Unfriending Employers: New Laws Restrict Access to Employees’ Social Media Accounts

November 14, 2012

Over the past few months, several states have passed laws restricting an employer’s ability to ask employees for passwords or access to their social media accounts such as Facebook. Until recently, prevailing court case law leaned toward a presumption that employees do not have a reasonable expectation of privacy when they use their workplace computers for personal reasons, thus allowing employers to monitor email, review electronic files stored on a work computer, and request access to social media accounts. Lawmakers now appear to be pushing back. Employers should be aware of these trends and changes and modify their policies and procedures accordingly, especially if they have employees in any of the following states.

Maryland became the first state to enact workplace privacy legislation in May when its governor signed the User Name and Password Privacy Protection and Exclusions Act, which prohibits employers from:

  • requesting or requiring that an employee or applicant disclose any user name, password, or other means for accessing a personal account or service through certain electronic communications devices;
  • taking, or threatening to take, certain disciplinary actions for an employee’s refusal to disclose certain password and related information; or
  • failing or refusing to hire an applicant as a result of the applicant’s refusal to disclose certain password and related information;

The Maryland law does allow an employer, however, based on the receipt of information regarding the use of certain Web sites or Web–based accounts, to conduct investigations related to securities fraud and trade secret misappropriation.

Illinois followed suit in August when it enacted the Right to Privacy in the Workplace Act, which prohibits an employer from:

  • requesting or requiring an employee or applicant to provide any password or other related account information in order to gain access to their account or profile on a social networking website or
  • demanding access in any manner to an employee’s or applicant’s account or profile on a social networking website.

Violations of this law expose the employer to actual damages plus costs, a criminal petty offense, and, if willful and knowing, a civil penalty and attorney’s fees.

In September, California passed the Employer Use of Social Media bill, which prohibits employers from:

  • requesting or requiring that employees or applicants disclose social media log-in credentials;
  • requesting or requiring that employees or applicants access personal social media in the employer’s presence;
  • requesting or requiring that employees or applicants divulge any personal social media content; or
  • discharging, disciplining, threatening to discharge or discipline, or retaliating against an employee or applicant for not complying with any prohibited request or requirement.

The only exception to this law allows employers to request that an employee divulge social media content (i.e., a screen shot or printout) reasonably believed to be related to an investigation of employee misconduct or violation of law.

As many as 15 other states and the federal government are also considering restrictions on employer access to employee social media accounts through legislation and enforcement of existing laws. Business-friendly Delaware, the registered home for many companies that operate in other states, has not enacted any legislation covering employers but, in July, passed the Higher Education Privacy Act, which prohibits Delaware academic institutions from requesting or requiring that a student or applicant disclose any password or other account information to gain access to their social networking accounts. Protections for job applicants, if not existing employees, cannot be far behind.

At the federal level, US Senators Chuck Schumer (D-NY) and Richard Blumenthal (D-CT) have asked the Department of Justice and Equal Employment Opportunity Commission to investigate whether an employer asking employees and applicants for social media account access is a violation of federal law, namely the Stored Communication Act and the Computer Fraud and Abuse Act. They are also considering legislation to fill any potential gaps in existing laws that would allow such employer inquiry.

In this environment, all employers would be well served to review their policies and procedures regarding requests for social media account information from applicants and employees, not only to avoid potential criminal or civil liability but, perhaps more importantly, to prevent unfavorable judgment in the courts of public opinion, which are increasingly shaped by social media website activity.