WILSON ELSER’S PRIVACY POLICY FOR CALIFORNIA PARTNERS, EMPLOYEES AND JOB APPLICANTS

Effective Date: September 13, 2024

Welcome to Wilson Elser! At Wilson Elser (“Wilson Elser”, “us” or “we”), we are committed to protecting the privacy and security of the personal information of our partners, employees and job applicants. In accordance with the California Consumer Privacy Act (CCPA), as amended, this privacy policy (“Policy”) outlines how we collect, use and disclose your personal information during the course of your employment, application or recruitment process. We understand the importance of maintaining the confidentiality and security of your information, and we strive to ensure compliance with applicable privacy laws and regulations.

NOTICE AT THE TIME OF THE COLLECTION

Before providing your personal information to us, please carefully review this Policy. When, after reading this Policy, you provide your personal information to us, that will mean that you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described herein. Please be assured that Wilson Elser will only use your information in accordance with this Policy.

WILSON ELSER’S ONLINE AND OFFLINE INFORMATION PRACTICES

A. Personal Information We Collect

Under the CCPA, we are required to disclose the categories of personal information that Wilson Elser collects from partners, employees and job applicants. These categories include:

Identifiers: This category encompasses information such as your name, contact details, social security number (collected post-offer), driver's license number (collected post-offer) and other similar identifiers necessary for employment, recruitment or the application process.

Personal information as defined in Ca. Civ. Code § 1798.80: This category includes information such as your signature, education history, employment history, prior professional affiliations, professional qualifications and other background check-related information.

Protected classifications: This category includes characteristics of protected classifications under California or federal law. For example, we may collect information about your gender, LGBTQ+, race, ethnicity, disability status and veteran or military status, as permitted by law.

Commercial information: This category of information may include records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies. Wilson Elser does not collect this category of information from partners, employees or job applicants. We would collect your history of employment with Wilson Elser.

Biometric information: In certain circumstances, businesses may collect and store biometric data, such as fingerprints or photographs, for security or timekeeping purposes. Wilson Elser does not collect this category of information from partners, employees or job applicants.

Internet or other electronic network activity information: This category includes data collected through our electronic systems, such as IP addresses, browsing history and interaction with our websites and applications, for IT and security purposes. We may collect this information to the extent that you are using Wilson Elser’s devices for your Internet access or accessing Wilson Elser’s networks, downloading Wilson Elser’s software or applications on your devices or using Wilson Elser’s access key cards or key fobs for access to our offices.

Geolocation data: We may collect information about your physical location, such as through GPS or Wi-Fi signals, for security or operational purposes (for example, to assess where our devices are located during the course of the business day). We do not collect precise geolocation data on our job applicants, partners or employees working at a Wilson Elser office or from home unless you are using a Wilson Elser device or application which may automatically transmit such information to us. Furthermore, if you interact with any Wilson Elser website, application or platform using your own device, our systems may automatically receive information as to your approximate geolocation (city and state).

Sensory information: This category covers audio and visual information, such as recordings of calls or video calls, collected for quality assurance, training or troubleshooting purposes. Wilson Elser may record certain meetings or training sessions conducted online; additionally, in-person Continuing Legal Education (CLE) events or similar presentations may be recorded.

Professional or employment-related information: We collect information such as job title, work experience, employment history, prior professional affiliations and performance evaluations during the course of your employment, recruitment or application process.

Non-public education information: If applicable, we may collect educational records and CLE records, such as transcripts or degrees, to verify qualifications for certain positions.

Inferences drawn from personal information: We may use your personal information to create an employee, partner or job applicant profile reflecting your qualifications, licenses, job performance, absences, promotions, disciplinary actions and similar information, where applicable. This information may be used by your supervisors as part of your job performance evaluation.

Please note that the specific categories of information collected may vary depending on the nature of your role and the applicable legal requirements.

