Data protection in the workplace is governed by a patchwork of federal and state laws rather than a single comprehensive statute, so what your employer can collect, monitor, keep, and share depends on the type of information involved and the state where you work. Some categories—medical records, genetic information, background checks, biometric identifiers—get strict, specific protections. Others sit in gray areas where employer policy and the notices you signed at hire do most of the real work.
The Federal Laws That Set the Floor
Four federal statutes do most of the heavy lifting for employee privacy.
The Electronic Communications Privacy Act, at 18 U.S.C. §§ 2510–2523, makes it a crime to intentionally intercept wire, oral, or electronic communications.1Office of the Law Revision Counsel. 18 USC Chapter 119 – Wire and Electronic Communications Interception and Interception of Oral Communications Its companion, the Stored Communications Act at 18 U.S.C. § 2701, makes unauthorized access to stored electronic communications a federal offense.2Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications Together they mean your employer cannot secretly tap your personal email or read messages stored on services you use outside of work. But there is a large carve-out at 18 U.S.C. § 2511(2)(a)(i): a provider of electronic communication service can intercept communications in the normal course of business to protect its rights or property.3Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Courts have read this to give employers broad authority to monitor anything happening on company-owned systems. That is why the monitoring notice buried in your onboarding paperwork carries real legal weight.
The Americans With Disabilities Act requires that any medical information your employer collects be kept on separate forms and in separate files from your general personnel record, and treated as a confidential medical record.4Office of the Law Revision Counsel. 42 USC 12112 – Discrimination Access is limited to supervisors who need to know about work restrictions or accommodations, first-aid personnel in emergencies, and government compliance investigators. Many people assume HIPAA does this job. It doesn’t. HIPAA’s Privacy Rule covers health plans and healthcare providers, not employers directly.5U.S. Department of Health and Human Services. Am I a Covered Entity Under HIPAA The ADA is what keeps your doctor’s notes out of the same folder as your performance reviews.
The Genetic Information Nondiscrimination Act prohibits employers from requesting, requiring, or purchasing your genetic information, including family medical history.6Office of the Law Revision Counsel. 42 USC 2000ff-1 – Employer Practices Narrow exceptions exist for voluntary wellness programs with written consent, FMLA certifications that require family history, and monitoring of toxic-substance exposure. Otherwise, your employer has no business knowing your genetic test results or whether cancer runs in your family.
The Fair Credit Reporting Act governs background checks and credit reports. Before pulling one, an employer must give you a written disclosure on a standalone document explaining that a consumer report may be obtained for employment purposes, and must get your written authorization.7Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The standalone requirement matters. It cannot be buried inside an employment application or mixed with other paperwork. If the employer plans to take adverse action based on the report, you are entitled to a copy and a chance to dispute it before the decision becomes final.
What Your State Adds
State legislatures have moved faster than Congress, and the result is real variation depending on where you work.
Roughly a dozen states now have comprehensive data protection laws modeled on consumer privacy frameworks. Most of them explicitly exclude employee data, so the consumer privacy rights you read about in the news usually do not extend to information your employer collects. Only one state currently applies its comprehensive privacy law to HR data.
Targeted state laws do more for workers than the omnibus statutes. About 27 states prohibit employers from demanding your social media login credentials or forcing you to open personal accounts on demand. A handful require advance written notice before an employer begins electronically monitoring your computer, email, or internet use. Several states have biometric privacy laws that require your consent before an employer collects fingerprints, facial scans, or other biometric identifiers, with statutory damages that can range from $1,000 to $5,000 per violation.
Many states also give you a right to inspect your own personnel file, usually within about five to 35 business days of a written request. No federal law grants private-sector employees this access, so whether you have it depends entirely on your state.
The Data Categories That Get the Strongest Protection
Not every piece of information in your file is treated the same way. Protections tighten as the data gets more sensitive.
Your Social Security number, legal name, and home address appear on tax documents like the W-2 and are needed for payroll and government reporting.8Internal Revenue Service. Form W-2 Wage and Tax Statement A stolen credit card can be replaced. A stolen Social Security number follows you for years, which is why breaches involving these identifiers do so much lasting damage.
Medical information—whether from an accommodation request, a fitness-for-duty exam, or a return-to-work note—must be stored separately from your general personnel file under the ADA.4Office of the Law Revision Counsel. 42 USC 12112 – Discrimination Genetic information carries an even higher bar: your employer generally cannot collect it at all, and any genetic data obtained through a narrow exception must be kept in aggregate form that does not identify individual employees.6Office of the Law Revision Counsel. 42 USC 2000ff-1 – Employer Practices
Biometric data is a category of its own. Fingerprints, palm scans, and facial recognition templates used for building access or time clocks cannot be reset the way a password can. In states with biometric privacy statutes, employers must get informed written consent before collection and must disclose how long the data will be stored. Class-action litigation over biometric collection has become one of the fastest-growing areas of employment privacy law.
