Imagine that your General Counsel asks you for a very brief overview of what she needs to know - and worry about - related to HR technology and HR data management. If your GC is like most we know, she has way too much on her plate, no time to become an expert on most things, and a need to know how to keep your organization out of trouble. Here’s our take on what you can tell and show your GC to help her spot HR technology and data management issues that might create legal liability.
Identify the technology in use. This may sound obvious, but we find that company lawyers may have no idea what HR technology is in use in their organization. Do you use a payroll service that accesses company data? Monitor employees’ locations through badges or smartphone apps? Use video surveillance in the workplace? Use software that locates prospective hires through social media? All of these (and any of the thousands of technologies available to HR departments) can create legal issues. Your GC doesn’t need to know the details, but does need a basic description of what technology is in use and how it is being used.
Identify and assemble contracts. Many forms of HR technology are purchased through contracts. The contract may cover hardware, software, equipment, or services. It might be called a “Purchase Agreement” or a “Vendor Agreement” or a “Service Proposal,” but if it contains promises from either the seller or the purchaser, it has legal implications and your GC needs to know about it. Don’t assume that an agreement entered into with a vendor of HR technology will protect your company in the event of trouble. In fact, many of the agreements we’ve seen shift the legal liability for harm caused by the product or service to the purchaser. If, for example, your employees’ personally identifiable information is hacked while in the hands of your payroll service, the contract you have with the payroll service may say that any damage caused by the hack is the employer’s problem and not the responsibility of the payroll service vendor. Purchasers of HR technology may or may not be able to negotiate with vendors for better terms than that, but company lawyers should, at the very least, know what the contracts with their vendors say about liability for any harm caused by the vendors’ products and services.
Identify where information is kept. HR data is often kept in many different locations or systems within an employer’s organization. Your GC doesn’t need to know the details of what is kept where, but does need to be able to access all HR data if necessary in response to a legal requirement, lawsuit, government investigation, or management request. If, for example, your organization is in a state that gives employees a statutory right to access their personnel records, your GC will have responsibility for ensuring that an access request is responded to properly. It will be much easier to do that if you have provided the GC with an accurate, up-to-date summary of the location of all HR information kept in electronic form.
Identify risks. Managing risk is what a GC’s job is all about. HR technology can be great, and the ability to electronically store, analyze and manipulate HR data can be enormously helpful to organizations of any size or type. As we have pointed out many times, however, HR technology is too often created and implemented without enough attention to the legal risks it may create. Social media-based recruiting may result in discriminatory hiring. Electronic storage and transfer of confidential HR information may result in data breaches (and all the potential liability that comes with them). Surveillance or monitoring of employees may lead to claims of invasion of privacy or labor law violations. In any given situation, the risk involved in using the technology or managing the data may be worth taking, and often, the risk can be reduced or eliminated through careful implementation. Give your GC a chance to effectively manage the risks associated with HR technology and HR data by making sure that she understands them.