B. Categories of Sources from Which Your Personal Information is Collected

As a law firm and an employer, Wilson Elser collects personal information for partners, employees and job applicants from the following categories of sources:

Directly from individuals: We collect information directly from you when you provide it during the application process, interviews, onboarding, surveys or throughout your employment or affiliation with us. This may include information submitted on resumes, application forms or through our communication channels.

Service Providers: We may obtain personal information from our service providers or vendors, such as background check providers or recruitment agencies, to verify qualifications, conduct reference checks or facilitate the hiring process.

Publicly available sources: To the extent permissible under the applicable federal, state and local laws, we may gather information from publicly available sources, such as professional networking platforms, websites or your social media accounts, to gain insights into your professional background.

Company systems and records: During your employment or affiliation with us, we may collect personal information from internal systems and records, including HR databases, timekeeping systems, performance evaluations, other employment-related platforms and similar resources or platforms for our partners.

Please note that the specific sources from which we collect personal information may vary depending on the circumstances and applicable legal requirements.

C. Business Purposes for Collecting Personal Information

We may collect the personal information of partners, employees and job applicants for the following business purposes:

Recruitment and hiring: Collecting personal information is necessary to evaluate and process applications, conduct interviews, verify qualifications and make informed hiring and recruitment decisions.

Activities related to employment and recruitment: Personal information may be collected to facilitate various activities related to employment and recruitment, such as onboarding, establishing employment or lateral partner relationships, administering benefits, payroll and draw payments, and maintaining employee and partner records.

Performance management and development: Personal information may be collected to assess employee or partner performance, provide feedback, offer training and development opportunities, and support career advancement within our organization.

Compliance with legal obligations: We collect personal information to comply with applicable laws and regulations, including employment and tax laws, reporting requirements and ensuring a safe and secure work environment.

Communication and engagement: Personal information may be collected to communicate with employees and partners regarding work-related matters, organizational updates, company events and employee and partner engagement initiatives.

Internal operations: Personal information may be collected for internal administrative purposes, such as managing work assignments, scheduling, resource allocation and maintaining business records.

Responding to clients or other requests: Wilson Elser processes employee or partner information in order to respond to our client’s requests for information, participate in certification processes (for which aggregated data is provided) and provide information to publishers on the authors of legal articles.

Security and safety: Personal information may be collected to ensure the security and safety of employees, partners, job applicants and company assets through measures like access controls, monitoring systems and incident response protocols.

Research and development: In some cases, personal information may be used for research and development purposes to improve processes, policies, and employee and partner experiences within the organization.

D. Categories of Personal Information Sold or Shared to Third Parties in the Preceding Twelve (12) Months

Wilson Elser does not share or sell partner, employee or job applicant information to third parties. Please note that the terms “sale,” “sharing” and “third-party” are defined in CCPA and have a specific meaning that may be different from a dictionary definition or a common understanding of these words. Notably, persons or entities to whom an organization may disclose personal information for a disclosed business purpose pursuant to a written contract are not considered “third parties.”

Wilson Elser does disclose personal information to our service providers, such as background check providers, recruitment agencies, payroll, draw and benefits vendors, pursuant to written agreements.

E. Categories of Third Parties to Whom We Have Sold or Shared Personal Information in the Preceding Twelve (12) Months

As set forth in section (D) above, Wilson Elser does not share or sell partner, employee or job applicant information to any third parties, as this term is defined in the CCPA. 

F. Business Purpose for Selling or Sharing Personal Information to Third Parties

As set forth in section (D) above, Wilson Elser does not share or sell partner, employee or job applicant information to any third parties, as this term is defined in the CCPA.

G. Personal Information of Persons Under Sixteen (16) Years of Age

Wilson Elser does not knowingly employ, affiliate with, recruit or collect, use, sell or share personal information of individuals under 16 years of age.

H. Categories of Service Providers to Whom We Have Disclosed Personal Information in the Preceding Twelve (12) Months

Wilson Elser does not disclose employee, partner or job applicant information to third parties, as this term is defined in the CCPA. However, in the past twelve (12) months, Wilson Elser disclosed personal information to our service providers or vendors, such as background check providers or recruitment agencies, to verify qualifications, conduct reference checks or facilitate the hiring process; medical and benefits providers (post-offer), to enroll our employees and partners into the benefits programs that they elect; payroll providers, to facilitate employee and partner compensation payments; or training vendors (post-offer), to provide required training to our employees and partners. Such disclosures are pursuant to written data-sharing agreements with such providers.

