privacy are greater than ever before. For example, employers can monitor numerous aspects of an employee's work, especially with regard to communications technology owned by the employer, such as email, telephone and internet use.

Employees have the right to keep private facts about themselves confidential and the right to some degree of personal space. However, employees have only a limited expectation of privacy, and employers may legally engage in surveillance, drug testing, or monitoring of an employee's lifestyle. For instance, an employee using their company's technology, such as a computer, should expect their employer to monitor it — even if they are checking their personal email. Although an employer can monitor work-related calls, they must stop monitoring once they realise that the employee is on a personal call. If a company gives an employee a work cellphone, they can look at their text messages, even if some are personal. In most cases, employers can videotape employees, but courts have prohibited filming in locker rooms and bathrooms.

A company's policy cannot conflict with the minimum requirements of federal or state law. Employers can balance their need to know with their employees' right to privacy, if they ensure that they collect, use, and disclose personal information about their employees for appropriate purposes only. An employer's need for information should be balanced with an employee's right to privacy. At a minimum, employers should tell their employees what personal information will be collected, used, and disclosed. They should inform employees of their policies on web, email, and telephone use, for example. If employees are subject to random or continuous surveillance, they need to be told so. Employers should also ensure that information they collect for one purpose isn't used for an unrelated purpose without the employee's consent. Even if they're not required to do so by law, employers should give employees access to the personal information held about them, so that they can verify, and if necessary, challenge its accuracy and completeness.

Company policy and federal/state laws

Company policies cannot override federal or state laws. A company's policy cannot conflict with the minimum requirements of federal or state law. In the case of a conflict between state and federal law, federal law "wins". The US Constitution includes the "Supremacy Clause", which states that the US Constitution, federal laws, and US treaties are superior to state laws.

For example, federal tax law applies to all US persons, including citizens, permanent residents, and corporations, regardless of which state they are resident in. Similarly, the Department of Labor (DOL) administers and enforces more than 180 federal laws that cover many workplace activities for about 165 million workers and 11 million workplaces.

However, it is important to note that federal and state laws can be complicated and create conflicts. For instance, while federal law may permit certain activities, state law can impose more restrictions and prohibit them. This is the case with marijuana, where a state law can prohibit its use even if federal law permits it.

Additionally, most business entities are created at the state level, and the laws that regulate corporate governance and shareholder rights are determined by the state of incorporation. The Privileges and Immunities Clause (also known as the Comity Clause) requires each state to treat citizens of other states equally with its own. This means that a "foreign" company (formed outside the state) cannot be prevented from doing business in a state unless it intends to perform illegal activities within that state.

Company privacy and communication laws

Company policies cannot override federal or state laws. In the context of privacy and communication laws, companies are bound by various legislation that governs how they handle their employees' and customers' personal data.

Privacy Laws

Privacy laws can be categorized into two types: vertical and horizontal. Vertical privacy laws protect sensitive information such as medical records or financial data, including an individual's health and financial status. Horizontal privacy laws, on the other hand, focus on how organizations use information, regardless of its context. This includes fingerprints, retina scans, biometric data, and other personally identifiable information such as names and addresses.

Communication Laws

Communication privacy laws in the U.S. are addressed in the Electronic Communications Privacy Act (ECPA) and other federal laws, such as the Telecommunications Act. The ECPA of 1986 criminalizes the interception of wire, voice, or electronic communications. It also outlines procedures for law enforcement interceptions. The Stored Communications Act, often referred to alongside the ECPA, clarifies how the government can legally access stored electronic communications.

Company Policies

Company policies must comply with these privacy and communication laws. For example, a company policy may state that employees cannot record conversations with co-workers, managers, or third parties without prior approval from the Legal Department and ensuring compliance with relevant laws. However, such a policy cannot violate employee rights or override federal or state laws.

Enforcement

The Federal Trade Commission (FTC) is the principal enforcer of privacy laws in the U.S. The FTC has taken action against companies like Google and Facebook for misleading consumers about their data security and privacy practices. Additionally, state-level legislation, such as the California Privacy Rights Act (CPRA) and Virginia's Consumer Data Protection Act (CDPA), further strengthen privacy protections and grant consumers more control over their data.

Employee rights and company policies

Company policies are a set of written guidelines that outline the practices and procedures of a business. They set expectations for employee behaviour and actions in various scenarios. These policies are beneficial to both employees and employers as they ensure consistency, promote fairness, enhance efficiency, and help in compliance with legal regulations.

Employee rights are protected by various laws and regulations, and company policies should be aligned with these laws to ensure that employee rights are not violated. For example, an equal opportunity policy (EOP) prevents companies from discriminating against job applicants or employees based on protected characteristics such as race, gender, age, religion, or colour. This is mandated by law in most countries. Similarly, workplace health and safety laws protect employees' rights to work in a safe and healthy environment, and companies should have policies in place to ensure this.

Company policies can also outline the rights and responsibilities of employees within the organisation. For instance, attendance policies define the rules and guidelines surrounding employee adherence to work schedules and the consequences for failing to adhere to them. Companies may also have substance abuse policies that prohibit the use of drugs, alcohol, and tobacco during work hours or on company property. These policies are important for maintaining a safe and healthy work environment and can include disciplinary actions for employees who violate them.

It is important to note that company policies cannot override federal or state laws. While companies can develop their own policies, they must comply with the minimum requirements of applicable laws. For example, a company policy may outline procedures for employee discipline, but it cannot violate employees' legal rights or protections afforded by federal or state laws. Therefore, when creating company policies, businesses should ensure that they are compliant with all relevant laws and regulations to protect employees' rights.

Frequently asked questions