====== 2-607 ======
Joseph J. LazzarottiJackson Lewis P.C. If you find this article helpful, you can learn more about the subject by going to www.pli.eduto view the on demand program or segment for which it was written. |
====== 2-609 ======
Last year, we addressed a wide range of workplace-related risks as companies look to harness the power of the digital age. We recognized that for most employers, employee privacy and data security considerations are changing rapidly, almost daily. Here, we touch on a couple of important developments and emerging issues for human resources professionals, as well as delving a bit into a critical best practice for workplace privacy and security – training.
In short, this article will briefly discuss:
• | the growing presence of “big data” and analytics in the workplace |
• | a recent development in California that will help all businesses and employers better understand what it means to have “reasonable safeguards” for protecting personal information. |
• | that privacy and data security training for employees is not just a prudent business practice, but very often a legal requirement. |
“Big Data” in the Workplace |
Earlier this year, the Federal Trade Commission (“FTC”) issued a report discussing “big data.”1 The report compiles the agency’s learning from recent seminars and research, including a public workshop held on September 15, 2014. Known best for its role as the federal government’s consumer protection watchdog, the FTC highlights in the report a number of concerns about uses of big data and the potential harms they may have on consumers. However, while the report’s focus is on the commercial use of big data involving consumer data, it also describes a number of issues raised when big data is employed in the workplace.
Used in the human resources context, big data has many useful applications such as helping companies to better select and manage applicants and employees. The FTC’s report describes a study which shows that “people who fill out online job applications using browsers that did not come with the computer . . . but had to be deliberately installed (like Firefox or Google’s Chrome) perform better and change jobs less often.” Applying this correlation in the hiring process can result in the employer rejecting candidates not because of factors that are job-related, but
====== 2-610 ======
Likely spurred at least in part by comments made by EEOC counsel at the FTC’s big data workshop in September 2014, the FTC’s report summarizes the potential ways that using “big data” tools can violate existing employment laws, such as Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act, the American with Disabilities Act and the Genetic Information Nondiscrimination Act. The report also includes a brief discussion of “disparate treatment” or “disparate impact” theories, concepts familiar to many employers.
According to the report, facially neutral policies or practices that have a disproportionate adverse effect or impact on a protected class create a disparate impact, unless those practices or policies further a legitimate business need that cannot reasonably be achieved by means that are less disparate in their impact. Consider the application above. Use of a particular browser seems to be facially neutral, but some might argue that selection results based on that correlation can have a disparate impact on certain protected classes. Of course, as the FTC report notes with regard to other uses of big data – a fact-specific analysis will be necessary to determine whether a practice causes a disparate impact that violates law.
Two other concerns discussed in the FTC’s report that have workplace implications include:
• | Biases in the underlying data. Big data is about the collection, compilation and analysis of massive amounts of data. If hidden biases exist in these stages of the process, “then some statistical relationships revealed by that data could perpetuate those biases.” Yes, this means “garbage in, garbage out.” The report provides a helpful example: a company’s big data algorithm only considers applicants from “top tier” colleges to help them make hiring decisions. That company may be incorporating previous biases in college admission decisions. Thus, it is critical to understand existing biases in data as they could undermine the usefulness of the end results. |
• | Unexpectedly learning sensitive information. Employers using big data can inadvertently come into possession of sensitive personal information. The report describes a study which combined data on Facebook “Likes” and limited survey information to determine that researchers could accurately predict a male user’s sexual orientation 88 percent of the time, a user’s ethnic origin 95 percent of time, and whether a user was Christian or Muslim 82 percent of the time. Clearly, exposure to this information could expose an employer to ====== 2-611 ====== |
Companies can maximize the benefits and minimize the risks of big data, according to the FTC report, by asking the following questions:
• | How representative is your data set? |
• | Does your data model account for biases? |
• | How accurate are your predictions based on big data? |
• | Does your reliance on big data raise ethical or fairness concerns? |
There certainly is much to consider before using big data technology in the workplace, or for commercial purposes. As big data applications become more widespread and cost efficient, employers may appropriately feel the need to leverage the technology to remain competitive. They will need to proceed cautiously, however, and understand the technology, the data collected and whether the correlations work and work ethically.
