KMK Law Management Rights Blog

As the COVID-19 threat lingers and businesses look for ways to protect their employees, there has been a lot of talk about contact tracing in the workplace. As the name suggests, contact tracing is a process of determining who an infected individual has had contact with and possibly exposed to a disease. This is not a new process and in the past has been done by interviewing people to create lists of exposed individuals who could be warned or isolated. With modern technology, there are a lot more options, some of which employers are considering using in the workplace.

The primary high tech options for contact tracing are smart phone apps and wearable technology although video monitoring is also a possibility combined with facial recognition technology and remote temperature checks. Tracking devices and smartphones may utilize GPS, Wi-Fi, Bluetooth or RFID technology. Most approaches utilize technology to keep a record of the instances of close proximity (e.g. within six feet) between employees over a certain period of time, e.g. during a shift. This data is stored for some period of time and can be searched for contacts if an employee contracts COVID-19. The data can be collected anonymously by using assigned identification numbers for employees. Most systems rely on employees self reporting a diagnosis so their contacts can be mapped during the period when they may have exposed other employees.

Each specific method of contact tracing raises different issues depending on how it is used in the workplace. Of initial concern are privacy torts that center on the employee’s reasonable expectation of privacy in the workplace and elsewhere. While monitoring in work areas is probably not an issue, monitoring or tracking restrooms, visits to medical personnel and off duty time could raise issues. Communication with employees regarding the employer’s program is critical in this area.

The ADA is probably not an issue given that the EEOC has declared COVID-19 a direct threat and authorized testing in the workplace. However, consideration should be given to what groups of employees are to be monitored to avoid discrimination claims. For example, monitoring only those in certain higher risk groups, e.g. over 60 years old, could be problematic. 

Perhaps the biggest concern are the wide variety of state laws that may be implicated by contact tracing.  For example, California’s Consumer Privacy Act (CCPA) regulates personal information, including biometric data such as: “physiological, biological or behavioral characteristics, including … DNA[,] that can be used … to establish individual identity,” including “imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.” Obviously, this could be implicated depending on the tracking method used.  Although the CCPA contains an exemption for employee information, employers still must provide California residents with a notice of the personal information collected along with the business and commercial purposes for such collection. In this context, that means that employers that deploy contact tracing apps in California will be required to provide disclosures to California employees. On another note, both California and Illinois laws require reimbursement for any utilization of employees’ mobile phones so this would be an issue if a smartphone app approach is used.

Additionally, contact tracing apps could be collecting personal information that is potentially subject to state data breach notification laws. Although these laws differ between jurisdictions, they generally require entities to notify individuals if there is unauthorized acquisition of personal information, which is usually defined as an individual’s first name or first initial and last name combined with a specified data element. Some of these laws cover medical information and/or biometric information. Similarly, a number of states have adopted specific biometric privacy laws that, depending on what is collected by the contact-tracing app, could be implicated. Finally, several state laws, e.g. California, Hawaii, Louisiana, Minnesota, New Hampshire, North Carolina and Virginia, prohibit the use of electronic tracking devices to determine the location or movement of a person without consent.

The takeaway is that tracking technologies can be utilized but there are a lot of issues to consider depending on the specific approach, including for example:

• What method will be used, e.g. app, wearable, other;
• What specific data will be collected;
• Who will be monitored;
• How will data be stored, protected, who will have access;
• How long will data be maintained; 
• What information will be provided to employees; what training;
• Is participation mandatory or voluntary;
• What will be done to address employee failure/refusal to comply with tracking;
• Will data be shared outside the company, e.g. with health agencies;
• What state laws apply in jurisdictions where tracking will occur.

If you are considering the use of contact tracing in the workplace, contact any member of our Labor & Employment Group, or the KMK Law Coronavirus (COVID-19) Response Team for further assistance.