Now that Thanksgiving is in the past, it’s time to look forward to the future.

Well, not before getting a recap of everything that transpired in employment law in the last year. Or at least everything that we can fit in an hour long seminar.

The webinar that broke attendance records last year is back again on December 4, 2018 at noon ET.

This year, five employment law bloggers are presenting the “Best-Ever Year-End Employment Law Review that Five Employment Law Bloggers Have Ever Presented” webinar.  Registration is just $25 and it’s eligible for CLE/SHRM/HRCI credit.

All that is needed is to sign up here. 

The presenters this year are:

  • Robin Shea, Constangy, Brooks, Smith & Prophete
  • Kate Bischoff, tHRive Law & Consulting
  • Jon Hyman, Meyers Roman
  • Eric Meyer, FisherBroyles
  • Jeff Nowak, Franczek Radelet
  • Daniel Schwartz, Shipman & Goodwin

Among the topics that you can surely expect to hear about: #MeToo, LGBT discrimination, Data Privacy and Security, Wage & Hour issues, and FMLA.

Be sure to sign up; it promises to be the best ever. (At least until next year.)

Do you remember when the Target store data breach made news? This was not that long ago, and yet, five years later we’ve arguably become immune to the news.

Take Facebook’s latest snafu — 50 million accounts compromised.  And yet, it hardly made headlines for a 24 hour period.

Heck, even the U.S. State Department has had personal information about its employees breached in the last month — though “only” one percent may have been affected – so…yawn.

Have we become that immune to such breaches at this point?  Perhaps.

But that doesn’t mean that employers can let their guard down. Indeed, I would argue that new laws and regulations (including one in California) are making the job of employers even more challenging.

I’ll be talking about all of this at my firm’s upcoming Labor & Employment Seminar later this month with my colleague Ashley Marshall.  It’s scheduled for October 25th at the Hartford Marriott.

Here’s the formal program:

If You Collect It, You Must Protect It: Dealing with Employee Data Privacy Issues
Presenters: Daniel A. Schwartz and Ashley L. Marshall

Cyberattacks are on the rise and employers must take the necessary steps to protect employee data.  This session will address data protection worries of human resources and review state and federal laws and regulations pertaining to workplace privacy, including the Personnel Files Act, GDPR, California statutes, and HIPAA complaint releases. 

We’ve got several other topics being tackled too.  We are probably only a few days away from selling out so be sure to sign up for this complimentary seminar today.

Are you ready for blockchain’s impact in employment law?

This seems to be the new equivalent to the buzz a decade ago that social media was going to change the world (it kinda did).

Perhaps bigger.

At this point in the post, there are probably two reactions: 1) Tell me more!; and 2) What are you even TALKING about?

So, let’s start with the second question first — what is the “blockchain”? There are many discussions, but one recent ABA article had this to say:

Blockchain is commonly defined as a decentralized digital ledger in which transactions are recorded chronologically and publicly. In its infancy stages, blockchain was the mechanism that tracked cryptocurrencies such as Bitcoin. However, as the technology evolved, variations such as private, permissioned, and consortium blockchains have emerged. Ultimately, blockchain technology can facilitate many types of business transactions.

Another article by a lawyer described the hype as follows:

By design, blockchains are inherently resistant to modification of the data—once recorded, the data in a block cannot be altered retroactively without obviously corrupting later blocks, which depend on the original data from the earlier block as part of the hash. It can take enormous time and energy to go back and rehash subsequent blocks to try to hide the earlier alteration, and in the meantime new blocks are being added to the chain. This makes a blockchain extremely resistant to modification.

The applications of the blockchain are still in the infancy phase.  (The hype cycle for blockchain is in the “peak of inflated expectations” period and it projects that we are still 5-10 years off from maturity.) And thus, any discussion regarding its implications in the employment law arena are necessarily speculative.

But let the speculation begin.

