By Vin Gurrieri

Law360 (June 5, 2020, 7:01 PM EDT) -- With businesses increasingly coming back online amid the novel coronavirus outbreak, employers are turning to an assortment of apps and high-tech gadgets designed to make their workplace safety plans easier to execute, but attorneys warn those technologies come with privacy risks and employee relations headaches.

Among the cornerstones of employers' plans to reopen their facilities after months of pandemic-related lockdowns are protocols for screening and testing workers, as well as making sure they are social distancing to mitigate the risk of spreading the virus throughout the workforce.

As employers work through how to implement those concepts, many are considering a range of smartphone apps and other technologies from third-party providers that have been developed to help make new workplace safety procedures as efficient as possible.

Jennifer Betts of Ogletree Deakins Nash Smoak & Stewart PC said she believes there "are a fair number of legal issues" at play that businesses have to work through before any such technologies are rolled out, with a lot of those assessments depending on how the technology works.

"The main thing I generally emphasize to clients when they are thinking about using these kinds of tools is to really think about how employees are going to react to them, how intrusive they are and to make sure you have a communication plan and strategy before you implement the tools to try and counteract any of those issues," said Betts, who co-chairs Ogletree's technology practice.

Tech on the Table

Jason C. Gavejian of Jackson Lewis PC, whose practice focuses on privacy and data security, said new technologies are increasingly on employers' radar in part because automating processes for things like employee health screenings and contact tracing helps ease various "administrative burdens" that exist when employers do those things manually.

Betts said employers' reliance on technology as part of their virus-mitigation efforts generally falls into four buckets: symptom tracking, contact tracing, proximity beaconing and advanced technology such as thermal imaging to check people's temperature for possible fevers.

For example, businesses might incorporate an app through which workers share whether they've experienced symptoms tied to COVID-19 or answer basic health screening questions like what their body temperature was that morning. That means the employer won't have to sift through pen-and-paper questionnaires every day.

Other businesses are considering smartphone apps or wearable devices like electronic wristlets that use Bluetooth or — less likely — GPS technology to track employees' whereabouts on shop floors and in offices. Those devices can help businesses assess whether their social distancing policies are having their intended effect, Betts said.

If a worker tests positive for COVID-19 or exhibits symptoms consistent with the disease, businesses can also use tracking technology to perform contact tracing, which would enable them to quickly figure out who has been in close proximity to the sick individual, she added.

"Those are the four things that I would say we're seeing a lot of clients explore or start implementing in their workplace," Betts said. "We are seeing an increase in employers using technologies to try to increase efficiencies and success rates in their COVID-19 responses."

Privacy Minefield

But despite the benefits, Betts said there could be a slew of privacy concerns awaiting employers who use such technology.

For example, if a certain technology does facial recognition scanning, "there could be biometric issues" under laws like the Illinois Biometric Privacy Act, or issues relating to businesses' obligation to notify employees about the information that's being collected. Some states also have laws that protect workers from getting in trouble for legal conduct done while off-duty, and employers could run afoul of those laws if the technology they use continues collecting information, like GPS data, after workers' shifts end.

"Every state that [employers] have operations in, you need to make sure you understand whether there's some kind of data privacy law that could be implicated," Betts said.

In addition to technology that monitors workers' off-duty whereabouts, Jackson Lewis' Gavejian also cautioned that employers have to be wary of using platforms without understanding exactly how much data is being obtained.

"When you're implementing technology like this, the additional concern would be what data is being collected that you don't know about," Gavejian said. "You may think you're contracting with a third party to provide an app to do employee screening, but as part of that technology it's also tracking or capturing other data off the individual's personal device or off the company-issued device that may be utilized by the employee to complete the online screening questionnaire."

As such, he said employers should address those types of issues "either contractually or through due diligence" to make sure a third party's representations about what information is being gathered are "actually accurate and that additional data is not being captured."

Joseph Lazzarotti, founder and leader of Jackson Lewis' privacy, data and cybersecurity practice, also said employers should go through "a multi-factored analysis" to figure out if it makes sense to provide workers with a phone to access apps or have them use personal devices instead, saying there are pros and cons for each approach.

