©2024 Seyfarth Shaw LLP www.seyfarth.com 2024 Cal-Peculiarities | 67 employee has signed a special release.54 California employers must not discriminate against an employee who refuses to sign that release, but may take necessary action in the absence of medical information if the employee refuses to sign the release.55 (See § 3.6.1.) The release must meet several requirements, e.g., the language must be separate from other language, and must be in no smaller than 14-point font. Moreover, the release must authorize only the release of medical information, be limited in purpose, and state an expiration date or event. The expiration date or event must limit the duration of the release to one year or less, unless the person signing the release requests a specific date beyond a year. Additionally, the release must specify who may disclose the information, and must contain an advisory that the employee is entitled to a copy of the release.56 4.7.2 Labor Code § 3762—workers’ compensation insurers In workers’ compensation proceedings, the employer’s insurance carrier or a third-party administrator often receives medical information about an employee (in, for example, a deposition transcript or medical report). The Labor Code forbids disclosure of this information to the employer, except as to (1) the diagnosis of the condition for which workers’ compensation is claimed or treatment is provided, and (2) information needed to modify the employee’s work duties.57 4.8 Social Security Numbers and Other Personal Information 4.8.1 Limits on use of SSNs No person may print an individual’s social security number (SSN) on materials mailed to the individual, publicly post SSNs, print them on password cards, or require their use to access a website.58 Nor may a person require an individual to transmit an SSN over the Internet unless the connection is secure or the SSN is encrypted.59 4.8.2 Duty to protect personal information California businesses owning personal information—such as SSNs, driver’s license numbers, credit card numbers, or medical information—must “maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”60 A business that “discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party”—e.g., an employer that releases personal information when contracting with third parties for payroll, benefits administration, or background check purposes—must “require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”61 4.8.3 Social media password and access protections California employers must not request or require employees or job applicants to divulge personal social media account information. The term “social media” broadly encompasses all digital or electronic content, including videos, photographs, blogs, podcasts, instant-text messages, email, on-line services or accounts, and internet website profiles.62 Specifically, employers must not ask or demand that employees or applicants (1) disclose user name or password to access a personal social media account, (2) access personal social media in the employer’s presence, or (3) divulge any personal social media.63 Employers must not take any adverse action against an employee for refusing or failing to comply with such a request or demand.64 However, employers still may ask employees to divulge personal social media reasonably believed to be relevant to investigating suspicions of employee misconduct or violations of law, so long as the employer uses the social media solely for that or a
RkJQdWJsaXNoZXIy OTkwMTQ4