Source: http://about.bloomberglaw.com/practitioner-contributions/proceed-at-your-peril-questions-abound-with-new-state-laws-restricting-employer-access-to-employees-personal-social-media-accounts-2/
Timestamp: 2014-03-10 15:32:44
Document Index: 639265975

Matched Legal Cases: ['§ 2701', '§ 11', '§ 980', '§ 8', '§ 3', '§ 37']

By Daniel I. Prywes and Jena M. Valdetero
Final approval of a law in New Jersey happened Aug. 28, with enactment to occur soon. Vermont has enacted a law providing for the establishment of a committee to study possible legislation, with participation from state legislators, state officials, and the American Civil Liberties Union. The committee’s recommendations are due by Jan. 15, 2014.
The state social media access limitation laws are vague about the threshold of suspicion or proof that must be met before such access can be required by the employer.
How does the federal Stored Communications Act affect the exceptions recognized in the state laws? The federal Stored Communications Act (SCA), 18 U.S.C. §§ 2701 et seq., generally prohibits anyone from obtaining unauthorized access to a person’s private social media account. It has been interpreted by one court to prohibit not only unauthorized access, but also an employer’s actions in coercing an employee to provide access when the employee fears that his or her lack of consent will have adverse employment consequences.1
The “right” of an employer recognized in some of the state statutes to “require” an employee to provide access to private social media accounts for the employer’s investigatory or monitoring purposes may collide with the Pietrylo prohibition on access obtained by coerced employee consent.
What use can be made of information discovered by an employer during an investigation? When an employer conducts an investigation into a particular type of wrongdoing that is subject to a statutory exception (e.g., violation of securities laws in Maryland), the employer may find evidence of other wrongdoing. A similar circumstance occurred in City of Ontario v. Quon, 130 S. Ct. 2619 (2010) (10 DDEE 196, 6/24/10), where an internal police review of expenses for a paging system led to evidence of sexually explicit messages.
However, the employer must still be mindful of legal restrictions that apply. For example, the National Labor Relations Board takes the position that an employer may not discipline employees for social media communications that involve in some way the terms and conditions of employment. The NLRB general counsel issued a memorandum in May 2012 summarizing its position.
A bill in committee in the House of Representatives (H.R. 537), the Social Networking Online Protection Act (SNOPA), would prohibit employers and certain other entities from requiring or requesting that employees and certain other individuals provide a user name, password, or other means of accessing a personal account on any social networking website. The bill was introduced by Rep. Eliot L. Engel (D-N.Y.), and it is still under consideration in committee. It largely mirrors the prohibitions of the state statutes but provides no exceptions. SNOPA, as proposed, would subject the employer to a civil penalty of not more than $10,000, which is significantly higher than the penalties set forth in the Michigan and Utah statutes.
On April 22 Arkansas enacted a law restricting employers’ access to employees’ social media accounts). Ark. Code. Ann. § 11-2-124. The Arkansas statute specifically identifies as a “social media account” such popular websites as Facebook, Twitter, LinkedIn, Myspace, and Instagram, but it also includes any personal account with an electronic medium or service where users may create, share, or view user-generated content. Like the other states to pass such measures, Arkansas excludes company email accounts or software programs owned or operated exclusively by an employer.
The Arkansas statute prohibits employers from requiring current or prospective employees to disclose their user name or password for their personal accounts, friend the employer, or change the account’s privacy settings. The statute prohibits retaliation by the employer where an employee refuses to take such acts. In the event of inadvertent disclosure of the employee’s user name and password, the employer cannot use that information to gain access to the employee’s social media account. However, the employer can view information about the employee or applicant that is publicly available on the internet.
The Arkansas statute includes some key exceptions, including one for compliance with the requirements of federal, state, or local laws or rules of a self-regulatory organization (such as FINRA). Additionally, the employer can request access to the account if the employee’s social media account is “reasonably believed” to be relevant to a formal investigation or related proceeding into allegations of the employee’s violation of the law or the employer’s written policies. In that instance, the access can be used only for the purpose of the formal investigation or related proceeding.
California was one of the first states to prohibit employer access to employees’ social media accounts, with the passage of an amendment to the Labor Code Sept. 27, 2012. Cal. Lab. Code § 980. The California act defines “social media” broadly to mean an electronic service or account or electronic content, including videos, photographs, blogs, podcasts, instant and text messages, emails, online services accounts, or internet website profiles or locations.
California prohibits a private employer from requiring an employee or job applicant to disclose a social media user name and password. California contains an exception for employer investigations that are “reasonably believed” to be relevant to allegations of employee misconduct or employee violations of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding. The law also provides for employer access to employer-issued electronic devices. California also prohibits retaliation if the employee or applicant refuses to comply with a request by the employer that violates the law. California is considering a bill that would expand its law to cover public employers, although the bill is in committee.
