Employee data protection laws in the United States are not one statute but a stack of them: the ADA governs medical files, GINA blocks the use of genetic information, the FCRA controls background checks, the ECPA sets limits on monitoring, and state laws — led by California’s privacy act and Illinois’s biometric statute — fill the gaps federal law leaves open. Together they decide what your employer can collect about you, who inside the company can see it, how long it must be kept, and what has to happen if it leaks.
The rules differ by category of information, so it helps to see what actually sits in an employer’s files before looking at which law applies to which piece.
What Counts as Protected Employee Information
The data an employer holds about a worker typically falls into six buckets:
- Identity and tax records: Social Security numbers, legal name, address, date of birth, and I-9 citizenship documentation.
- Financial data: bank and routing numbers for direct deposit, wage and salary history, and tax withholding elections.
- Health information: insurance enrollment records, disability accommodation requests, workers’ compensation claims, and drug testing results.
- Background and investigative data: criminal history, credit reports, driving records, and reference checks, generally kept apart from the main personnel file.
- Performance and disciplinary records: evaluations, warnings, improvement plans, and promotion or termination decisions.
- Biometric identifiers: fingerprints, facial geometry, retinal scans, voiceprints, and palm scans collected through timeclocks or access controls.
No single security policy covers all of these, because each bucket is governed by a different law.
Medical Records: HIPAA Rarely Applies, but the ADA Does
The most common misconception about workplace privacy is that HIPAA broadly protects employee medical records. It usually doesn’t. The HIPAA Privacy Rule covers health plans, healthcare providers, and clearinghouses. In most cases, it does not apply to an employer’s actions, even when the employer holds health information about workers.1U.S. Department of Health and Human Services. Employers and Health Information in the Workplace A doctor’s note in your personnel file, a workers’ compensation record, or a sick-leave form generally sits outside HIPAA’s reach. An employer-sponsored group health plan is itself a covered entity and must handle enrollee data under HIPAA, but that is the plan, not the employer’s HR function.
The law that actually forces most employers to protect medical information is the Americans with Disabilities Act. The ADA requires that any medical information about an employee be collected on separate forms, stored in separate medical files apart from general personnel records, and treated as confidential.2Office of the Law Revision Counsel. 42 US Code 12112 – Discrimination Only a narrow group of people can see those records: supervisors who need to know about work restrictions or accommodations, safety personnel who may need to respond to a medical emergency, and government officials investigating ADA compliance. Medical documentation should never be filed alongside performance reviews or payroll.
Background Checks Under the FCRA
The Fair Credit Reporting Act controls how employers obtain and use background check reports. Before pulling a report, the employer must give the applicant or employee a clear written disclosure and get their written consent. If the employer plans to take adverse action based on what the report shows, it must first provide a copy of the report and a summary of the individual’s rights, then give them time to dispute inaccuracies before making a final decision.3Federal Trade Commission. Background Checks – What Employers Need to Know
This is where employers most frequently get sued. Skipping the written disclosure, burying it inside a multi-page application, or failing to send the pre-adverse action notice can each trigger liability. For willful noncompliance, an individual can recover statutory damages between $100 and $1,000 per violation, plus attorney fees and potentially punitive damages.4Office of the Law Revision Counsel. 15 US Code 1681n – Civil Liability for Willful Noncompliance
Genetic Information Under GINA
The Genetic Information Nondiscrimination Act flatly prohibits using genetic data in any employment decision, including hiring, firing, promotions, and pay. It also bars employers from requesting, requiring, or purchasing genetic information about employees or their family members.5U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination Genetic information here includes family medical history, genetic test results, and testing results for a family member. Enforcement follows the Title VII framework, so employees can pursue compensatory damages, back pay, and attorney fees through the EEOC.6U.S. Department of Labor. The Genetic Information Nondiscrimination Act of 2008
Electronic Communications and Personal Devices
The Electronic Communications Privacy Act restricts how employers can intercept or access private emails, phone calls, and other electronic messages. But the consent exception swallows most of the rule at work. If you have signed an acknowledgment that communications on company-owned devices are subject to monitoring — usually part of onboarding paperwork or an acceptable-use policy — the employer generally has legal cover to review those communications. Work email and company phones are largely fair game.
Personal devices are different. When employees use their own phones or laptops for work, the lines blur. There is no comprehensive federal BYOD law, but employers who access personal devices without clear written authorization risk ECPA liability. A written BYOD policy should spell out what the employer can access, what security measures are required, and when the employer can remotely wipe data from the device.
Biometric Data and State Laws
No federal law specifically regulates biometric data in the workplace, so protection depends on where you work. Illinois imposes the strictest rules through the Biometric Information Privacy Act, which requires a publicly available written policy with a retention schedule, written consent before collecting any biometric identifier, and compliance with strict disclosure rules. Illinois also lets individuals sue directly for violations, one of the few data protection statutes with a true private right of action. Colorado, Maryland, and New York have their own biometric rules with varying scope, and more states are actively considering similar legislation. Employers running fingerprint timeclocks or facial-recognition access systems have to check every state where they operate.
