When Acting To Prevent Data Breaches And Comply With Privacy Laws, Remember Overarching Employee Rights

The grocery business may be "fresh and easy," but drafting a confidentiality and data protection policy that withstands the scrutiny of the current National Labor Relations Board (NLRB) is not. The NLRB, in its recent 2-1 Fresh & Easy Neighborhood Market and United Food and Commercial Workers International Union decision, 361 NLRB No. 8 (July 31, 2014), ruled that the company's "confidentiality and data protection" rule violated Section 8(a)(1) of the National Labor Relations Act (the Act). This decision is a reminder that businesses acting proactively to avoid data breaches and comply with privacy laws must also consider the NLRB's view of employee rights if an employee may be implicated in wrongdoing, regardless of the context or label placed on the workplace rule.

Section 8(a)(1) of the Act makes it an unfair labor practice for an employer "to interfere with, restrain, or coerce employees in the exercise of the rights guaranteed in Section 7″ of the Act, which guarantees employees the right to engage in "concerted activities for the purpose of collective bargaining or other mutual aid or protection."

Fresh & Easy Neighborhood Market, a grocery store chain, maintained a 20-page "Code of Business Conduct" (the Code) on its website. Employees were required to follow the policies described in the Code and breaches of the Code may result in disciplinary action. The Code's section entitled "Confidentiality and Data Protection" mandated that employees:

Keep customer and employee information secure. Information must be used fairly, lawfully and only for the purpose for which it was obtained.

In May 2012, charges were filed by the United Food and Commercial Workers International Union challenging the data protection rule, alleging that it was unlawful because employees could reasonably construe it as prohibiting the sharing of information by employees to improve terms and conditions of employment. The NLRB issued a complaint in October 2012, alleging a violation of Section 8(a)(1) of the Act and the matter was transferred to the Division of Judges. On March 22, 2013, an Administrative Law Judge concluded that there was no violation and dismissed the complaint. After the NLRB General Counsel filed exceptions, the matter was transferred to a three member panel of NLRB, including its Chairman.

Forming a majority, the Chairman and another NLRB member disagreed with the Administrative Law Judge and the third dissenting NLRB member by finding the...