If you have employees or are doing business with individuals in the European Union, on May 25, 2018, you will be subject to some new regulations. The General Data Protection Regulation (GDPR) sets a new, heightened standard for data collection of citizens in EU countries, and many companies inside and outside of Europe will need to ensure that their systems and processes comply with a data protection statute that will be among the strictest in the world. There are specific provisions that apply to employee data.

The Basics

The GDPR applies to all companies processing and/or holding the personal data of data subjects residing in the EU, regardless of where the company is physically located. Even companies without an EU presence will be subject to the new rules whenever: (1) an EU resident’s personal data is processed in connection with good/services offered to him/her; or (2) the behavior of individuals within the EU is “monitored.” Additionally, violations of the GDPR could result in fines of up to 4 percent of a company’s annual global turnover or almost $25 million (20 million euros), whichever is greater.

Dealing with Your EU Employees’ Data

A key element of the GDPR is its heightened requirements for consent by employees for the processing of their personal data. Under the GDPR generally, consent must be freely given, specific, informed, unambiguous, and revocable. The GDPR, however, also acknowledges the limits of consent in situations where it cannot be freely given.

Article 29 of the Data Protection Working Party, an advisory body of representatives from the data protection authority of each EU Member State, outlines guidance on consent under the GDPR. These guidelines specifically acknowledge that an imbalance of power exists between an employer and an employee. Unlike consumers and customers who can provide voluntary consent for data processing, an employee will be unlikely to feel free to deny consent to data processing without fear of reprisal. For example, an employee may not feel free to refuse to fill out an assessment form or to refuse to consent to camera monitoring in the workplace when it could result in his or her termination.

Despite this imbalance of power, Article 29 acknowledges that there may be certain situations where an employee can freely consent. These exceptional circumstances can occur only when the employee is able to refuse consent with no fear of adverse consequences. As an example, Article 29 outlines a scenario where a film crew needs to film in certain office spaces. The employer requests consent from the employees sitting in that area to be filmed. If the employees who do not wish to be filmed suffer no consequences and are permitted to work in another part of the building during the filming period—that would be acceptable consent.

If consent in the employment context can be used only in exceptional circumstances, employers must find another legal basis to process their employees’ data. These additional legal bases include processing employee data when: (1) required for the performance of an employment contract, (2) required by law, or (3) furthering an employer’s legitimate interest. Furthering an employer’s legitimate interest requires the employer to perform a privacy impact assessment – balancing its legitimate interest with the employee’s privacy rights and documenting that the legitimate interest outweighs the employee’s privacy rights.

Next Steps

If you are going to be subject to the GDPR, you should review your employee documents (such as employment contracts or any permissions for data processing) to ensure they do not depend on the employee’s consent. For current employees, you may wish to provide new data processing notices outlining the additional legal bases for data processing. For new hires, you may wish to provide updated employment contracts and other documentation that outline the additional legal basis for data processing identified above. Employers should remain alert that under the GDPR consent alone may be insufficient for data processing in the employer/employee context.

Ever wonder why the severance agreement that I (or your other favorite employment lawyer) send you says “nothing in this Agreement prevents Employee from filing a charge with the EEOC” (or words to that effect)? I mean, isn’t that the point of the agreement? You pay the employee money, and he or she can’t file a charge or lawsuit against you? Well, a recently announced settlement from the EEOC provides some insight.

Background

An employee with the Coleman Company filed an EEOC charge alleging that the company discriminated against the employee based on a disability. After investigating, the EEOC found that it was probable that the company violated Section 503 of Americans with Disabilities Act and Section 704 and 706 of Title VII—the retaliation provisions. How, you may ask? According to the EEOC’s announcement,

the company conditioned “employees’ receipt of severance pay on an overly broad severance agreement that interfered with employees’ rights to file charges and communicate with the EEOC, and which precluded employees from accepting any relief obtained by the EEOC, should the agency take further action.”

Coleman has agreed to hire a consultant to review its severance agreements and make changes if necessary. The company will also notify employees who signed agreements in the last few years about their rights.

Now What?

