2023 Could Be the Year of HR Privacy

Comprehensive privacy measures have been proposed in 11 states already this year in the opening salvo of state-level privacy developments.  In a reversal of last year’s pattern, several of the proposals would cover HR data, including in Mississippi (SB 280), Oklahoma (HB 1030), and New York (S02277).

In general, such bills would grant employees, applicants, and contractors the rights to know, correct, and delete their personal information held by an employer, or by the employer’s vendor on the employer’s behalf.

There are many legitimate uses of data in the workforce to improve the employee value proposition, comply with legal mandates, and complete core tasks such as issuing pay checks and administering benefits. The bills were generally designed with consumers—not employees—in mind, and thus compliance will require special consideration by employers. For starters, companies will need to beef up data mapping, train HR and legal teams to handle employee requests, develop policies and procedures around such requests, and install verification processes to ensure information is provided to individuals who have a right to it.

In our recent letter to the 118^th Congress, HR policy noted, “Large employers seek to maintain a culture of trust in the workplace while providing leading wages, benefits, and a safe work environment. Toward these ends, employers collect and process information about workers that is essential for issuing pay checks, administering benefits—such as health insurance and paid leave—and withholding taxes. As Congress works on consumer privacy legislation, we encourage members to consider the inherent differences between employment-related and consumer data. Any federal consumer privacy legislation must be clear in its scope—focused on consumers.” 

Has this ship sailed? Last year, California legislators failed to extend an exemption of HR data from most of the provisions of its consumer-focused privacy law. As a result, the full suite of privacy rights granted under the California Consumer Privacy Act (CCPA) now applies to employees, job applicants, and contractors who are residents of California. 

Looking ahead: By the end of the year, we could see several additional states enact measures that cover HR data. This will place the impetus on the business community to determine whether it should continue to advocate against the inclusion of HR data in such bills—or opt for federal legislation tailored to HR data that would provide one nationwide standard.