California Sheds More Light on the Meaning of “Reasonable Safeguards” for Protecting Personal Data2 |
In February, California Attorney General, Kamala D. Harris – who has been mentioned as a potential nominee to fill Justice Antonin Scalia’s recently vacated seat on the U.S. Supreme Court – issued the California Data Breach Report (Report)3. The Report provides an analysis of the data breaches reported to the California AG from 2012-2015.
But perhaps the most consequential part of the Report for businesses is that it establishes a floor of controls that must be in place for a business to be considered to have adopted “reasonable safeguards” to protect personal information. Other states have a “reasonable safeguards” requirement, but have not provided further guidance concerning that standard. California’s adoption of the Center for Internet Security’s Critical Security Controls (The Controls) may provide multistate employers a path to achieving a greater comfort level in the protections they have (or need to have) in place for employment-related personal information.
====== 2-612 ======
The Report details that nearly 50 million records of Californians have been breached and the majority of these breaches resulted from security failures. In fact, the Report explains that nearly all of the exploited vulnerabilities, which enabled the breaches, were compromised more than a year after the solution to address the vulnerability was publicly available. According to Ms. Harris, “It is clear that many organizations need to sharpen their security skills, trainings, practices, and procedures to properly protect consumers.”
Malware and hacking, physical breaches, and breaches caused by error have been the three most common types of breaches. Of the three, malware and hacking have been by far the largest source of data breaches, with 90% of all records breached by means of malware and hacking. Physical breaches, resulting from the theft or loss of unencrypted data on electronic devices, were next most common, with heath care entities and small businesses most heavily impacted. Breaches caused by error – such as mis-delivery of email and inadvertent exposure of information on the public Internet – ranked third. Government entities made half of all such errors.
Under California law, “A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” 4 This requirement is important as the Report specifically states an organization’s failure to implement all of the 20 controls set forth in the Center for Internet Security’s Critical Security Controls (The Controls) constitutes a lack of reasonable security.
The Controls are set out in the table below:
The Report goes on to discuss numerous findings about breach types, data types, and industry sectors impacted. It concludes with five recommendations at stemming the tide of these breaches:
1. | Reasonable Security: Implement The Controls which are viewed by the State’s Attorney General as a minimum level of information security. |
2. | Multi-Factor Authentication. Organizations should make multi-factor authentication available on consumer-facing online accounts that contain sensitive personal information. This stronger procedure ====== 2-614 ====== |
3. | Encryption of Data in Transit. Organizations should consistently use strong encryption to protect personal information on laptops and other portable devices, and should consider it for desktop computers. |
4. | Fraud Alerts. Organizations should encourage individuals affected by a breach of Social Security numbers or driver’s license numbers to place a fraud alert on their credit files and make this option very prominent in their breach notices. This measure is free, fast, and effective in preventing identity thieves from opening new credit accounts. |
5. | Harmonizing State Breach Laws. State policy makers should collaborate to harmonize state breach laws on some key dimensions. Such an effort could reduce the compliance burden for companies, while preserving innovation, maintaining consumer protections, and retaining jurisdictional expertise. |
While the Report, and California’s existing law, are focused on protecting the personal information of California residents, it is important to remember California has continuously been at the forefront of data security legislation. In fact, California was the first state to enact a data breach notification law in 2003, and since that time 46 other states have followed suit. As such, it would not be surprising if other states consider the recommendations in the Report, in particular the minimum standards for reasonable safeguards, and implement similar requirements.
