Levy Employment Law Blog

22

January, 2021

Even Small Employers Have Data Protection Requirements Under the NYS “Shield” Act

By Alexandra Lapes

New York employers responding to the pandemic may have overlooked data privacy requirements that took full effect in March 2020 as part of the Stop Hacks and Improve Electronic Data Security (“Shield”) Act.  The Shield Act requires any business handling the “private information” of New York residents to comply with broadened data breach notification requirements, and for the first time it sets specific standards covered businesses and employers should take to maintain reasonable data security safeguards.  The Act explicitly requires small employers to implement a data security program that contains reasonable administrative, technical, and physical safeguards, and to provide notice to affected individuals and proper authorities in the case of a data security breach.  The Act defines a small business as any person or business with less than 50 employees; less than three million dollars in annual revenue for the past three years; or less than five million dollars in year-end assets.

The type of “private information” held by organizations that may trigger the provisions of the Shield Act is defined broadly to include any of the following data elements:

  • social security number;
  • driver’s license number or non-driver identification card number;
  • account number;
  • credit or debit card number, in combination with any required security code, access code;
  • password or other information that would permit access to an individual’s financial account;
  • account number, credit or debit card number if the number could be used to access an individual’s financial account without additional identifying information;
  • biometric information; or
  • a username or e-mail address in combination with a password or security question and answer that would permit access to an online account.

If any one of those data elements is “accessed” or “acquired” by an unauthorized party and can be linked back to an individual’s “personal information,” meaning name, number, personal mark or other individual identifier, it falls under the Shield Act.  Encrypted data falls outside the scope of the Shield Act, unless the data is encrypted with an encryption key that has been “accessed or acquired” by an unauthorized party.

When implementing the security obligations required of all covered employers under the Act, small employers are allowed greater flexibility and will be deemed compliant if the security program is reasonable based on the size and complexity of the business. Small businesses should consider implementing appropriate measures within the following:

  • administrative safeguards, such as designating one or more employees to coordinate a data security program, identify foreseeable internal and external risks on a regular basis, track and assess the sufficiency of safeguards in controlling identified risks, and train employees in security programs, including preparing and preserving documents of compliance activities;
  • technical safeguards, such as assessing risks in network and software design, using the latest versions of software, two-factor authentication implementation, prevention and response to attacks or system failures, and regularly testing and monitoring the effectiveness of system controls and procedures; as well as
  • physical safeguards, such as assessing risk of storage and removal of private information, detecting and preventing intrusions, and physically securing access to information and disposal of that information in a reasonable amount of time.

Small employers must also consider administrative safeguards with regard to third party providers who have access to private data.  These safeguards should be documented so that the employer can demonstrate the reasonableness of its efforts to secure private information.

Small employers should also consider encrypting any and all private information of New York residents to which they have access, and storing the key to the encryption separately from the private information itself.  In doing so, they can significantly minimize the risk of data theft and similarly minimize their obligations and liabilities under the Shield Act.

Facebooktwitterredditpinterestlinkedinmail
17

January, 2021

Paternalism in the Age of COVID-19 Can Trip Up Well-Meaning Employers

By Tracey I. Levy

Employers are authorized, and to some degree required, to intrude into their employees’ personal lives and health issues as a screening tool to prevent the spread of COVID-19 in the workplace.  It is critical to remember, however, that the inquiries employers may currently be posing with regard to employees’ recent travel activity, physical health, and contacts with others represent a very limited exception to the general principle that employees in the U.S. are legally entitled to keep their health information private from their employers and to maintain autonomy over their engagement in lawful activities on their personal time.  Well-meaning employers, concerned for their employees’ welfare, may unwittingly run afoul of federal, state or local laws if they probe unnecessarily into the activities of their employees or place restrictions on where and when employees can work.

 

Reporting Positive COVID-19 Results

One issue that may trip up employers is requiring remote workers to report if they have tested positive for COVID-19 or are experiencing any COVID-like symptoms.  These are precisely the inquiries that employers can pose when screening employees who are physically coming into the workplace and will thereby be in contact with other individuals.  But the same questions are not permissible with regard to remote workers.  Guidance from the Equal Employment Opportunity Commission (“EEOC”) and New York City make clear that an employee who is working remotely and has not had in-person contact with colleagues or customers has no obligation to notify the employer of a positive COVID-19 test result or if they are experiencing COVID-like symptoms.

 

Working While Under Quarantine

Employees in New York who are under a quarantine or isolation order are not eligible for New York State COVID-19 leave if they are still able to work remotely while under quarantine.  If an employee has been quarantined because the employee has personally contracted COVID-19, New York City has issued testing guidance that if the employee can work remotely from home and feels well enough to do so, the employee need not take time off.  The guidance does not authorize employers (no matter how well-meaning) to preclude an employee who is able to work remotely from doing so just because the employee is experiencing symptoms of COVID-19.