For example, one human resources expert suggested some uses for this technology as follows:

  • It may make the concept of a “self-sovereign identity” for employees a reality, making verification of past employment or certifications easier and more secure. (Or this breathless article about “Blockchain-based CVs Could Change Employment Forever.“)
  • Potentially, you could run payroll off the blockchain to make those transactions more secure.
  • It could also be used to help employers keep confidential health information and transmit it more easily.

It only takes some imagination to go beyond that as well.

  • “Smart” employment law contracts, in which transactions automatically happen, could be introduced into the workplace.
  • Or the blockchain could be used to secure IP rights to company products, thereby avoiding the confusion as to whether the employee or the employer “owns” such rights.

Blockchain is still very much developing and I wouldn’t be surprised if this article seemed a bit dated a few years from now.  After all, who would’ve thought you could order a car (Uber) inside a social messaging app (Facebook) just a decade ago?

But employers and their attorneys who stay up on technology should understand the potential implications for blockchain in the workplace and be ready to adapt once the technology becomes mature enough to use.  From my perspective, there’s still time to keep reading about this developing technology; the time for action is still yet to come.

With a weekend of football championships behind us, this post tackles the privacy developments that employers here in Connecticut need to run down.  Indeed, while I could just pass off two recent posts from my colleagues, it’s worth going through a progression of options.

One development is for the U.S. “patriots”, while another one lets you fly like an eagle to Europe to understand the implications that an EU regulation can have on US employers.

Since my beloved New York football giants were out of it since week one, I’m going to just quarterback what you need to know and, for the sake of everyone, put the football puns on the sideline for the rest of the post.

First up, the Connecticut Supreme Court last week recognized a private right of action that patients have against their doctors for unauthorized disclosure of confidential information obtained in the course of that relationship.”  My colleagues in the Health Law group have a detailed post here. As noted by my partners:

This case is significant because it provides yet another avenue by which physicians may be held liable for violating HIPAA. This is because the Court decided in 2014 that “HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to such claims arising from allegations of negligence in the disclosure of patients’ medical records …” Thus, if physicians owe a duty of confidentiality to their patients and violating HIPAA is found to breach that duty, the Court held that patients now have the right to sue their physician for damages caused by a violation of HIPAA. Whether a patient will be successful in such a lawsuit remains to be seen.

The case serves as a reminder to health care professionals and, perhaps just as importantly, to their staff to protect confidential health information to comply with the law and avoid legal liability from patients.  If you do any work in the health care area, the decision and the tips flowing from the case are a must read.

On a broader scale, Connecticut employers that do business in Europe or do business from EU citizens should also take note of new regulations coming into effect in late May 2018.  Again, my colleagues posted about this on the School Law blog, but it’s worth a look.

So what are we talking about? As my colleagues noted:

The requirements of the European Union (“EU”) General Data Protection Regulation (“GDPR”) come into effect on May 25, 2018.   These regulations promise to usher in sweeping changes to the way institutions, companies, and other organizations collect and handle the personal data of EU residents.

The GDPR is a holistic set of data privacy requirements that address the entire life cycle of collection, use, and disclosure of the “personal data” of EU residents. While we anticipate jurisdictional challenges that may someday limit the GDPR’s reach outside of the EU, the law as currently drafted purports to affect institutions of higher education, companies, and other organizations, such as boarding schools, worldwide. This means that the GDPR will affect not only institutions that do business with or operate inside of the EU, but will also affect institutions in the United States that processes the personal data of persons residing in the EU.

For more on the subject, check out this comprehensive post from my fellow law partners.  

Privacy law has increasing implications for employers and employees.  Employers need to ensure proper training in these areas to ensure compliance.

Yesterday, I had the opportunity to speak to the IASA Northeastern Conference on a favorite topic of mine of late — Privacy and Data Breaches in the workplace.

Of course, that sounds kinda of boring.

So my presentation is actually called the title of this post: “The Rise of Smartphone Fueled, Social Media Addicted Workplace Zombies.”

Much catchier right?