Financial data—bank account and routing numbers for direct deposit, plus credit reports and background checks from hiring—rounds out the most sensitive categories. The FCRA’s standalone disclosure requirement trips up a surprising number of employers who bundle it into broader onboarding paperwork.7Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Monitoring on Company Systems vs. Your Own Devices
If you are using a company-owned computer or phone, assume your employer can see what you do on it. The provider exception under the ECPA gives employers broad latitude to monitor communications on their own systems, including email, web browsing, keystrokes, and application usage.3Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Courts generally uphold these practices when the employer gave prior notice, which is why the disclosure in your handbook matters so much. A minority of states require written notice before electronic monitoring begins.
Video cameras in lobbies, hallways, and other common areas are standard and generally legal. The line is reasonable expectation of privacy: cameras are prohibited in restrooms, locker rooms, and changing areas. Audio recording is a higher-stakes area because of wiretapping laws. Federal law allows recording when one party consents, but roughly a dozen states require all parties to consent.
Remote work has pushed monitoring into employees’ homes and created questions the older statutes were not written to answer. On a company-issued device, the employer keeps the same monitoring authority it would have in the office no matter where you sit. On a personal device, the picture changes. The Stored Communications Act prohibits unauthorized access to your personal accounts, and the Computer Fraud and Abuse Act at 18 U.S.C. § 1030 can apply if an employer accesses your personal computer or phone without permission.2Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications The gray area appears when you use a personal device to reach company networks or install company software. The employer may have a legitimate interest in monitoring company data on that device, but does not gain blanket authority to look through your personal files and photos.
If your employer uses productivity software that captures screenshots, records keystrokes, or activates webcams, find out whether it runs only during work hours or continuously. The practical rule: keep personal activity on personal devices, and treat any company-provided equipment as fully monitored at all times.
Public social media is fair game for your employer to review; private accounts behind a login generally are not. About 27 states specifically prohibit employers from demanding your usernames or passwords or requiring you to log in during an interview or on the job.
Seeing and Correcting Your Own Records
In states that grant personnel file access, you can typically submit a written request and review your file within a few weeks. That review lets you check performance evaluations, salary history, and disciplinary records for accuracy. Many states allow you to demand corrections when you find errors. Some let you submit a written rebuttal that becomes part of your permanent file if the employer refuses to make the change.
Access rights generally do not extend to internal investigation files, documents prepared for litigation, or materials tied to future business planning. Employers can also withhold reference letters and management notes genuinely being used for ongoing strategy. Your access right covers the records that drive employment decisions about you, not every document that mentions your name.
If You Get a Breach Notification
All 50 states and the District of Columbia require companies to tell affected individuals when their personal information has been compromised. Deadlines vary: some states require notice within 30 days, others allow 60 or 90, and some simply say “without unreasonable delay.” There is no comprehensive federal breach notification law for private employers, though sector-specific rules cover healthcare and financial services.
If your employer notifies you of a breach involving your Social Security number, financial account information, or login credentials, act quickly. Place a fraud alert or credit freeze with the three major credit bureaus. Monitor financial accounts for unfamiliar transactions. Change passwords for anything affected. Employers often offer free credit monitoring after a breach; it won’t prevent identity theft, but it can help you catch problems early. The notification letter should tell you what data was exposed, when the breach happened, and what the company is doing about it. If it doesn’t, ask.
Two Common Assumptions That Are Wrong
HIPAA is the first one. It applies to health plans and healthcare providers, not to your employer as an employer.5U.S. Department of Health and Human Services. Am I a Covered Entity Under HIPAA Your employer-sponsored group health plan is a separate legal entity bound by HIPAA and can only share your protected health information with the employer under specific conditions. When it comes to medical records the employer itself holds, the ADA is the governing law.
The GDPR is the second. It protects data subjects located in the European Union.9Your Europe. Data Protection Under GDPR It does not directly cover U.S.-based employees just because their employer is European. Where it can matter is when a multinational firm adopts a single global privacy standard to comply with the GDPR everywhere; that often raises the privacy floor for American employees beyond what U.S. law requires. If your employer has a global data protection policy, read it. It may give you access, correction, and deletion rights that federal law here does not.