 

Higher-Risk Individuals in the Workplace

The EEOC and the New York City Commission on Human Rights have both issued guidance that policies intended to be benevolent, that prohibit older workers from returning to the workplace because their age places them at a higher health risk if they contract COVID-19, are legally impermissible.  The same is true, according to the EEOC guidance, for removing pregnant or disabled employees from the workplace during the pandemic.  Employers must consider remote work requests from pregnant and/or disabled employees as a reasonable accommodation, but if no such request has been made, then the employer cannot mandate a telework arrangement based solely on an employee’s pregnancy, nor can an employer impose such a mandate with regard to an individual with a disability other than in extremely narrow circumstances where the employee’s presence in the workplace is found to present a “significant risk of substantial harm” to the employee and no other accommodation would suffice.

 

Accommodating Older Individuals to Keep Them Safe

New York City employers also can create issues for themselves if they authorize employees to work from home based solely on their age, or provide greater pandemic protective measures in the workplace just for older employees.  Employees, of any age, with underlying health conditions, may be entitled to work remotely as a reasonable accommodation for a disability.  Where the employee is not asserting any risk factor other than age, the NYC Commission on Human Rights has taken the position that the employer must treat all employees the same regardless of age.  The employer is not legally required to accommodate such individuals with remote work or additional precautionary measures, but if it chooses to do so then the option must be made available in an age-neutral manner.

 

Getting the All Clear from the Doctor

Finally, employers that want to be sure an employee really is well enough to return to work after contracting COVID-19 should restrain their instinct to require medical documentation.  Per CDC guidance, employers should not require a COVID-19 test result or a healthcare provider’s note for employees who are sick to validate their illness, qualify for sick leave, or to return to work. The CDC states requiring a negative COVID-19 test result also is not an appropriate criterion for such employees to return to work, as many people test positive long after the infectious period has ended.

Facebooktwitterredditpinterestlinkedinmail
30

December, 2020

Extension of FFCRA Credit Helps NYS Employers

By Tracey I. Levy

As a post-script to our last blog post, the latest federal COVID-19 relief package, which was signed into law on December 27, 2020, includes a short-term extension of the FFCRA tax credit that offers some additional financial relief for New York State employers.  As we previously discussed, the paid leave requirements of the FFCRA are set to expire December 31, 2020, and the new COVID-19 relief package allows those requirements to sunset.  However, those employers that voluntarily elect to continue to provide the paid leave that was available under the FFCRA, under that law’s eligibility requirements, can continue to claim a federal payroll tax credit through March 31, 2021 to offset the cost of that leave.  New York employers do not have an option with regard to providing COVID-19 leave, and therefore the extension of the FFCRA credit may be a valuable benefit to manage the associated costs.

There are some notable limitations on which employers can benefit from the federal tax credit:

  • Large Employers

Employers with more than 500 employees are subject to the New York State paid leave requirements, but were not subject to the FFCRA paid leave requirement and therefore cannot claim the credit;

  • Multiple Quarantines for the Same Employee

To the extent the reasons for leave under the FFCRA and New York State law have overlapped, the FFCRA tax credit was limited to a total of ten days of paid leave, per employee.  However, the New York State law does not appear to place a limit on the number of times an employee can receive paid leave, provided each leave is in accordance with a government-mandated quarantine or isolation order.  Once an employer has claimed the FFCRA tax credit for an employee, it appears that it cannot be claimed again for a repeat occurrence of quarantine.

New York State employers should consult with their tax advisor with regard to the availability of the tax credit in specific circumstances.

Facebooktwitterredditpinterestlinkedinmail
17

December, 2020

FFCRA Is Ending, But NYS Employers Still Have COVID-Leave Obligations

By Tracey I. Levy

The Families First Coronavirus Response Act (“FFCRA”), which provides up to two weeks of paid, job-protected sick leave to covered employees for a variety of COVID-related reasons, and additional leave for care of a child related to COVID, is scheduled to sunset on December 31, 2020. Presently, there seems to be limited legislative or executive effort to extend the law beyond that date, even as we remain in the throes of the pandemic. That means that, as of January 1, 2021, employees will no longer be eligible for FFCRA leave, any employee who is on leave as of December 31, 2020 will be ineligible for continued leave after that date, and employers who continue to grant employees leave for an FFCRA-qualifying reason will not be entitled to claim tax credits for paid COVID leave days subsequent to December 31. In a nutshell, the sunset clause means an end to any federal paid leave benefit or tax credit, and restoration to the way things were back in March 2020, before the pandemic.

