Category: Commentary & Opinion

When is the last time you reviewed, or, even better, re-wrote your employee handbook?

Last year? Five years ago? Ten years ago? What’s an employee handbook?

Now is as good a time as any to dust off yours, and give it a good review and polishing.

The National Labor Relations Board recently published guidance on the standards it will follow in determining whether a facially neutral employment policy violates the rights of employees to engage in concerted activity protected by section 7 of the National Labor Relations Act.

The board, over scathing dissents by its more reasonable members and scorching critiques from business groups, had applied its longstanding Lutheran Heritage rule to find that a variety of employment policies violate employees’ rights to engage in protected concerted activity under section 7 of the National Labor Relations Act. Lutheran Heritage asked if an employee would “reasonably construe” a work rule to infringe on their right engage in protected concerted activity. The benign policies it found unlawful ranged from confidentiality, to insubordination, to the use of company logos, to photography bans, and to conflict-of-interest rules. Over the past few years, the board’s Lutheran Heritage test has led to some pretty crazed results.

Lutheran Heritage, however, now resides in the NLRB’s dust bin. In its place is Boeing Co., which scrapped the board’s “reasonably construe” test.

Category 1: Rules Generally Lawful to Maintain

These rules are presumed lawful because, when reasonably interpreted, they do not prohibit or interfere with the exercise of rights guaranteed by the Act, or because the potential adverse impact on protected rights is outweighed by the business justifications associated with the rule. Such rules include:

• Civility rules
• No-photography rules and no-recording rules
• Rules against insubordination, non-cooperation, or on-the-job conduct that adversely affects operations
• Disruptive behavior rules
• Rules protecting confidential, proprietary, and customer information or documents
• Rules against defamation or misrepresentation
• Rules against using employer logos or intellectual property
• Rules requiring authorization to speak for the company
• Rules banning disloyalty, nepotism, or self-enrichment

Category 2: Rules of Individualized Scrutiny

These rules are not obviously lawful or unlawful, and must be evaluated on a case-by-case basis to determine whether the rule would interfere with rights guaranteed by the NLRA, and if so, whether any adverse impact on those rights is outweighed by legitimate justifications. Such rules include:

• Broad conflict-of-interest rules that do not specifically target fraud and self-enrichment and do not restrict membership in, or voting for, a union.
• Confidentiality rules broadly encompassing “employer business” or “employee information” (as opposed to confidentiality rules regarding customer or proprietary information, or confidentiality rules more specifically directed at employee wages, terms of employment, or working conditions.
• Rules regarding disparagement or criticism of the employer (as opposed to civility rules regarding disparagement of employees).
• Rules regulating use of the employer’s name (as opposed to rules regulating use of the employer’s logo/trademarks.
• Rules generally restricting speaking to the media or third parties (as opposed to rules restricting speaking to the media on the employer’s behalf.
• Rules banning off-duty conduct that might harm the employer (as opposed to rules banning insubordinate or disruptive conduct at work, or rules specifically banning participation in outside organizations).

Rules against making false or inaccurate statements (as opposed to rules against making defamatory statements).

Category 3: Rules Unlawful to Maintain

Rules in this category are generally unlawful because they would prohibit or limit NLRA-protected conduct, and the adverse impact on the rights guaranteed by the NLRA outweighs any justifications associated with the rule. Such rules include:

• Confidentiality rules specifically regarding wages, benefits, or working conditions (such as, “Employees are prohibited from discussing or disclosing wages, salaries, commissions, bonuses, or any other remuneration.”).
• Rules against joining outside organizations or voting on matters concerning the employer.

These rules are welcome news for employers, as they provide much needed sanity on the legality of facially neutral employment policies, many of which employers scrapped under the NLRB’s questionable Obama-era rulings.

Is an employer required to permit a disabled full-time employee to work a reduced work schedule as a reasonable accommodation?

