4 steps to securing employee’s personal data
A single data breach of your employees’ information has far-reaching implications. First and foremost, data breaches can wreak havoc on employees’ lives. Hackers can use stolen data to apply for credit cards, obtain fraudulent tax returns, and cause the identity theft victim no end of financial troubles.
As an employer, you risk a lawsuit against the company for not safeguarding information. If a group of your employees suffer financial loss due to an employer data breach, they may jointly bring a claim together as part of multi-party litigation, or appoint one individual to act as a representative as part of a class action. Also, publicity generated by a breach may hurt your motor carrier’s reputation and ability to hire quality drivers and other employees. Steps to limit the vulnerability to your employee’s personal information:
1. Review collection practices
There are two types of information that should be examined during any data inventory:
- Personal data, such as addresses, phone numbers, and other information that may be accessed through other means.
- Sensitive personal data, such as social security numbers, driver’s license numbers, dates of birth, employee pay, and other not-so-readily available information that could cause greater harm to individual in the event it is learned by others.
Your assessment will also include records on both employees and those individuals who may never have been on your company payroll, such as:
- Applicants. Data related to vetting may include drug test, application, and background checks information.
- Leased owner-operators and temp drivers. Motor carriers are required to assemble records on independent contractors and staffing service employees.
2. Audit storage practices
Consider creating a spreadsheet to document the types of records you have that contain personal information. This document should identify the form or report, storage medium and location (hardcopy or cloud storage, personal computers, external hard drives), security measures to limit access, those with access, and how long the record is kept.
If the records are spread throughout the organization (Safety, Operations, Human Resources), your self-audit may require speaking with each to learn of their internal processes. If items are stored or shared electronically (email, cloud), you may need to work with your IT department to learn what security measures are in place.
Specific to retention, documents must be kept a minimum amount of time based on employment laws or the Federal Motor Carrier Safety Regulations (FMCSRs). Keeping them beyond the retention period may unnecessarily put the individual’s information at risk. If you hold on to the records longer than what is required, identify the reason why (e.g., ongoing lawsuit).
Once a document is no longer needed, you should look at how the item is purged (shredded, outside disposal service, deleted from server).
3. Audit vendors
Often records are stored at motor carrier vendors. Whether it is a consortium/third-party administrator or an accounting firm performing payroll services, you need to know their business practices. Security requirements should be included in your contract. For those requesting background checks for you (e.g., motor vehicle records, safety performance histories, or Clearinghouse queries), the vendor is subject to security requirements in accordance with the Fair Credit Reporting Act.
Areas to address with your vendors include:
- Security practices for storage and transfer of your data
- Their staff (background checks and data security training)
- Mechanisms to report data breaches in timely fashion
If you find anything that makes you uneasy, you may need to consider a new service agent.
4. Implement controls
Once your security audit is complete, you need to act on what you found. For example, you might consider:
- Updating your security software
- Requiring annual security training for employees and managers
- Perming background checks on those handling data
- Creating reminders to dispose of data
- Employing a clean desk policy (locking up sensitive documents and computer screens whenever stepping away)
- Routinely performing a self-audit of your recordkeeping practices
- Addressing any violations of your corporate security policy
State requirements
All 50 states have data breach laws that require a business to notify individuals and, in some cases, state agencies, of a security system breach resulting in the exposure of personal information.
The definition of “personal information” varies by state, but, at a minimum includes a person’s name, social security number, driver’s license number, and a financial account number. Some states also biometric data that can be a component of a time and attendance system, or health insurance information.
State data breach laws require a business to provide notification to affected individuals as soon as 30 days of the breach or as soon as reasonably practicable, depending on the state.
The laws will provide the terms of the notice and the delivery method. Some states require state agencies to be notified of a breach such as the state Attorney General when a certain number of state residents are inspected by the breach or in some states, more broadly as, if the business operates in the state.
Some states also require reasonable data security measures, specific data security requirements, and a statute of limitations on data breach claims.
Key to remember: Employers must collect employee data for payroll and other purposes, and that data must be kept secure. This can be achieved through best practices in obtaining and storing data, as well as employee training and regular monitoring of data security.