"There are some advantages to having the company phone versus the employee's phone, but that adds to costs," Lazzarotti said, adding that "with the employee's phone, there can be greater privacy issues and considerations that you have to work through as well."

Beware of Different States' Rules

As is common throughout employment law, employers whose operations stretch across multiple cities and states have to contend with different mandates in each jurisdiction op top of federal requirements.

Data privacy laws are no different, according to Ogletree's Betts, who noted the U.S. has "a patchwork" of such statutes that includes the California Consumer Privacy Act, and that employers have to keep a keen eye on all of them if they implement technology as part of their virus response efforts.

Gavejian said employers generally want to use the same technology in all of their locations rather than having different processes all aimed at accomplishing similar goals. But in seeking that uniformity, businesses still have to make sure they address any specific requirements on a jurisdiction-by-jurisdiction basis.

"From my perspective, I'm seeing clients roll these out nationwide. So if they have operations or facilities in multiple jurisdictions, they look to utilize one piece of technology across the board," Gavejian said. "They don't say, 'OK, in one jurisdiction we're going to use paper and in another jurisdiction we're going to use technology to accomplish the same goal.' I think it's just a matter of what nuances or what legal issues may need to be addressed before they roll out the technology."

Required or Voluntary?

Besides privacy laws and data protection laws, employers also have to contend with a slew of practical questions when they incorporate technology in COVID-19 response plans.

For example, businesses must decide whether to mandate that workers use it or whether it'll be optional, with attorneys noting that contact tracing apps in particular increase in effectiveness as more people participate.

Sidley Austin LLP partner Kate Heinzelman, a former deputy general counsel at the U.S. Department of Health and Human Services, said the question is one she believes will be "front and center" as employers consider whether to use apps, the type of information they will collect and what protections should be put in place "to inform employees about what they're collecting."

"Employers can require employees to take many steps as a mandatory matter for the health and safety of the workplace, particularly in this extraordinary time. But a particular app or type of information collection may present risks that are better addressed by deploying the app on a voluntary basis," said Heinzelman, who is a member of Sidley Austin's privacy and cybersecurity, health care and commercial litigation practice groups.

While voluntary data collection processes may result in more administrative work for employers, they can also help assuage fears workers may have about submitting information, according to Heinzelman.

"The more options you give, it can become more burdensome for the employer. And employers have to have some uniformity, particularly large global employers," Heinzelman said. "But giving employees options and making collections voluntary can help mitigate concerns that employees have about the particular way that employer goes about doing the collection."

Eye Toward Labor Law

Aside from privacy issues and employee fears about the data being collected, employers whose plans include a heavy focus on technology also face potential problems when it comes to dealing with existing unions or nonunionized workers who are trying to form one.

For example, if a company decides to use tracking technology as part of a social distancing plan, it could land in hot water — depending on how the technology works — if employees are in the midst of an organizing drive, according to Ogletree's Betts.

Under the National Labor Relations Act, it is unlawful for businesses to interfere with workers' right to unionize, including by spying on pro-union workers, and businesses could run afoul of that legal obligation if they track employees' whereabouts.

"If the technology is monitoring where employees are located at all times and there's [a union] organizing drive, for example, that could have surveillance implications," Betts said.

Employers could also land in legal hot water if they implement new technology without running it by the union first.

Generally speaking, Jackson Lewis' Lazzarotti said the implementation of technology as part of COVID-19 preparedness plans is subject to collective bargaining between businesses and unions unless a collective bargaining agreement contains language that "gives the employer the ability to exercise some discretion about how they maintain safety in the workplace."

"Barring [such language] in a collective bargaining agreement, if you're going to be implementing technology that affects working conditions, which I think this might, I think there's a good chance that you have an obligation to bargain," Lazzarotti said.

And if such bargaining occurs but the union finds out later that the data the employer collected was used in ways that go beyond what was agreed upon, that too could form the basis of a federal labor law claim, according to Lazzarotti.

"If you're bargaining with a union and it turns out that the union learns that you used the information beyond what you bargained for, you might have an unfair labor practice [charge]," Lazzarotti said.

--Editing by Kelly Duncan and Marygrace Murphy.

For a reprint of this article, please contact reprints@law360.com.