Employee Privacy and Data Security Training: A Legal Requirement and Prudent Business Practice |
Many executives may be surprised to learn that one of the most frequent causes of data breaches is employee error, and not just employees in the IT department. The types of information involved in breaches go beyond payment cards, Social Security numbers and patient medical information, and can include valuable proprietary or trade secret information; privileged or financial data belonging to employees, clients and customers; and sensitive internal email communications. Every day mishaps like failing to lock a door, using the wrong email address, forgetting a device on a plane, forwarding the wrong attachment, or not knowing who is authorized to access data can have catastrophic consequences for a business.
====== 2-615 ======
While various safeguards may minimize employee error, employee training is essential in preventing data breaches. In certain industries, training may be required by law, but even if not required by a statute, data security training likely would be considered a reasonable safeguard for businesses required to protect certain data. Additionally, businesses in various industries increasingly are being required by contract, including government contracts, to conduct data security training. Finally, given the vast amounts of readily accessible data, it is a prudent business practice to train employees about the company’s policies and best practices concerning information confidentiality, privacy and security.
Yes. Looking back at our own experience as a practice group, having handled hundreds of data incidents and breaches, employee error is easily the most frequent cause. A number of reports and surveys also indicate that employee error is a key reason why companies are experiencing damaging losses of data. Late last year, the Wall Street Journal5 reported on a survey by the Association for Corporate Counsel that found “employee error” is the most common reason for a data breach. CSO Online reported6 on Experian’s 2015 Second Annual Data Breach Industry Forecast, stating, “Employees and negligence are the leading cause of security incidents but remain the least reported issue.” According to Kroll7, in 31% of the data breach cases it reviewed in 2014, the cause of the breach was a simple, non-malicious mistake. These incidents were not limited to electronic data – about one in four involved paper or other nonelectronic data. When people think about data breaches, they tend think more about the illegal hacking into computer networks by individuals, criminal enterprises or even nation states, than they do about employee error. This makes some sense as hacking incidents seem to draw intense media focus and capture the public’s attention. This misconception ====== 2-616 ====== |
For many businesses, the answer is yes, but it will depend on the kind of business, where it is located and the type of data the business maintains. Here are some examples:
|
There are a myriad of ways to design a training program to create awareness and build a culture of privacy and security in an organization. Key issues organizations should consider when designing a training program:
|
No system of safeguards is perfect, and that includes privacy and data security safeguards. Compliance is an ongoing process, and periodic data security training is an essential component of any organization’s data security compliance efforts. Through periodic training, organizations reinforce awareness regarding data privacy and take steps to manage risk, avoid litigation, and mitigate business exposure. |
1. | Big Data: A Tool for Inclusion or Exclusion? Understanding the Issues, Federal Trade Commission, January 2016. Available at https://www.ftc.gov/system/files/documents/reports/big-data-tool-inclusion-or-exclusion-understanding-issues/160106big-data-rpt.pdf. |
2. | This section was adapted from an article prepared by Jackson Lewis attorneys: Jason C. Gavejian, Principal, Morristown, NJ and Damon W. Silver, Associate, New York, NY. |
3. | California Data Breach Report, California Attorney General, Kamala D. Harris, February 2016. Available at https://oag.ca.gov/breachreport2016. |
4. | Cal. Civ. Code § 1798.81.5(b). |
5. | Nicole Hong, Employee Error Leading Cause of Data Breaches, New Survey Says, The Wall Street Journal Law Blog (Dec 9, 2015). Available at http://blogs.wsj.com/law/2015/12/09/employee-error-leading-cause-of-data-breaches-new-survey-says/. |
6. | Taylor Armerding, Healthcare breaches need a cure for human errors, CSO Online (Jan 19, 2015). Available at http://www.csoonline.com/article/2871215/data-breach/healthcare-breaches-need-a-cure-for-human-errors.html. |
7. | |
8. | HIPAA Privacy Rule § 164.530(b). |
9. | HIPAA Security Rule § 164.308(a)(5). |
10. | Data Security Reg. 201 CMR § 17.04(8). |
11. | ORS § 646A.622(d)(A)(iv). |
12. | Texas Health and Safety Code § 181.101. |