While those consequences are relatively simple to explain, the interplay with New York State law makes things a bit more complicated. New York State passed its own COVID-related leave law, which took effect on the same day as the FFCRA. New York State’s law grants all employees COVID-related leave if an employee is personally subject to a mandatory or precautionary order of quarantine or isolation due to COVID-19, provided the employee is not physically able to work remotely while under quarantine. Employees are disqualified from the NYS COVID-related leave benefit only if they are being quarantined for having traveled outside the U.S., for non-work-mandated reasons, to a country for which the employee was on advance notice of a level two or level three travel notice having been issued by the CDC. New York State’s COVID-related leave law has no sunset date; rather, the leave benefit is specifically tied to COVID-19 and therefore, for as long as employees are subject to COVID-related quarantine or isolation orders, they remain eligible for the benefits provided under the state’s law.

As we noted previously in the Summer 2020 issue of our newsletter, Takeaways, employees who are directed by a healthcare provider to quarantine or isolate can obtain a quarantine or isolation order by following a process jointly defined by the New York State Departments of Health and Labor to request such an order from their local health department. New York City had issued a standing order with various appendices that, when satisfied, would be deemed to meet the state law quarantine order requirement, but the city has since withdrawn that page from its website.

For those employees who meet the NYS eligibility criteria, employers must provide the following, depending on their profitability and the size of their workforce:

  • 14 calendar days of job-protected, paid COVID-related leave, at the employee’s regular rate of pay, if the employer has 100 or more employees;
  • 5 calendar days of job-protected, paid COVID-related leave, at the employee’s regular rate of pay, and an additional 9 calendar days of job-protected, unpaid leave, if the employer has 11 to 99 employees or has fewer employees but had a net profit of $1,000,000 or more last year; and
  • 14 calendar days of job-protected, unpaid COVID-related leave, for all other employers with 10 or fewer employees.

Employees are entitled to apply for New York State Short-Term Disability and Paid Family Leave benefits, simultaneously and without any waiting period, during the unpaid portion of their quarantine leave, and all COVID-related leave is in addition to, and gets used before, any paid time off the employee may have otherwise available under the employer’s paid leave policies or the new New York State paid sick leave law.  New York State provides no reimbursement or subsidy to employers for the paid sick leave benefits required under the law.

As a reminder, FFCRA also provided employees with partially-paid leave benefits, of varying duration, in the event they were caring for a child or family member who was quarantined due to COVID. New York State law has no similar provision. However, to the extent an employee meets the eligibility criteria for Paid Family Leave (having worked at least 20 hours per week for 26 consecutive weeks), if either (i) the employee’s child has been quarantined and the employee is unable to work remotely while caring for that child, or (ii) the employee is unable to work because the employee needs to care for a close family member who contracts COVID-19, the employee can submit a claim for job-protected Paid Family Leave and receive paid time off benefits under that program.

New York State employers must therefore continue to provide COVID-related paid sick leave benefits to their employees, where the eligibility criteria are met, and shoulder those benefit costs, for as long as we are facing COVID-19-related quarantine orders.

Facebooktwitterredditpinterestlinkedinmail
11

December, 2020

Structuring a Paid Sick Leave Policy for New York, New Jersey and Connecticut

By Tracey I. Levy and Alexandra Lapes

By this January 2021, paid sick leave laws will impact all employers throughout the tri-state area of Connecticut, New Jersey, and New York.  The laws have some commonalities, but there are notable differences across jurisdictions that make it challenging for employers to draft a uniform policy.

Consensus at the Macro Level:

The sick leave laws all permit eligible employees of covered employers to accrue up to 40 hours of sick leave per calendar year. This leave can, at a minimum, be used for the employee’s or family member’s illness, injury, or preventive medical care or treatment, and if an employee or family member is a victim of domestic violence/sexual violence (including the need to obtain related safety measures).  Employees minimally must provide notice as soon as practicable prior to taking a sick day. For absences of more than three consecutive days, employers may request documentation to substantiate the need for leave but must keep confidential the information they receive.  In addition, all prohibit retaliation against employees who exercise their sick/safe leave rights.

Divergence in Key Details:

Connecticut’s sick leave law is limited to non-exempt service works (as defined by the US Bureau of Labor Statistics), excluding manufacturing and not-for-profits.  The New Jersey, New York City, and New York State laws apply to all private employers, although in New York State and New York City, the leave need only be paid if the employer has 5 or more employees, unless an employer made more than $1 million in the previous tax year, and employers with 100 or more employees must provide a total of 7 days (56 hours) of paid sick/safe leave per calendar year.

The following chart summarizes key jurisdictional differences that relate to employment policies.  Employers should additionally be mindful that Connecticut, New York City and New Jersey all require providing employees with notice of their sick leave rights, and New York City and State impose additional recordkeeping requirements on employers with regard to paid sick leave accruals.

Paid Sick Leave Provisions

Facebooktwitterredditpinterestlinkedinmail
Back to Top