Speaking before the Insurance Accounting & Systems Association (IASA) Northeastern Chapter at their 54th Annual Regional Conference was great fun though.

In my talk, I highlighted items like Business E-mail Compromise scams, Ransomware, and yes, even workplace zombies.

What do I mean by that? Well, too many of us (including me at times) stare at our phones and sometimes respond to e-mails or click without thinking.  (Think Before You Click would make the name of a good book; fortunately, I wrote a chapter in that very book a while back.)

Protecting workplace data IS about thinking. It’s about protecting personnel files, or benefit information, or retirement plan data.  It’s about protecting trade secrets or just plain confidential information.

It’s about building a CULTURE of data privacy. Where employees buy in that protecting data is a core value and where employees are REWARDED for good data practices while enforcement (with a bit of punishment where needed) is encouraged by all.

It’s not the most exciting topic to be sure but everyone wants to be protected from the zombies, right?

I gave a similar talk early this summer as keynote lunch speaker for the ADNET Worksmart conference and it worked so well, word got around.  Maybe data privacy can be interesting after all.

My thanks to IASA for the invitation and opportunity to speak to the group yesterday.

A few weeks back, I did a post about having our personal data hacked.

What if the hacker was you?

Yes you — the attorney, the employer, or someone else who has confidential information.

I was recently reviewing the online court file of an employment case in federal court for a recent blog post.  It’s available for anyone to see.

(You might be asking, Why? Because it’s always interesting to see other filings and the way cases turn out. Ok, it’s always interesting TO ME at least….).

In looking over some of the court-filed documents, I came across the college transcript of the employee/plaintiff.  It was filed by the attorney as evidence in the case.

Some newer transcripts don’t have some confidential information. But this college transcript was old school: It still contained the Social Security number of the employee AND his date of birth.

And just like that, the attorney has opened up the employee to hacking.

In case you are wondering, yes, there are rules in federal court about this. For example, Local Rule 5(e)8 requires that a party filing a document that will become publicly available shall redact Social Security numbers, financial account numbers, dates of birth and names of minor children.

Attorneys who represent employers should beware that the same rule applies to filings you submit as well.

Beyond court rules, employers have an independent legal obligations to protect Social Security numbers of its employees as well.

And so, in this age of data, it’s up to us all — attorneys and employers — to take the responsibility of protecting data seriously.

You don’t want to hack your own client or employee.

“Technology is a wonderful thing but it’s scary when it’s weaponized against you.”

The first sign that my wife’s identity and my own were under attack came innocently enough.

It was an e-mail alert that we get from time to time from Comcast, so innocent that I almost ignored it.  But it said our password had been changed.  When we tried to log-in to download e-mail, the system indicated the password was incorrect.

“That’s weird”, we thought.

I mean, we have two factor authentication on it so that if someone DOES try to change the password, shouldn’t they need a code?

So I called Comcast and was assured repeated that our password wasn’t changed and our account was not compromised.

They said it was a phishing exercise and the e-mails were fake too. As for the account access, they said that someone may have just tried to access it but they were unsuccessful.

Comcast easily reset the password for me and since two factor authentication wasn’t invoked, it seemed like something unusual but nothing beyond that.

The second attack happened the same way.  This time, we knew something was most definitely wrong.

The war over our identities was now on, though I didn’t realize at the time how outmatched we were in our weaponry.

We were able to regain control of the account in just a few minutes with resetting the password on my side (two can play that game, so I thought).

And then I placed another call to Comcast for help.

After an hour on the phone and a reset password and security question, I was told again that there’s nothing otherwise suspicious in my account but they’ll keep “looking”.  No other outward sign of hacking.

Still, our credit cards were quiet and we changed some more passwords just in case.  What were they after?

The hacker’s next salvo though had already been launched and was operating secretly.

Later that evening, I received a notice from UPS that night that we had a package coming from Amazon, but, well, let’s just say that we are frequent Prime users and that didn’t raise any suspicions to be getting another one from them.

