Bloomberg Law
Free Newsletter Sign Up
Bloomberg Law
Advanced Search Go
Free Newsletter Sign Up

As Offices Reopen, State Laws Thread Worker Privacy and Safety

July 21, 2021, 9:11 AM

Employers preparing to welcome workers back to the office are navigating a hodgepodge of new state employment laws and pending legislation catalyzed by the Covid-19 pandemic as legislators walk the line between maintaining employee safety and privacy.

Hawaii, Montana, and Oregon are among those that passed laws weighing more heavily on the side of maintaining worker privacy during the pandemic. They seek to set guardrails for employers tracking the location of workers or other personal data for contact tracing, or in the case of Montana, to prevent employers from mandating Covid-19 vaccines for their workforce.

Even before the coronavirus slammed into workplaces across the country, legislatures were addressing how to safeguard employee privacy across industries, with states such as Illinois and California implementing sweeping policies. The pandemic, however, raised novel—and complex—issues for businesses, and sparked a range of state legislative proposals that create uncertainty for employers trying to ensure a safe work environment, particularly for those operating in multiple states.

“This idea that people have a right to maintain privacy to important health information, like their Covid vaccine status, is an emerging flash point that we’re seeing a lot of movement on,” said A. Klair Fitzpatrick, a partner with Morgan, Lewis & Bockius LLP who counsels employers on workplace matters.

Vaccine mandates too have emerged as a combustible issue for state legislators grappling with whether to permit or prohibit requirements for returning to public institutions and workplaces. Cases have already been brought by hospital workers in Texas and university students in Indiana bristling at the notion of forced inoculation.

Employee-Tracking Restrictions

Among the new state privacy measures is a Hawaii law that took effect this month blocking employers from requiring employees to download a location-tracking app onto their personal mobile devices, while allowing workers to sue their employers over such violations.

The Hawaii law does, however, include a carveout permitting employers to require their workers to download such an app on a company-owned mobile device.

Employers have long eyed location-tracking apps as a way to keep tabs on employee interactions, but up until the pandemic attorneys advised against such measures.

Laws pre-dating the pandemic limit employers tracking their workers’ movements in California, Connecticut, Delaware, and Texas, but traditionally with a focus on vehicle tracking, said Danielle Vanderzanden, an attorney at Ogletree, Deakins, Nash, Smoak & Stewart PC in Boston who co-chairs the firm’s cybersecurity and privacy practice. The contact-tracing technologies that businesses and public health authorities have adopted to slow the spread of Covid-19 have put a new spotlight on the issue, she said.

The privacy-focused policies are catching up to how much data is being collected today, said Elizabeth Stork, an associate with Reavis Page Jump LLP.

The new Oregon law also addresses privacy concerns around contact tracing, setting rules for any entity that collects or uses individuals’ personal data, including location-tracking data. The measure requires that location-tracking be done only with consent and limits the ways the data can be used. It’s designed as a temporary law specific to the Covid-19 pandemic and is set to expire 270 days after Oregon’s state of emergency declaration ends.

Highlighting the tension between worker privacy and safety concerns, Washington Gov. Jay Inslee (D) in May vetoed a bill that would have limited the collection and use of personal health data, out of concern that it would inhibit companies’ virus-control efforts.

“There’s an interest in privacy, but there’s also an interest in health and safety,” Stork said of the laws generally.

Lee Adler, a labor law and civil rights practitioner who teaches at Cornell University, said he doesn’t believe there’s a significant effort to protect worker privacy by employers and legislators.

“Worker privacy is, in my opinion, protected when workers in a consolidated, concerted, unified way, push back on whatever efforts employers are doing to monitor them,” he said. “I don’t think that employers or legislators have, all of a sudden, developed a kind of respect for employee privacy—but rather, I see that any recent interest around employee privacy is taking place against the backdrop of the clash between public health and privacy.”

VIDEO: We answer the question on the minds of CEOs, in-house lawyers, and rank and file employees - can employers make their employees take the vaccine?

Limiting Vaccine Mandates

Many states also have considered limiting or banning vaccine mandates as an entry requirement for schools, government properties, or businesses, though most legislatures so far have stopped short of barring workplace vaccine mandates.

That includes Florida, where Gov. Ron DeSantis has been a vocal opponent of vaccine passports and has sparred with the cruise industry over its desire to require Covid-19 vaccines for passengers. The state’s new law bars passport requirements imposed by a government agency or by a business on its customers, but doesn’t restrict workplace mandates.

In neighboring Georgia, an order by Gov. Brian Kemp (R) prevented any state or local government from establishing a vaccine passport program and blocked the use of the state immunization registry for enforcement of a private-sector mandate—but it too stopped short of outright barring workplace vaccine requirements.

Stork said employers operating in states that have enacted some form of a vaccine passport ban should be aware that they could go further and should monitor for workplace developments.

“It’s something to look out for,” she said.

Montana is an exception to this rule, having enacted a broad ban on vaccine passport requirements that also blocks workplace vaccine mandates. Republican state officials in Idaho and Oklahoma have renewed calls recently for their legislatures to also ban workplace vaccine mandates, in response to news in those states about large hospital systems requiring their staff to get vaccinated.

“Older case law seems to favor public health requirements and even mandates, but we are in a different political and legal environment today making this clash more critically uncertain for employers and employees,” Cornell’s Adler said.

Employers have to be nimble, Stork said.

“We always advise clients that employment law is an area of law that changes rapidly, and I think it’s been changing even more rapidly,” she said.

To contact the reporters on this story: Paige Smith in Washington at; Chris Marr in Atlanta at

To contact the editors responsible for this story: Andrew Harris at; Jay-Anne B. Casuga at