After suffering a data breach that may have compromised the personal data of approximately 800,000 employees, the United States Postal Service (USPS) is now faced with a new problem — whether it should have bargained with the unions representing impacted postal workers over its response to the breach.

On November 10, 2014 the USPS announced to its employees that it had suffered a data breach of its information systems. An internal investigation conducted throughout September and October, 2014 revealed that a USPS human resources file containing personal identifying information of employees, including names, addresses, dates of birth and Social Security numbers, may have been accessed and copied during the breach. Those employees impacted by the breach were offered free credit monitoring for one year. The American Postal Workers Union (APWU), which represents over two hundred thousand USPS employees, alleges it was notified of the breach just one day prior to the announcement.

The same day that the employees were notified of the breach the APWU filed an unfair labor practice charge with the National Labor Relations Board (NLRB). The charge alleges that the USPS violated Section 8(a)(5) of the National Labor Relations Act, which requires an employer to bargain in good faith with the union representing its employees over wages, hours and terms and conditions of employment, by failing to provide the Union with "advance notice" of the breach and failing to provide the Union with an opportunity to bargain "over the impacts and effects of the data breach on employees." The charge further alleges that the USPS' offer of free credit monitoring to employees constituted an unlawful unilateral change in employees' wages, hours and working conditions. The National Association of Letter Carriers and the National Rural Letter Carriers’ Association have also filed unfair labor practice charges seeking similar relief.

This case is unique because it represents the first time that a union has gone to the NLRB seeking redress based on an employer's response to a data breach. Although the NLRB has yet to issue a complaint on the APWU's charge, a finding in favor of the Union will place additional burdens on unionized employers facing similar data breaches. Employers would be obligated to notify the union of the breach in advance of any employee communications, and further required to bargain over any remedial actions taken.