Actually, that example doesn't sound at all insane to me. What if Workday then sells the information that I'm sick a lot to future prospective employers or to health insurers? The employer should have a duty to adequately protect that information. It's not just "their" data.
I don’t know about the US law on confidential employee data, but in some countries selling data like that would be an open and shut lawsuit (against both Google and the employer).
