Starting July 1, 2013, employers in Virginia run a risk if they disclose “personal identifying information” about their current or former employees. New Virginia Code §40.1-28.7:4 provides that “employers shall not, unless a listed exemption applies, be required to release, communicate, or distribute to a third party, any current or former employee’s personal identifying information.”
Personal identifying information” is defined as an employee’s “home telephone number, mobile telephone number, email address, shift times, or work schedule.” Exceptions permitting the disclosure of such information include requirements of federal laws that supersede state statutes, court orders, judicial warrants or a subpoena in a civil or criminal case. There is no fine for improper disclosure.
This law began as an “anti-union” measure in response to a proposed rule by the National Labor Relations Board that would have required employers to provide employee telephone numbers and email addresses to union organizers. The NLRB rule is currently on hold. In the end, the law is really about increasing worker privacy.
Practically speaking, what does this mean for your business? It means you should review your personnel policies and procedures concerning “personal identifying information.” Employee information is often shared internally on group contact lists, with benefit brokers for insurance purposes and with other third parties for business purposes (e.g., employment verification). Employers should now consider adding to their list of onboarding documents an authorization form for employees to sign giving the employer permission to share personal identifying information for specifically listed business purposes, or including it as part of the handbook acknowledgement. Although there is no penalty for disclosure of personal identifying information, the statute establishes a public policy in Virginia that favors protection of such information and could be used by employees and former employees in a lawsuit against their employers.
