12.1 Notice, AEP, CRA, ADA, and GINA
Key Takeaways
- A private-sector employee has no Fourth Amendment claim against a private employer; workplace privacy comes from notice, the appropriate expectation of privacy, statutes, and common law.
- Written notice that the employer owns the device or records the space is the practical control that shrinks the appropriate expectation of privacy.
- Title VII of the Civil Rights Act of 1964 forbids monitoring or screening used to discriminate and facially neutral tools that have an unjustified disparate impact.
- The ADA bars all disability-related inquiries and medical exams before a conditional offer; post-offer exams are allowed if applied to the whole job category; during employment they must be job-related and consistent with business necessity; medical files stay separate from personnel files.
- GINA Title II forbids using genetic information, including family medical history, in employment decisions and generally forbids requesting it; a wellness incentive may not be conditioned on answering genetic questions.
12.1 Notice, AEP, CRA, ADA, and GINA
Domain IV of the IAPP CIPP/US Body of Knowledge 2.6.1 (effective 1 September 2025) is Workplace Privacy and accounts for only 4–6 of the exam's 90 questions. Those few items are dense. Competency IV.A is workplace-privacy concepts; this section is performance indicator IV.A PI1. Later sections add the agencies and pre-employment screening. Almost every Domain IV fact pattern still collapses back to one idea: U.S. workplace privacy is a patchwork of notice, expectation, and named statutes, not a general constitutional right to be left alone at work.
There is no Fourth Amendment claim against a private employer
The Fourth Amendment constrains government searches and seizures. It does not run against a private retailer, hospital, software vendor, or factory. A private employee who says "they searched my locker without a warrant" is making a constitutional argument that the exam will mark wrong. Public-sector employees can raise constitutional issues against a government employer; that is a different case. CIPP/US Domain IV is built around the private-sector workplace.
Private-sector limits come from four other places:
- The employee's appropriate expectation of privacy (AEP) — IAPP's workplace phrase for the reasonable-expectation idea.
- Notice and other employer practices that shrink that expectation.
- Federal and state statutes (Title VII, the ADA, GINA, the FCRA, the EPPA, state password and fair-chance laws).
- Common-law claims such as intrusion upon seclusion, plus contract and handbook promises.
Appropriate expectation of privacy
Appropriate expectation of privacy is the exam's first workplace filter. Ask three practical questions before you reach for a statute:
| Factor | Higher AEP | Lower AEP |
|---|---|---|
| Notice | No policy, no banner, no posted sign | Clear written policy, login banner, posted camera notice |
| Ownership | Employee-owned phone used only for personal matters | Employer-issued laptop, badge, vehicle, or email account |
| Space | Restroom, lactation room, locked personal locker used only for personal items | Open cubicle, shop floor, loading dock, shared server |
| Audience | One-to-one conversation the employer did not invite | Speech the employee posted publicly or sent through the company system |
Notice is the practical control that shrinks AEP. A handbook that says "company email, laptops, and the warehouse floor are monitored," a login banner, and a camera placard in the stockroom do more exam work than any constitutional slogan. After notice, the employee who treats the company inbox as a personal diary has a weak AEP. The same employee still has a strong AEP in a restroom stall, because some spaces stay private even after a general monitoring policy.
Scenario. A logistics firm issues laptops, posts a written electronic-communications policy, and displays a login banner. An employee stores personal tax returns in a folder labeled "Private" on the company drive. A manager opens the folder during a theft investigation. The Fourth Amendment is not in play. AEP is low because of ownership plus notice. A different result follows if the same manager hides a camera inside a restroom. Notice cannot legalize that space, and common-law intrusion plus state voyeurism statutes still apply.
Device ownership is the second lever. An employer-issued phone is usually the employer's equipment. A bring-your-own-device (BYOD) phone is mixed: the employer may have a legitimate interest in the work container or the MDM profile the employee agreed to, and a much weaker claim to personal photos, personal SMS, and a personal iCloud backup. The exam wants you to separate the work layer from the personal layer instead of treating "the phone" as one legal object.
Title VII of the Civil Rights Act of 1964
Title VII of the Civil Rights Act of 1964 (CRA) is not a general privacy statute. It is an anti-discrimination statute that becomes a workplace-privacy statute when monitoring or screening is the tool of discrimination. Title I of the CRA's employment title, as amended, covers employers with 15 or more employees and forbids discrimination because of race, color, religion, sex, or national origin. The Equal Employment Opportunity Commission (EEOC) enforces it.
Two theories matter on CIPP/US:
- Disparate treatment. The employer uses monitoring or a screen because of a protected trait — for example, extra GPS tracking only of workers of one national origin, or a social-media review applied only to applicants who appear to be a particular religion.
- Disparate impact. A facially neutral tool disproportionately excludes a protected class and is not job-related and consistent with business necessity. A strength test, a criminal-records rule, a credit screen, or an automated résumé scorer can all be Title VII problems even when no one intended bias.