In Hostettler v. The College of Wooster [pdf], the 6th Circuit concluded that it depends on the specific position, and that an employer risks violating the ADA by declaring full-time work as an essential function of a position without analyzing the actual need for full-time work for that position.

Heidi Hostettler started her job as an HR Generalist at The College of Wooster while she was four-months pregnant. As she approached the end of her maternity leave and return to work, she suffered severe postpartum depression and separation anxiety. As a result, and upon the recommendation of her OB/GYN, Wooster permitted Hostettler to extend her leave by a month.

She eventually returned to work on a reduced, half-time schedule, which Wooster permitted for two months. Thereafter, Hostettler needed to submit a refreshed medical certification. That certification explained that she should continue to work half-time for two more months.

Instead, however, Wooster fired Hostettler because she was “unable to return to [her] assigned position … in a full time capacity.”

The court considered whether working full-time was an essential function of Hostettler’s job as an HR Generalist. If it was an essential function, the Hostettler was not otherwise qualified for her position, and loses her ADA claim. If, however, full-time work was not an essential function, then Wooster discriminated against her by firing her for not working full time.

The court concluded that a jury should determine whether full-time work was essential to Hostettler’s job, and rejected the employer’s argument that full-time presence at work is always essential to every job.

[F]ull-time presence at work is not an essential function of a job simply because an employer says that it is. If it were otherwise, employers could refuse any accommodation that left an employee at work for fewer than 40 hours per week. That could mean denying leave for doctor’s appointments, dialysis, therapy, or anything else that requires time away from work.

The court further rejected Wooster’s stated preference for full-time work, finding it unsubstantiated. It instead required the employer to show it why full-time work was essential to Hostettle’s specific job.

Wooster may have preferred that Hostettler be in the office 40 hours a week. And it may have been more efficient and easier on the department if she were. But those are not the concerns of the ADA.… An employer cannot deny a modified work schedule as unreasonable unless the employer can show why the employee is needed on a full-time schedule; merely stating that anything less than full-time employment is per se unreasonable will not relieve an employer of its ADA responsibilities.

Thus, “on its own, however, full-time presence at work is not an essential function. An employer must tie time-and-presence requirements to some other job requirement.… Wooster must explain why Hostettler could not complete the essential functions of her job unless she was present 40 hours a week.”

When presented with this issue by one of your employees, what do you do?

For starters, do not make the same mistake as Wooster, and assume that every full-time employee must be present at work 40 hours per week. Instead, if you want to deny the accommodation, build your case.

• Are there required aspects of the job that cannot be completed in less than 40 hours a week?
• Are there specific aspects of the job that cannot be done remotely?
• Has the employees failed in the past in efforts to complete required tasks in less time, or while remote?

Without answering these questions, and tying the full-time requirement to specific job requirements that will otherwise go unfulfilled or uncompleted, you will have a difficult time meeting your obligations under Hostettler and defeating an ADA claim premised on a denied modified work schedule.

I’ve had a lot of thoughts walking through Costco.

Why aren’t the free samples out yet?

What the heck am I going to do with 10 pounds of cheese, but damn that’s a good price?

How did I just manage to spend $250?

But the one thing I’ve never thought?

It’s so loud in here; I wish the employees would speak more quietly.

Then again, I’ve never been in the Costco in Pompano Beach, Florida.

That’s where Christine D’Onofrio worked for 24 years, until she was fired for speaking too loudly.

Her excuse? She’s deaf, and couldn’t self-regulate the volume of her own voice.

According to the Sun Sentintel, the store provided her a video phone to help her communicate. She alleged that after managers complained that she was yelling into the device, she was written up for being too loud.

She responded by sending a letter to Costco’s CEO. Shortly thereafter, she says, the store suspended her for a week, and then fired her.

For its part, Costco argued that D’Onofrio had a history of discipline “for serious misconduct and insubordination.”

