Employee & Workplace Privacy Flashcards

Biometric information collected from employees (such as fingerprints for timekeeping) is primarily regulated by:

Answer: State biometric privacy laws such as Illinois BIPA

Biometric data collection in the workplace is primarily regulated by state laws like Illinois' Biometric Information Privacy Act (BIPA), which requires written consent, a public retention policy, and limits on data sharing.

Under the Genetic Information Nondiscrimination Act (GINA), employers are prohibited from:

Answer: Using genetic information in hiring, firing, or compensation decisions

GINA prohibits employers from using genetic information in employment decisions and restricts the acquisition of genetic information about employees or their family members.

When an employee returns from FMLA leave, their medical certification and related health information must be:

Answer: Kept in a separate confidential medical file, apart from the general personnel file

FMLA regulations, consistent with ADA requirements, mandate that employee medical information be maintained in separate confidential files distinct from general personnel records.

Before disciplining an employee based on social media activity discovered through employer monitoring, the employer must first:

Answer: Evaluate whether the activity constitutes protected concerted activity under the NLRA

Employers must evaluate whether social media activity involves protected concerted activity under the NLRA before taking disciplinary action, as doing so otherwise could be an unfair labor practice.

Under the FCRA's 'adverse action' process, when an employer intends to deny employment based on a background check report, the employer must first:

Answer: Provide a pre-adverse action notice with a copy of the report and Summary of Consumer Rights

The FCRA requires a two-step adverse action process: a pre-adverse action notice with the consumer report and Summary of Rights, followed by a final adverse action notice after a reasonable waiting period.

GPS tracking installed on an employee-owned personal vehicle used for work is:

Answer: Generally impermissible without the employee's explicit consent

Tracking employee-owned vehicles raises significant privacy concerns, and most jurisdictions require explicit employee consent; employers have broader latitude with company-owned vehicles.

Which privacy principle best describes the obligation to collect only the employee data strictly necessary for legitimate business purposes?

Answer: Data minimization

The data minimization principle requires employers to collect only the personal data that is necessary for specified, legitimate business purposes, limiting unnecessary privacy intrusions.