Keep in mind that the EEOC’s announcement does not indicate that Coleman discriminated against the former employee based on a disability. This conciliation was all about a provision in the severance agreement. So, it appears that the company did what it was supposed to do under the ADA but is being chastised only for its form agreement.

The EEOC has made clear that it is concerned about the breadth of severance agreements. In fact, preserving access to the legal system, including addressing overbroad separation agreements, is part of its Strategic Enforcement Plan.

Note that the EEOC’s agreement with Coleman goes well beyond the current charging party. Not only must Coleman review and perhaps revise its current agreement, it must notify any employees who signed similar agreements in recent years. Once the EEOC is looking at an issue in your workplace, it can expand beyond the current employee.

So what’s the moral of the story? When your labor lawyer includes language that carves out someone’s ability to talk to the EEOC (or any other government agency), listen.

Urine testing—not one of the more popular work activities. However, drug tests are part of safety programs throughout the country. Two recent events—one a court decision and one a potential legislative event—give me the opportunity to review this issue.

Alabama Case: Can You Require Employees to Tell You What Medicines They Take?

The Facts: On January 18, in Upton v. Day & Zimmerman NPS, an Alabama federal district judge reminded employers about how drug tests may connect hiring decisions and the ADA. Mr. Upton, a pipefitter who had lower back pain after a 1989 car accident, took prescription morphine, an opiate. Due to a union contract, Upton was required to pass a five-panel drug test before working at a power plant. When Upton would take the test, it came back positive for opiates, but the medical review process would note that he had a legitimate prescription and he was permitted to work. The review process included a letter from his physician showing that he could work safely while taking the pain medication.

In January 2015 (so Mr. Upton had been taking the medication for many, many years), he was sent to another plant where he took another drug screen. He presented another letter from his doctor that described his prescription, but this one also opined that requiring employees to disclose their medications may be a violation of the ADA. Mr. Upton was not hired for that job, and he sued.

The Litigation: Both Mr. Upton and the company moved for summary judgment on various issues: whether the company regarded Mr. Upton as disabled; whether Mr. Upton was, in fact, a qualified individual with a disability; and whether the company discriminated against him because of a disability. The court found insufficient evidence to support a “regarded as” claim and spent a good bit of time discussing whether Mr. Upton should be considered a qualified individual with a disability. But the lesson from this opinion deals with whether the drug testing itself was improper.

Are Drug Tests Improper Medical Inquiries? As the court notes, a pre-employment drug test does not count as a “medical inquiry” under the ADA. (The court does not say whether a decision maker’s access to medical information collected as part of an employment entrance exam under another section of the ADA is problematic as Mr. Upton failed to plead that section.) Even the letter from Mr. Upton’s doctor can be considered proper. Mr. Upton complained that he was required to disclose the actual medication he was taking—opioids—instead of just stating that he had a valid prescription and could safely do the job. The court noted that practically, an employee would have to disclose the actual medication so as to explain the positive drug test. In addition, since the inquiry was in the pre-offer stage, an applicant who tests positive for illegal drugs may be required to give possible explanations for the test.

Overall, this case again shows that pre-employment drug testing can be a valid part of the application process. Employees can also provide medical documentation to explain a positive test—that’s not improper under the ADA. Keep in mind that Mr. Upton’s disability discrimination claim survived, so the company is going to trial to defend its decision not to hire him.

Mississippi Seeks to Ban Synthetic Urine

On another, stranger drug testing note, a member of the Mississippi state legislature has introduced a bill to combat synthetic human urine products. The bill is titled “Urine Trouble” and would prohibit retailers from selling the product that mimics human urine chemistry and is packaged with instructions on how to keep it at body temperature. Apparently, it is being used to create false negative drug screens. If this proposal passes, Mississippi will join the growing ranks of states (including Florida and Illinois) that make synthetic urine illegal. We doubt that the other states have named their statutes as uniquely.

Lessons from the Drug Testing World?

  • Pre-employment drug tests are okay under the ADA but you should still consider limiting decision makers’ access to the information. If the decision maker doesn’t know anything other than that the drug test was fine, he cannot be accused of discriminating against someone based on an alleged disability related to the drug test.
  • As long as there are drug tests there will be people who help employees beat them. Luckily we have legislatures who are trying to help us on the front.