Title VII does not require an employer to stop all monitoring. It requires the employer not to aim that monitoring at a protected class and not to keep a neutral tool that knocks out a protected class without a real job-related reason. When the same tool is an automated employment decision tool, New York City Local Law 144 (covered in section 12.3) adds a bias-audit overlay; Title VII remains the federal floor everywhere.
Americans with Disabilities Act — three stages
Title I of the Americans with Disabilities Act of 1990 (ADA), as amended, also covers employers with 15 or more employees. The EEOC's enforcement guidance splits disability-related inquiries and medical examinations into three stages. The stage is the whole question.
| Stage | What the employer may do | What the employer may not do |
|---|---|---|
| Pre-offer | Ask whether the applicant can perform the job, with or without reasonable accommodation, and how the applicant would do the work | Ask about a disability, the nature of an obvious disability, workers' compensation history, or prescription drugs; require a medical exam — even a job-related one |
| Post-offer (conditional offer, before start) | Ask disability-related questions and require medical exams, even if they are not job-related | Apply the questions or exams to only some people in the same job category; withdraw the offer because of a disability unless the person cannot perform essential functions with or without reasonable accommodation, or poses a direct threat |
| During employment | Make a disability-related inquiry or require a medical exam only if it is job-related and consistent with business necessity (for example, an accommodation request or a reasonable belief the employee cannot work safely) | Run a medical exam because a supervisor is curious, or condition continued employment on a broad physical that is not tied to the job |
Confidentiality is its own ADA rule. Medical information from an inquiry, an exam, a wellness program, or a voluntary disclosure is a confidential medical record. It must live in a file separate from the personnel file, with access limited to people who need it (a supervisor who must implement a work restriction, first-aid staff, or a government investigator). Dumping a diagnosis into the ordinary HR folder is an ADA violation even if no one was fired.
Scenario. A warehouse posts an opening and, on the application, asks "List every prescription you take" and requires a pre-interview physical. Both steps are pre-offer medical inquiries or exams. They are unlawful even if the employer intends to ignore the answers until after an offer. The lawful sequence is: assess ability to do the job → extend a conditional offer → then run the same medical exam for every person hired into that job category → keep the results in a separate medical file.
Genetic Information Nondiscrimination Act
Title II of the Genetic Information Nondiscrimination Act of 2008 (GINA) took effect on 21 November 2009. The EEOC enforces Title II (employment). Title I, which limits health-insurer use of genetic information, is a Labor / HHS / Treasury rule set, not an EEOC file. GINA covers employers with 15 or more employees.
Genetic information includes the individual's genetic tests, the genetic tests of family members, and family medical history (the manifestation of a disease or disorder in a family member). It also includes a request for genetic services, participation in genetic research, and genetic information of a fetus or embryo. The EEOC's bright line is exam-ready: an employer may never use genetic information to make an employment decision, because genetic information is not relevant to an individual's current ability to work.
GINA also generally forbids a covered entity to request, require, or purchase genetic information. Six narrow exceptions exist: inadvertent overhearing; voluntary health or genetic services (including a wellness program) that meet specific conditions; family-history certification for Family and Medical Leave Act (FMLA) or similar leave to care for a family member; commercially and publicly available documents the employer is not searching in order to find genetic information; a legally required or carefully conditioned genetic monitoring program for workplace toxins; and forensic or remains-identification DNA work. Genetic information must be kept confidential and in a separate medical file; it may share the ADA medical file.
Wellness-program limits. A wellness program may collect family medical history only if participation is voluntary. The surviving EEOC GINA regulation is the 2010 rule: the employer may not condition an incentive on the employee providing genetic information. If a health-risk assessment includes family-history questions, those questions must be identified and the employee must be told, in ordinary language, that the incentive is available even if those questions are left blank. The 2016 EEOC wellness rules that tried to bless a 30 percent of self-only coverage inducement were vacated after AARP v. EEOC and removed from the Code of Federal Regulations effective 2019. Do not treat that 30 percent figure as current GINA or ADA law.
Scenario. A benefits vendor's health-risk assessment asks "Has a parent or sibling had breast cancer?" and pays a $200 premium credit only if every question is answered. That is a GINA problem: family history is genetic information, and the incentive is conditioned on providing it. The same question can appear if it is clearly optional and the $200 is paid whether or not it is answered. Using the answer to deny a promotion is independently unlawful — GINA never allows genetic information to drive an employment decision.
How these pieces stack
On the exam, walk the fact pattern in this order: (1) private employer, so no Fourth Amendment; (2) notice, ownership, and space, so you know the AEP; (3) Title VII if the tool treats a protected class worse or has an unjustified impact; (4) ADA if the question or exam is medical; (5) GINA if the information is genetic or family history. Notice can shrink AEP. Notice cannot authorize a Title VII, ADA, or GINA violation.
A private retailer installs cameras in a company-owned stockroom after posting a written notice that the space is recorded. An employee later claims the cameras violate the Fourth Amendment. What is the CIPP/US-correct analysis?
Under EEOC ADA guidance, when may a private employer require a medical examination of a job applicant?
Which statement correctly states Title II of GINA as the EEOC enforces it?