But by mid-morning the next day, still yet another e-mail arrived. Again, from UPS, but this time saying that the package we were expecting would be held at the Watertown customer care center “at the customer’s request”.

(Why, you might ask, is UPS sending me e-mails? It turns out, I set up an alert with UPS to send me an a separate e-mail account anytime a package for our hours is scheduled for delivery. As it turns out, this last countermeasure helped stem the tide, though I didn’t know it at the time)

Still, when we searched our Amazon account for the package, nothing showed up.  There was a package from over the summer that never turned up and showed it was “out for delivery”. Could that be it? Or was it a gift?

As “luck” happens, I was driving past the Watertown care center by late afternoon and decided to swing by.  A big box awaited.  My curiosity was piqued – What’s In The Box?

I open it up at the UPS facility.

Not one, but TWO high-end MacBook Pros.

Wow.  Was not expecting THAT.  Or perhaps I was.

A call to the local Watertown police was met with a response of a department that has seen one too many of these — “you should just contact your hometown police”.

A call to Amazon revealed that our account had been accessed, an Amazon store card opened up, and the purchase “hidden” as if it were a “gift” to ourselves that we didn’t want spoiled before its arrival.  Amazon set up for the computers to be returned at no charge and the card wiped clean.

At least we could claim victory in stopping the shipment, right?

Well, as we were also told by police later, sometimes hackers just send something to a customer care center and don’t pick it up just to see if the hacked worked.  If it does, then the sky’s the limit on the next go around.

But still, were we done? Had we hacked the hackers by seeing this UPS alert we weren’t suppose to see?

Well, it turns out the hackers had more tricks up their sleeve.

Upon a third call to Comcast, the security representative reviewed our account still further and he found three things:

  1. The hacker set up an “e-mail forwarding” so that a copy of EVERY single e-mail received would also be sent to the hacker.  Yes, even the ones we were sending to each other about the hacker were being read too.
  2. The hacker also set up “selective call forwarding”, an option I didn’t even know existed. Apparently, you can have up to a dozen phone numbers you choose get directly forwarded to another phone number.  As it turns out, the hacker knew the numbers that Amazon and the card verification service would call on and conveniently forwarded those calls directly to his own mobile number on a burner phone.
  3. Looking at phone logs, we could actually see that the hacker had taken a call from Amazon.  A-ha.

All done, right?

Well no. I continued to scour the account on my phone and found yet another devious hack in my “options”. The hacker had set up a series of filters (which didn’t have a title, so they showed up as “”) that forwarded e-mails from Amazon and Amazon’s card carrier directly to the hacker’s e-mail.  Delete, delete, delete.

Since then, police have been contacted. The Amazon card cancelled and account locked for a few days. Package returned. Fraud alerts placed. ID protection re-upped. Passwords being changed. Sleep lost.

And replaced with a sort of paranoia about what else is lurking.

While we can claim victory in preventing the MacBook Pros from falling into criminal hands, at what cost? The damage is already done. We may have foiled the crime, but the identity is compromised and we now need to be vigilant for other account pop-ups. The victory feels empty.

We have to instead hope the hacker will lose interest, knowing that we know about the scam and have alerted police.

This feeling of hopelessness doesn’t have to be that way.

Indeed, the irony of the situation isn’t lost on me. I’m part of my firm’s Privacy and Data Security Team and routinely give others advice with how to protect themselves.

And yet, even with the steps we took, we still couldn’t stop the attack. Here is where government and businesses have a role to play in helping to protect our identities.

For example, everytime I called Comcast to complain, I had to “verify” our info; in doing so, I had to provide the last four of her social security number and our address — the very information we KNEW was already compromised.