I. Categories of Personal Information Disclosed to Service Providers in the Preceding Twelve (12) Months

Wilson Elser does not disclose partner, employee or job applicant information to third parties, as this term is defined in the CCPA. However, in the past twelve (12) months, Wilson Elser disclosed the following categories of personal information to our service providers or vendors:

• Identifiers
• Personal information as defined in Ca. Civ. Code § 1798.80
• Protected classifications
• Professional, employment-related or recruitment-related information
• Non-public education information
• Internet or other electronic network activity
• Inferences drawn from personal information

J. Business Purpose for Disclosing Personal Information to Service Providers

Wilson Elser does not disclose partner, employee or job applicant information to third parties, as this term is defined in the CCPA. However, in the past twelve (12) months, Wilson Elser disclosed personal information to our service providers or vendors, such as background check providers or recruitment agencies, to verify qualifications, conduct reference checks or facilitate the hiring process. Such disclosures are pursuant to written data-sharing agreements with such providers.

K. Use or Disclosure of Sensitive Personal Information

Wilson Elser does not use or disclose sensitive personal information for purposes other than those specified in Section 7027 (m) of the California Consumer Privacy Act Regulations. Specifically, Wilson Elser only uses or discloses sensitive personal information of partners, employees or job applicants to:

(1) Perform the services expected by our partners, employees or job applicants in connection with their employment or recruitment, applications for employment or recruitment, such as processing applications, background checks and functions attendant the employment or partnership relationship.

(2) Prevent, detect and investigate security incidents that compromise the availability, authenticity, integrity or confidentiality of stored or transmitted personal information.

(3) Resist malicious, deceptive, fraudulent, or illegal actions directed at the business and prosecute those responsible for those actions.

(4) Ensure the physical safety of natural persons.

(5) Perform services on behalf of the business. For example, we may use information for the purposes of hiring, processing applications, background checks and functions attendant to the employment or partnership relationship.

(6) Verify or maintain the quality or safety of devices that we own or control, and improve, upgrade or enhance such devices.

L. How Long Your Personal Information Will Be Kept

Consistent with our legal obligations, we will keep your personal information for the duration of time necessary to accomplish the business purposes for which this information was provided to us. If you are an employee or partner, we will keep your personal information for the duration of your employment relationship/partnership with Wilson Elser, plus the time equal to the statute of limitations for any claims that may arise out of such employment relationship/partnership under any applicable laws.

If you are a job applicant, we will keep your personal information (including your application records, resume and our notes related to your interviews and our contact with you) for seven years from the date of your original application. You have the right to request that we delete your personal information. Please see the EXPLANATION OF YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION section below.

Additionally, we may be required to keep your personal information for as long as is necessary:

• To respond to questions or complaints made by you or on your behalf.
• To comply with legal obligations and to enforce our rights.
• To show that we treated you fairly.
• To keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this Policy. Different retention periods apply for different types of personal information. When it is no longer necessary to retain your personal information, we will delete or anonymize it.

EXPLANATION OF YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION

1. The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling or sharing personal information, the categories of third parties to whom we may disclose personal information and the specific pieces of personal information we have collected about you.

2. The right to delete personal information that we have collected from or about you, subject to certain exceptions. We may deny your deletion request if retaining the information is necessary for us to:
   1. Complete the transaction for which we collected the personal information, namely, your employment or affiliation with us, or processing your application for employment or recruitment. Without collecting and using the necessary personal information, it would not be possible for us to maintain an ongoing employment relationship with you.
   2. Detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, or prosecute those responsible for such activities.
   3. Debug, to identify and repair errors that impair existing intended functionality.
   4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided for by law.
   5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
   6. Engage in public or peer-reviewed scientific, historical or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
   7. Enable solely internal uses that are reasonably aligned with your expectations based on your employment or affiliation with us, or job applicant relationship with us.
   8. Comply with a legal obligation.