It also argued that if any unlawful activity occurred, it “was outside the scope of that individual’s employment, was not authorized or condoned by Defendant, and was undertaken without the knowledge or consent of Defendant.” (P.S. That’s not a defense to a discrimination claim.)

The jury awarded D’Onofrio $750,000 for emotional pain and mental anguish caused by the denial of reasonable accommodations, and $25,000 for punitive damages.

Employers, listen to (and don’t punish) your disabled employees when they ask for reasonable accommodations. The alternative could prove quite costly.

Consider the following scenario.

An employer discovers that an employee who worked in its information technology department had been stealing older laptop computers. Some of those computers had been used in the employer’s human resources department and contained former employees’ personal information (including Social Security numbers and drivers’ license numbers), which the company collected on each employee at the time of hire.

The employer attempts to recover the stolen computers and informs its employees of the data breach. Some time later, however, an employee learns that several of his accounts with online retailers were compromised and used to make unauthorized purchases.

He sues his employer for, among other claims, breach of contract (based on the company’s data security policy in its employee handbook) and negligence. Who wins?

These are the facts the 3rd Circuit Court of Appeals recently considered in Enslin v. Coca-Cola Co. In opinion drafted by twice-SCOTUS bridesmaid Thomas Hardiman, the court found for the employer. It concluded that the employee could not prevail because he could not establish that the employer caused his damages. The harm flowed “from the compromise of his retail accounts rather than directly from … [the] theft of his personal information,” and the employee presented “no evidence from which a reasonable jury could conclude that his accounts were compromised because information was gleaned from the stolen laptops.”

Similar to Enslin is Dittman v. UPMC d/b/a the University of Pittsburgh Medical Center, in which a Pennsylvania appellate court held that an employer “did not owe a duty of reasonable care in its collection and storage of the employees’ information and data.” The court found it “unnecessary to require employers to incur potentially significant costs to increase security measures when there is no true way to prevent data breaches altogether.”

Do not, however, allow these cases to lull you, as an employer, into a false sense of immunity from claims by employees following data breaches. Indeed, several other courts that have examined this issues have reached the opposite result.

• • Sackin v. TransPerfect Global, Inc. (S.D.N.Y. 10/4/17): “Employees ordinarily have no means to protect that information in the hands of the employer, nor is withholding their PII a realistic option. The employer is best positioned to avoid the harm in question. Employees — much more than employers — suffer the harmful consequences of a data breach of the employer. Potential liability in the absence of reasonable care provides employers with an economic incentive to act reasonably in protecting employee PII from the threat of cyberattack.” 
  • Hapka v. CareCentrix, Inc. (D. Kan. 12/19/16): Employer “owed a [common law] duty to Plaintiff and the Class to exercise reasonable care in obtaining, securing, safeguarding, deleting, and protecting Plaintiff and Class members’ personal and tax information within its control from being compromised, lost, stolen, accessed, and misused by unauthorized persons.”

Regardless of whether you, as an employer, have a legal duty to protect the personal information and data of your employees, you still have a significant financial and reputational incentive to take reasonable steps to maintain the privacy and security of the information.

What should you be doing?

1. 1. Implementing reasonable security measures, which includes encryption, firewalls, secure and updated passwords, and employee training on how to protect against data breaches (such as how not fall victim to phishing attacks).
   2. If (or more accurately when) you suffer a data breach, timely advising employees of the breach as required by all applicable state laws.
   3. Training employees on appropriate data security.
   4. Drafting policies that explain the scope of your duty as an organization to protect employee data.
   5. Maintaining an updated data breach response plan.

Remember, data breaches are not an if issue, but a when issue. Once you understand the fact that you will suffer a breach, you should also understand the importance of making the issue of data security a priority in your organization. The average cost to a company of a data breach in 2018 is $3.9 million (and increasing annually). While I don’t work in the business of guarantees, I can guarantee that any expenses you incur to mitigate potential cost of a data breach is money well spent.