A new Massachusetts law has some interesting similarities to the EU Data Protection Directive . . . except that it’s a bit more onerous. Section 148 of An Act Relative to Economic Development (click here and scroll down to section 148) reads:
An employer shall notify an employee within 10 days of the employer placing in the employee’s personnel record any information to the extent that the information is, has been used or may be used, to negatively affect the employee’s qualification for employment, promotion, transfer, additional compensation or the possibility that the employee will be subject to disciplinary action. An employer receiving a written request from an employee shall provide the employee with an opportunity to review such employee’s personnel record within 5 business days of such request. The review shall take place at the place of employment and during normal business hours. An employee shall be given a copy of the employee’s personnel record within 5 business days of submission of a written request for such copy to the employer. An employer shall not be required to allow an employee to review the employee’s personnel record on more than 2 separate occasions in a calendar year; provided, however, that the notification and review caused by the placing of negative information in the personnel record shall not be deemed to be 1 of the 2 annually permitted reviews.
To paraphrase, there is an affirmative obligation on employers to inform Massachusetts employees of anything non-flattering that may impact that employee’s future with the company. Also, an employer must provide access to or a copy of the employee’s employment record within 5 business days of receiving such a request. Much of this language is repeated from other statutes (there has always been a right to review a personnel record and for employees to challenge the information therein. What is new is that employees are now entitled to notice of any non-flattering information. There are a few things to be aware of:
- “Personnel record” is not defined, nor is “employee” or “employer” is not defined in the act, but we can find definitions elsewhere and the definitions are quite broad. I suspect that even if you email back and forth with another manager and save those emails in a folder, it’s probably covered and must be disclosed. It’s unlikely that the disclosure requirement trumps legal privilege so involving in-house counsel is important.
- The employee does not have a private right of action under the statute. They must complain to the Attorney General who in turn will decide whether to investigate and proceed with a fine.
- You will need to work this into your policy framework and train your HR staff accordingly. In crafting the policy, you will need to decide if you are going with the highest common denominator approach (e.g., all staff are entitled to this right) or separate policies for Massachusetts staff.
- Put a process in place to receive and process requests within the prescribed timeframes. Meet with your HR staff and understand where personnel files are kept, how long it takes to retrieve them, and how you will supervise employees reviewing their file or how you will send out a copy (I suggest via courier with return receipt). If an employee cancels their requests or grants you additional time, immediately document this in writing and send a copy to the employee via courier with return return receipt. I’ve had direct experience with employees modifying or canceling their request for information and later complain to the data protection regulator (Isle of Man and Guernsey) that their right of access of refused. If you can’t get the file out in time for some reason, send what you can and provide a timeframe for when you will deliver the rest. Try to obtain consent to the delay. Most people are flexible if you are up front with them.
- Use this as an opportunity to train all staff on what they should and should not write, regardless if it’s a personnel file entry or a customer file entry. Far to frequently I came across inappropriate comments in emails about staff by other staff. The basic rule is to state the facts only and not write anything that you couldn’t defend on the front page of a national newspaper. Be mindful how things sound. One of my favourites was two staff discussing a night of drinking with other staff and the vivid description of the sexual escapades of himself and a fellow colleague. I took the printout of the email and placed it on the desk next to him- he understood quickly. (The email came up in an ediscovery search, but was completely unrelated to the legal matter- luckily.) Another time, a high-ranking executive sanctioned instructions to keep a shareholder away from the microphone at a shareholder meeting. The exec then went on to make an inappropriate comment about the shareholder (who was also a former client). That document had to be disclosed and resulted in severe repercussions.
Perhaps more interesting is to wonder what is going on here. As I understand it, this has something to do with a police officer being denied a promotion as a result of unflattering information in his personnel record (hint: request your personnel record a few weeks before you are up for promotion) that he was not aware of. Had he been aware of it, he would have refuted it, or so it goes. The Europeans tend to be rather strict on employee privacy, but this law even goes beyond the usually EU requirements. Of course, from a people management perspective, this will result in an employee being made aware of issues their employer has with the him/her and thus provide him/her with the opportunity to address the issue. Constant feedback, both good and bad, is the best way, but this provides a nice failsafe. It’s not at all what the aim of the legislation is, but perhaps there will be some unintended good consequences for a change.