HR Data Security: HR’s Role in Employee Privacy & Data Protection

With an increase in data breaches and cybersecurity attacks, organizations are on high alert (or should be if they aren’t already) in terms of employee privacy and data protection. HR departments are central to ensuring that responsible practices are implemented to protect their employees’ data.

This piece covers what employee privacy and data protection are, misconceptions about the topic, the costs of a data breach, global privacy laws, and what HR can do to protect employee data throughout the life cycle.

Employee Privacy & Data Protection Defined

As the phrase implies, employee privacy and data protection are when organizations take measures to ensure their employees’ personal data is safely stored and only accessed or released with the permission of the employee—their personal employee data should not be released without their consent. Personal data includes home and cell phone numbers, home and mailing addresses, social security numbers, birth dates, bank account information, number of dependents, medical history, and more. In the wrong hands, this type of information can be used illegally and cause a lot of problems for the employee.

Misconceptions about Employee Data

Employers have several rights to consider when it comes to how they can use employee data. Oftentimes, there are many misconceptions the employer about what they can and cannot do with an employee’s data. Privacy and data security firm security highlights the following four common misconceptions by employers when it comes to employee data:

1.         Employers believe that they do not need to notify employees before processing data. However, most global privacy laws require employers to notify their employees on every instance of data collection and data processing.

2.         Employers believe that they have an unrestricted right to monitor their employees for security and productivity reasons. However, most global privacy laws allow monitoring of employees only under certain conditions and as long as such monitoring is not unreasonably intrusive to employees.

3.         For an employer sitting in the US, they believe that laws from other countries do not apply to them. This is incorrect, as laws such as the GDPR may also apply in the US if, for example, they are processing data belonging to EU residents. Most global privacy laws have extraterritorial applications. Therefore, it is important for an organization to identify which privacy laws apply to them depending on their employees’ residencies, citizenships, place of work, or any other appropriate factors.

4.         Employers believe that a data breach will result in fines. This can be the case, but it depends on the severity of the breach and its impact. Apart from fines, employers might also be asked to provide further mitigation services to employees affected by the breach as well as overhaul or upgrade their security frameworks to ensure that the breach does not take place again.

The Costs of an Employee Data Breach

There have been several known data breaches in recent years. In the third quarter of 2022 alone, there were 15 million records exposed throughout the world due to data breaches, a 37% increase from the same quarter in 2020. Specific to personnel and employee records, Snapchat had a data breach that exposed the payroll information of 700 former and current employees—the breach was the result of an attacker appearing to be the CEO of the company, Evan Spiegel. In 2017, the City of Calgary in Canada experienced a breach that impacted over 3,700 of its employees, which lead to a $92.9 million lawsuit.

Employee data breaches are costly in several ways for both employees and employers. Employees must deal with the stress and aftermath of their personal details being accessed by unknown parties, which could lead to identity theft, lowering one’s credit, and more.

Employers have to deal with the costs directly associated with handling the breach, understanding how and why it happened, and doing their best to mitigate damages due to it. Additionally, employers have to deal with the fallout with their employees and consumers. Their reputation is negatively impacted and both groups tend to lose trust in the organization. For employees, the stress and lack of trust can also lead to lower morale and losing employees within the organization.

HR’s Role: Data Protection for the Employee Lifecycle

Human Resource departments need to be aware of the data security requirements and obligations throughout an employee’s lifecycle with the company, from the pre-hiring recruitment process to the employment tenure and finally, their post-tenure.

Pre-Hiring Recruitment Phase Data Protection Measures

During the pre-hire recruitment phase, organizations must be mindful of the following:

•            Applicants must be informed of what information will be collected and why.

•            Data collection should be specific to the job the candidate is applying for.

•            Background checks should only request required information to make an informed decision about the candidate’s history without being too intrusive.

•            Authorization forms need to be included for any documentation where third-party vendors might be pulling or using the candidate’s information.

•            In some areas, publicly available data can be used as part of the employment process, whereas in other areas, it cannot be, so it’s essential you know the employment and data privacy laws in your area and where you do business.

•            Unsuccessful job candidates’ information should only be stored if it’s relevant for them to be considered for a future open position.

Employment Phase Data Protection Measures

During the employment phase, organizations must be mindful of the following:

•            Many privacy laws and regulations require employers to let their employees know before any of their personal data is collected or processed.

•            Collection, processing, and retaining personal data should only be done for relevant reasons and as it pertains to the employee’s job function.

•            When monitoring employees of implementing privacy protection tools, the employee must be informed of such actions being taken, and the company must put measures in place to protect such monitoring.

•            Risk-based assessments, risk-mitigating tools, and appropriate security measures need to be in place by employers to protect their employees’ data.

•            Employee records need to be regularly updated by employers to reflect accurate and current information.

•            Employers need to review and communicate any third-party vendors’ privacy practices to protect employee data if they are accessing or processing it for any reason.

Post-Employment Phase Data Protection Measures

During the post-employment phase, after the employee has exited the company, organizations must be mindful of the following:

•            Employees must consent to their information being retained for the purpose of future open positions with the company.

•            Clear data retention policies and procedures need to be in place as to when an employee’s data will be deleted and must abide by local employment laws on such practices.

•            Employers don’t need to keep former employee info current and up-to-date, but they do have to provide a copy of an employee’s records to them upon request.

Global Laws Related to Employee Privacy and Data Protection

With the many types of data an organization holds on its current and former employees and job candidates, it’s vital that the organizations and their HR departments carefully consider the best route to protect such data. The numerous types of employee data, the increase in security breaches, and more have prompted many governments to implement legislation and regulations to protect employee data. Brazil, European Union, New Zealand, Singapore, and California in the United States are countries that have implemented such legislature.

Brazil - Lei Geral de Protecao de Dados (LGPD)

The Lei Geral de Protecao de Dados (LGPD) in Brazil covers the requirements of private and public organizations in terms of personal data to protect individual privacy rates in the country.

European Union - General Data Protection Regulation (GDPR)

The European Union’s General Data Protection Regulation (GDPR) treats consumers and employees equally to provide protection related to the processing of personal data.

New Zealand - New Zealand Privacy Act 2020

The New Zealand Privacy Act 2020 is a modernized version of the Privacy Act of 1993. The Act provides several safeguards and rights related to the processing of personal data and treats consumers and employees equally.

Singapore - Personal Data Protection Act 2012

The Singapore Personal Data Protection Act 2012 has two primary provisions, one of which focuses on Data Protection and the other focuses on the national Do Not Call Registry.

California in the United States - California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) requires data collection privacy notices and disclosures to be issued by employers and provides statutory damages of between $100 and $750 for the breach of personal information.

Next Steps for Improved Data Security

For companies that have outdated software or manual employee data security, it’s time to shift to updated and automated processes to help ensure your employee data is as secure as it can be. Conduct research to identify the best approaches and organizations you might want to work with that specialize in data security. Taking these steps is imperative to help mitigate risks and reduce costs associated with privacy and data breaches. The health of your organization and employees depends on it.