We have to do more. Here are five small steps to start:

  1. Congress should hold hearings to hear from security professionals about the best ways stores and utilities can protect customer information.  And then work with businesses to create a common standard.  Our current system is broken.  Health care information is treated as important; our identities need to be treated with similar care.
  2. Businesses that have sensitive customer information should offer real two-factor authentication, not offer work arounds that just open up a loophole. In Comcast’s case, resetting the password allows you to bypass the two factor authentication by answering a simple “security” question.
  3. Password management is broken.  Yes, I can set up some password managers, but using multiple devices and computers makes it difficult to have consistency.  Too many of us need to use similar passwords on websites because there is no one common log-in system. A new type of authentication system might be a start (though I acknowledge it might also then create a target for hacking too — see Equifax).
  4. After a hack, the government ought to mandate easy, free tools that people can use to help clean up their own identities. If we can get a free credit report once a year, can’t the government mandate that credit agencies assist you in cleaning up your identity for free?
  5. The police are woefully understaffed to deal with an international problem.  The only means that an ordinary person can use is their local police, but even they admit that they’re still playing catch up.  More consistent training and better tools for our police can at least start to make a dent on this.

Which gets me back to the first sentence here — which was a comment a friend shared with me upon learning of the hacking.

“Technology is a wonderful thing but it’s scary when it’s weaponized against you.”

Yes, my friend. It definitely is.

lock1Last night I had the opportunity to speak to the Colonial Total Rewards Association on the topic of Data Privacy and HR.  I titled the presentation “Is Your HR Data Going Rogue” and really focused on the role that Human Resources professionals should play in ensuring that company data is secured.

For those who have been following the blog for a while, you know that I’ve spoken a bit about this before (see some posts here and here).

Lest you think, this could NEVER happen at your company, the headlines from the last few weeks show otherwise. Company after company keep reporting major  data breaches — in part due to a W-2 scam that keeps claiming victims (see here, here, here and here if you’re not convinced).

Even technology companies are not immune. My favorite blurb from the last month was the following:

On Thursday, March 16, the CEO of Defense Point Security, LLC — a Virginia company that bills itself as “the choice provider of cyber security services to the federal government” — told all employees that their W-2 tax data was handed directly to fraudsters after someone inside the company got caught in a phisher’s net.

Oops.

So if even tech companies are victims of data breaches, is there any hope for the rest of us? Well, yes. It’s not easy but there are several steps that employers can take.

  1. Learn – This is NOT simply IT’s role; rather, HR professionals should have a key role at the table in discussing a company’s data privacy culture and practice.  And the first step in that is that HR should learn the basics of data privacy.
  2. Assess – HR has access to lots of data; where is it and who has access?  Where are you “leaking” data when it comes to your employees?
  3. Develop – Develop policies and your data privacy program; and develop the teams of people that will respond in the event of a data breach
  4. Educate – Data privacy and protection ought to be part of sustained training program, just like anti-harassment training
  5. Monitor – Figure out risks and review areas; when breach happens, HR needs to be at table to discuss employee impact
  6. Inform – When (not if) if you have a data breach, inform those affected and gov’t officials and implement your data breach plan.

Once you’ve made it through, it’s time to start back at the beginning. Learn from your mistakes in a data breach and re-assess your vulnerabilities.

Data privacy and the need for companies to view it as a key part of your company’s culture should be an integral part of your employee onboarding and training.  My thanks again to CTRA for the invitation to speak to the group and the great conversation we had last night.

robertsWith the new year upon us, cyberthieves are once again attempting to prey on unwitting HR professionals, as my colleague William Roberts explained in an article last week for SHRM on phishing.

The scam goes like this. As an HR professional, you get an e-mail from your boss (or your boss’s boss) that seems legitimate…and urgent. Something like this:

I’m in the middle of a negotiation so won’t be available by cell or e-mail but I need you to send W-2s for the management team to our new accountants. You can e-mail them to [____________]. Needs to be done today. Sorry for the rush on this and please take this as an exception to normal protocol. Thanks. – Alan

It’s happened before.  Indeed, as Bill explained in the article:

“Alan was the chief financial officer,” said William J. Roberts, a Hartford, Conn.-based data privacy attorney with the law firm Shipman & Goodwin LLP. But in this case, it wasn’t Alan who was sending the e-mail. Despite the company’s policy prohibiting employees from sending sensitive documents through e-mail, a newly hired junior HR professional fell for the phishing scam and sent the W-2s to the cyberthief’s e-mail address.

