New Data Privacy Challenges for HR Executives, Daily Journal

By Katherine Catlos, KD Partner, Chief Diversity & Inclusion Officer, and Jean Liu, attorney in the KD Chicago office
Daily Journal – July 10, 2019

Unforgettable, That’s what you are, Unforgettable, Though near or far. — “Unforgettable”

Nat King Cole’s words never applied with more force than in today’s digital world. While not crooning about romance in 1890, Samuel Warren and Louis Brandeis published, “The Right to Privacy,” in the Harvard Law Review, defining privacy as the “right to be left alone.” The parallel notion of “the right to be forgotten,” or in French, “le droit à l’oubli,” derives from European ideals. In 2014, the European Court of Justice solidified the “right to be forgotten” as a human right. See Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González. This right includes the right to demand deletion of personal data, and it has been defined as “the right to silence on past events in life that are no longer occurring.” (Pino, G. (2000). ”The right to personal identity in Italian private law: Constitutional interpretation and judge-made rights.” In: M. Van Hoecke; F. Ost (eds.). The harmonization of private law in Europe (pp. 225-237). Oxford: Hart Publishing. p. 237.)

In the employment context under U.S. law, however, the right to be forgotten poses difficulties for employers. California has undertaken an ambitious initiative designed to enhance privacy protections for consumers. The new California Consumer Protection Act, effective Jan. 1, 2020 (with potential retroactive provisions), opens a new privacy frontier.

Human resource professionals already address employment privacy rules in the context of consumer credit and criminal background checks, HIPAA protections and drug testing, among others. But under the CCPA, “consumers” can now request information about collected personal data as well as its deletion and the right to opt out of its sale. Cal. Civ. Code Sections 1798.100, 1798.105. As written, “consumers” includes employees who might seek to have data deleted that is necessary for an employer’s operations, such as maintaining personnel files, and as defined by other laws. It is a conundrum for employers.

Read more at the full article.