California’s Broader Employee Privacy Rights
California stands alone in applying a broad consumer privacy framework to employee data. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, originally exempted employee information, but that exemption expired at the end of 2022. California workers now hold the same rights consumers do: the right to know what personal information their employer collects and why, the right to request deletion in certain circumstances, and the right to correct inaccurate records. Employers must provide a formal notice at or before the point of collection describing the categories of personal information being gathered and how it will be used.7Office of the Attorney General – State of California. California Consumer Privacy Act (CCPA)
A boundary worth naming: comprehensive privacy laws in Virginia and Colorado are sometimes cited as giving employees similar rights, but both statutes explicitly exclude individuals acting in an employment context from the definition of “consumer,” and Colorado’s law goes further, stating it does not apply to data maintained for employment records purposes. Most other states with comprehensive privacy statutes have followed the same approach and carved out employee data. Don’t assume a state privacy law covers your workforce without checking whether employees are included.
What Happens After a Data Breach
All 50 states, the District of Columbia, and U.S. territories require organizations to notify individuals when a security breach compromises their personal information.8National Conference of State Legislatures. Summary Security Breach Notification Laws Specifics vary, but most laws set a deadline running from discovery of the breach, typically 30 to 60 days. Some states also require notice to the state attorney general or a consumer protection agency once the breach crosses a threshold number of affected people.
Separately, the FTC expects companies that collect sensitive personal information to keep reasonable security in place under Section 5 of the FTC Act and, for financial institutions, the Safeguards Rule. The agency has brought enforcement actions against organizations that failed to protect employee and customer data through basic measures like encryption, access controls, and secure disposal of old records.9Federal Trade Commission. Data Security
How Long Employers Must Keep Records
Federal law sets minimum retention periods that differ by record type. State laws may impose longer periods, so the federal numbers are a floor.
- Employment tax records: at least four years after the tax becomes due or is paid, whichever is later.10Internal Revenue Service. Topic No. 305, Recordkeeping
- Personnel and employment records, including job applications: at least one year under EEOC rules. If a discrimination charge has been filed, all related records must be kept until the charge or resulting lawsuit is fully resolved.11U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
- Form I-9: three years after the date of hire or one year after employment ends, whichever is later.12U.S. Citizenship and Immigration Services. I-9, Employment Eligibility Verification
Once the retention period runs out, secure disposal matters as much as secure storage. The FTC’s Disposal Rule requires reasonable measures when discarding information derived from consumer reports, which includes background checks obtained under the FCRA.9Federal Trade Commission. Data Security
Your Right to See and Correct Your Personnel File
No federal law gives private-sector employees a general right to inspect their personnel files. That right comes from state law, and roughly 20 states have enacted statutes requiring employers to allow access. Response times run from as little as 72 hours to as long as 45 days. In states without a specific statute, employees may have no legal mechanism to review their own records unless the employer voluntarily provides access or a collective bargaining agreement covers it.
Where the right exists, the process usually starts with a written request to HR or a designated privacy officer, and the employer must produce the file within the statutory window. The file should include performance, compensation, disciplinary, and employment-history documents. Some states let employers charge a small per-page copying fee; others require copies at no cost.
If the records contain errors, many state statutes let the employee submit a written correction or rebuttal that must be attached to the file going forward. The employer may update the record or, in some states, provide a written explanation for refusing the change. Correcting mistakes early matters, because an outdated disciplinary note or wrong job title can surface during an internal transfer review or a reference check before you know it exists.
Former employees generally have a narrower window. Several states extend file-access rights after separation, commonly for one year, but timeframes are shorter and the scope of accessible documents may be more limited. If you’re leaving a job, request your file before your last day; it’s far simpler than trying to get it later.
AI and Automated Employment Decisions
Employers increasingly use automated tools to screen resumes, analyze video interviews, monitor productivity, and flag performance issues. No comprehensive federal law governs AI-driven employment decisions yet. A December 2025 executive order signaled a push toward a national framework, but no specific requirements have been enacted.
State and local governments have moved faster. New York City’s Local Law 144 requires employers using automated employment decision tools to conduct an annual bias audit and notify candidates before the tool is used. Illinois requires specific disclosures and consent when employers use AI to analyze video interviews. California’s evolving regulations are pushing multi-state employers toward stricter recordkeeping and vendor oversight for any AI tools that touch hiring or performance evaluation.
The practical point for employees: if an algorithm makes or influences a decision about your hiring, pay, promotion, or termination, existing anti-discrimination laws still apply. The EEOC has said that using a biased tool does not shield an employer from liability under Title VII, the ADA, or GINA. If an automated system produces discriminatory outcomes, the employer bears the legal risk whether a human or a machine made the call.