Industry
Part of How employee guidelines earn trust when three sentences carry most of the weight
5 things nobody tells you about employee guidelines checklist
Five things a workplace posting checklist rarely says out loud, from BIPA consent rules to New York City's screening limits and school phone bans.
What to take away
- An employee guidelines checklist covers what you publish. It rarely covers what your employer collects about you, and the rules with fixed dollar figures attach to collection.
- Illinois BIPA, at 740 ILCS 14, requires written notice and a written release before fingerprint or face scans. Damages are $1,000 for a negligent violation and $5,000 for an intentional or reckless one.
- New York City's screening rule, NYC Administrative Code Section 8-107(33), blocks password and username requests. An employer-issued device used for business is the clearest exception.
- A verified California data request gets an answer within 45 days, with one 45-day extension.
- School phone bans at San Francisco Unified and Miami-Dade reach staff posting, not student phones only.
1. Checklist items that decide most cases
Most checklists state what you may not publish. They leave out what is gathered about you: badge scans, location history, camera footage, wellness entries. That gap is where statutes with damages attach.
The difference between an internal rule and a published regulation is set out item by item in how a regulation checklist reads.
What a checklist for an employee should hold:
Checklist items that decide most cases
- Whether the rule covers work devices only, or every account you post from.
- Who owns each account, personal and work.
- The person to ask before publishing, and the answer time.
- What is collectedbiometric, location, wellness, keystroke.
- Whether a school rule reaches posts that show students.
- Where an approval or refusal is recorded.
- The version date of the document you rely on.
If it answers fewer than four, the rest is your exposure. Asking before you publish is the cheapest step available, and a written answer is worth keeping.
The ask route before publishing
- Check guidelines for who to ask
- Ask a short question before publishing
- If no route, ask in writing
- Keep written question and answer
- Absence of route is not yours to solve silently
2. The three stop signs and their remedies
Three categories are not judgment calls: someone else's personal information, unreleased work or decisions, and security detail. Each has a different remedy.
The three stop signs and their remedies
Why it is different
- Someone else's personal information
- Harm lands on a person who had no say
- Unreleased work or decisions
- Consequences reach colleagues, customers and contracts
- Security detail
- Cannot be un-said, and the audience is wider than you intend
What to do instead
- Someone else's personal information
- Strip the identifying detail, or do not post
- Unreleased work or decisions
- Ask whoever owns the announcement
- Security detail
- Raise it through the internal security route
Three stop signs, not judgment calls
Stop sign
- Personal information
- Harm lands on a person
- Unreleased work
- Reaches colleagues and contracts
- Security detail
- Cannot be un-said
Why different
- Personal information
- Remove detail or don't post
- Unreleased work
- Ask whoever owns announcement
- Security detail
- Raise internally via security route
Instead
- Personal information
- Unreleased work
- Security detail
Everything else, including most complaints and most opinions, is judgment. A checklist that treats every call as a stop sign trains people to ignore it. What the employer's own document should carry, section by section, is covered in how employee guidelines earn trust.
3. Password requests and screening limits
New York City's rule covers applicants and current employees. It bars requesting or requiring a username, password or other login credentials for a personal social media account. It also bars asking you to log in while someone watches.
The clearest exception is an account or device the employer provided and paid for and that is used for business purposes. A screening duty imposed by a regulator on a licensed role is another.
A third-party check changes the analysis. A social media background check bought from an outside firm is a consumer report, and the FTC guidance on consumer reports for employers sets out the permission and notice steps that follow.
4. The 45-day data request clock
A California employer that collects your personal information owes you notice at collection. It must answer a verified request within 45 days under Cal. Civ. Code Section 1798.130, and it may take one 45-day extension if it tells you. The California Attorney General's CCPA page lists the rights and the business duties.
The 45-day data request clock
- Send the request to the privacy contact in the notice at collection, not to your manager.
- Note the date you sent it. The clock starts when the request is verifiable.
- If the deadline passes, escalate to the privacy officer, then to the regulator.
If you are asked to help answer a colleague's request, treat the deadline as legal work and route it.
5. School phone bans and staff accounts
California's AB 3216, the Phone-Free Schools Act, was signed in 2024. It requires districts to adopt a phone policy by July 1, 2026, which is why San Francisco Unified's rule is still settling. How a district writes that policy is covered in getting school policies right the first time.
Florida's HB 379, from 2023, led Miami-Dade to restrict phones during instructional time. Austin ISD writes its own board policy, so its reach is set there.
Read any of them on three axes: instructional time or bell to bell; whether lunch and passing periods count; and whether staff may post a student's face, name or work. That question is where a checklist written for an office fails, because the phone ban does not decide it.
Platform enforcement, and your own record
A takedown, suspension or age check runs on the platform's terms, not on your workplace guidelines. Section 230, at 47 U.S.C. 230, is the provision that lets a platform moderate user content without becoming its publisher.
Keep a dated copy of what you publish. Correct errors in the open instead of deleting quietly. If someone raises a concern, ask for it in writing and note the exchange. What an enforcement action is and what follows covers the appeal route when the platform acts rather than the employer.
Common questions
Can my employer ask for my social media password?
Not in New York City, under Section 8-107(33), and several states set similar limits. Elsewhere the answer depends on your contract and on local law.
How long does my employer have to answer a data request about me?
In California, 45 days from a verified request, extendable once by 45 days with notice. Other jurisdictions set their own clocks.
Do school phone bans affect what staff may post about students?
They can. District policy and student privacy rules usually decide what a staff account may show, not the phone ban alone.