3. The right to correct inaccurate personal information that we maintain about you.

4. If the business sells or shares personal information, the right to opt out of the sale or sharing of their personal information by the business. That said, Wilson Elser does not sell or share the personal information of partners, employees or applicants.

5. If the business uses or discloses sensitive personal information for reasons other than those set forth in section 7027 (m) of the California Consumer Privacy Act Regulations, the right to limit the use or disclosure of sensitive personal information by the business. That said, Wilson Elser does not use or disclose the personal information of partners, employees or job applicants for reasons other than those set forth in section 7027 (m) of the California Consumer Privacy Act Regulations.

6. The right to non-discriminatory treatment by us for exercising privacy rights conferred by the CCPA, including a partner’s, employee’s, applicant’s or independent contractor’s right to no retaliation for exercising their CCPA rights. Please be assured that Wilson Elser does not and will not retaliate against partners, employees, job applicants or independent contractors for the exercise of their data privacy rights.

HOW YOU CAN EXERCISE YOUR CCPA RIGHTS AND WHAT YOU CAN EXPECT FROM THE PROCESS

To exercise the rights described above, please submit a request to us via email or regular mail.

Email:    privacy@wilsonelser.com

Mail to:

Wilson Elser Moskowitz Edelman & Dicker LLP

150 E 42nd St #23, New York, NY 10017

Attn: Privacy Requests

You may be limited to two consumer requests for access or data portability in any given 12-month period. Your consumer request must meet the following conditions:

1. Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or a legally authorized representative.
2. Describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it.
3. Before responding to your privacy rights request, depending on the nature of your relationship with us, we may need to verify your identity to make certain that you have the right to receive the information you request. We may verify your identity by matching at least two reliable data points from your request to the information that we maintain about you. For more sensitive personal information, we may require further verification, including obtaining your signed declaration under penalty of perjury to confirm that the requestor is the consumer. Once you contact us to exercise your rights, we will further guide you as to our verification process.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us.  We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

Authorized Agents

Only you or a person that you authorize to act on your behalf may make a verifiable consumer request related to your personal information. You may use an authorized agent to submit a privacy rights request on your behalf if you provide the authorized agent a written permission signed by you. We may also require you to do either of the following:

(1) Verify your own identity directly with us.

(2) Directly confirm with us that you provided the authorized agent permission to submit the request.

We may deny a request from an authorized agent if the agent cannot provide us with your signed permission demonstrating that they have been authorized to act on your behalf, or if you do not confirm with us that you provided the authorized agent permission to submit the request.

Response Timing and Format

We will acknowledge your request no later than ten (10) business days after receiving your request to delete, request to correct or request to know, and provide information about how we will process the request. The information provided shall generally describe our verification process and when you should expect a response, except in instances where we have already granted or denied the request.

We shall respond to your verifiable consumer request within 45 calendar days of its receipt.  If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding receipt of the verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable, enabling you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded.  If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. For example, in cases where requests from a consumer are distinctly unsubstantiated or excessive, particularly due to their repetitive nature, we may, at our discretion, charge a reasonable fee considering the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request altogether.

Global Opt Out Preference Signal

As we do not sell or share the personal information of our partners, employees or job applicants, Wilson Elser does not process opt out preference signals with respect to partner, employee or job applicant personal information. 

Personal Information of Consumers Under 16 Years of Age

We do not knowingly collect or process personal information of any persons under 16 years of age. If we become aware that such information was submitted to us, we will promptly delete it.

Modifications of This Privacy Policy

We reserve the right to change this Privacy Policy at any time. We will provide you with an updated Privacy Policy before collecting any additional information or before continuing to process your personal information for the business purposes disclosed above.

CONTACT INFORMATION

For any questions or concerns about our privacy policies and information practices, please email privacy@wilsonelser.com.