That’s more than just an “Oops” moment.

Although the IRS is taking steps to help reduce this, the best defense is for HR professionals to be aware of this scam.  I previously discussed this back in March 2016 with a quick post but it’s worth looking at some of the tips presented in the SHRM article including:

  • Train employees on cybersecurity awareness. Many companies do not.
  • Use common sense and avoid making electronic requests for sensitive data. It’s not just an e-mail threat; phishing by text is also on the rise….
  • If you receive an e-mail from upper management, verify the request….

starrMy colleague Gary Starr returns today with a story worth reading about the need for employers to secure confidential information.  Although it is based on Massachusetts, the concepts it covers may have some carryover to employers elsewhere as well.  

Employers that maintain records of their employees and customers and allow employees have access to confidential information have long needed policies that not only secure the information, but ensure that employees who have been granted access to such information are complying with the corporate policies and are trustworthy.

An insurance agency in Massachusetts thought it had done everything right, but was sued for negligence in its retention of an employee that it thought was trustworthy, but was not.

An employee used her computer to access confidential information that she then gave to her boyfriend about the identity of a witness to a car accident in which the boyfriend had been involved with her car.  The boyfriend used that information to contact and threaten the witness.  The witness reported the threat to the police and ultimately the boyfriend and the employee pleaded guilty to witness intimidation and conspiracy.  After the police visited the employer to obtain information about the threat, which was traced back to the employee, the employer fired the employee.

That, however, did not end the tale.

The witness then sued the employer for failing to safeguard personal information, and for negligent retention and negligent supervision.  While the trial court dismissed the case, the appellate court has determined that the facts alleged are sufficient to go to trial.

Where did the employer go wrong?  The company had adopted a data security plan and policy that prohibited employees from accessing or using personal information for personal purposes.  The computer software even required employees, who wished to access the data base with confidential information, to agree to use the information for one of four limited purposes, all of which were business related.

Those were positive steps.

The problem arose because the unrestricted access did not stop the employee from reviewing information that had an impact on her personally.  The second failure had to do with an inadequate investigation of the employee’s background and simply taking the employees word about a weapons arrest that occurred during her employment in another state.

The employee told her boss that the arrest was a misunderstanding, that she was clearing it up, and subsequently said it was resolved.  The employer simply took her word for it.

What he would have discovered with a very simple inquiry was that there were serious issues with her honesty and fitness for accessing other people’s personal information.  The company could have learned that she was traveling with her boyfriend when they were stopped for speeding and that she was arrested for having two semi-automatic guns concealed in her purse, one had the serial numbers filed off and the other was stolen.  She also had a half-mask and police scanner.  After her arrest, she told the company that there had been a misunderstanding as the weapons belonged to her boyfriend, that she didn’t know anything about them and that she was exonerated.

Her story was not true, but her account itself should have raised questions about her having access to personal information.

The court said that the company had a duty to protect the confidential information and that it was foreseeable that the employee could access information and use it for personal gain.  The company had an obligation to investigate the employee’s continuing fitness after the arrest.  The court said that a jury could decide that the failure to take action under these circumstances was unreasonable as the company knew about the weapons charge and could have learned of her lies and her willingness to commit a crime with her boyfriend.  The company did not take sufficient steps to limit the risk of harm to those whose personal information its employees could access.

There are steps to take to avoid this problem.  After an employee is hired, that does not end the need to be vigilant about their fitness for the job.  When information comes to light that may raise questions about the actions of an employee, an employer cannot simply take his/her word for what occurred.  It must take affirmative steps to explore what the underlying issue is, analyze the employee’s story, and assess the risk the employee poses if access to confidential information is abused or if other employees and the public may be put at risk.