On May 11, the Colorado governor signed into law a new electronic privacy statute, to be codified at Colo. Rev. Stat. § 8-2-127). The Colorado statute does not apply to state or local law enforcement agencies (including corrections departments).
Otherwise, the law prohibits an employer from requiring employees or applicants to disclose their user name and password used to access a personal account or service through the employee’s or applicant’s electronic communications device. An employer also may not require an employee or applicant to add anyone to that person’s approved list of contacts on a social media site, or to require a change in privacy settings. The statute permits an employer to require disclosure of a user name and password that would access an employee’s nonpersonal accounts on the employer’s internal computer or information systems.
The statute carves out exceptions permitting an employer to conduct investigations (a) to ensure compliance with applicable securities or financial law or regulatory requirements based on the “receipt of information” about the use of a personal account for business purposes, or (b) to investigate “upon receipt of information” that an employee has improperly downloaded the employer’s proprietary information or financial information to a personal account.
An employee or applicant may file a complaint about violations with the Colorado Department of Labor and Employment, which is to investigate and issue findings after a hearing. That department may promulgate rules
Illinois amended the Right to Privacy in the Workplace Act effective Jan. 1, 2013, to prohibit employers from requesting that employees or applicants provide any password or account information that would allow access to their social networking profile or account. 820 Ill. Comp. Stat. 55/10. Employers may still create policies concerning the use of internet, email, and social networking sites at work, and may monitor the usage of the employer’s email system. Employers may also obtain information about employees or prospective employees that is publicly available.
The Illinois definition of social networking website expressly excludes email. Instead, a social networking website is defined as an internet-based service that allows individuals to construct a public or semipublic profile; create a list of other users with whom they share a connection; and view and navigate their list of connections and those made by others within the system.
Several bills are being considered that would amend the terms of the Illinois statute. The proposed amendments would create several exceptions permitting employer access to employer-owned devices or accounts, and would permit the company to request access to personal accounts where it has specific information about activity on an online account that might violate laws or regulations or constitute employee misconduct. The amendments also would permit an employer to take actions to comply with laws or rules of a self-regulatory organization. (See related story.)
In May 2012, Maryland became the first state in the nation to pass a law that prohibits employers from asking job applicants or employees for access to their personal social media accounts. The legislation was prompted by reports that the Maryland Department of Corrections was requiring applicants for prison jobs to disclose their Facebook passwords so that the department could check them for gang relationships. In retrospect, the Department of Corrections’ concerns were not idle ones. In April 2013, 13 prison guards at a Baltimore prison were indicted for allowing gang members to smuggle drugs and cellphones into the prison, and four female guards were impregnated by an imprisoned gang leader.
The Maryland law, codified at Md. Code Ann., Lab. & Empl. § 3-712, states that “an employer may not request or require that an employee or applicant disclose any user name, password, or other means for accessing a personal account or service through an electronic communications device.” It further prohibits an employer from refusing to hire “any applicant as a result of the applicant’s refusal to disclose” the password or user name information needed to access the personal account.”
The Maryland law also protects persons, once employed, against discharge, discipline, or penalties (as well as threats of such action) for failure to provide information needed to access their social media accounts.
The law provides only two limited exceptions, both of which relate to current employees but not applicants. First, “based on the receipt of information about the use of a personal Web site” by an employee for “business purposes,” the employer may conduct an “investigation for the purpose of ensuring compliance with applicable securities or financial law, or regulatory requirements.” Second, “based on the receipt of information about the [employee's] unauthorized downloading of an employee’s proprietary information or financial data” onto an internet site, the employer may investigate the employee’s actions.
Employees are also subject to limitations. The Maryland statute prohibits an employee from downloading “unauthorized employer proprietary information or financial data to an employee’s personal Web site.” An employer may also require an employee to disclose any user name or password for accessing “nonpersonal accounts” or services that provide access to the employer’s internal computer or information systems.
The Maryland law does not specify whether a private cause of action exists for violations, or any penalty for violations.
Effective Dec. 28, 2012, Michigan enacted the Internet Privacy Protection Act, Mich. Comp. Laws § 37.271 et seq., which similarly bars employers from requesting that employees or applicants grant access to, allow observation of, or disclose information from their personal internet account. “Personal internet account” means an account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, utilize, or edit the user’s account information, profile, display, communications, or stored data. It is unclear whether this definition includes personal email accounts, although the exceptions indicate that it may.
The Michigan statute contains a long list of exceptions, which narrow its impact. The employer may still require an employee to disclose access to an electronic communications device or account paid for or provided by the employer or used for the employer’s business purposes. The employer may discipline or discharge an employee for the unauthorized transmission of the employer’s proprietary or confidential information or computer data to the employee’s personal internet account. The employer may conduct an investigation if there is specific information about misconduct on the employee’s personal internet account, or if the employer has specific information about an unauthorized transfer of the employer’s proprietary or confidential information. Additionally, the employer may restrict access to websites while using an employer’s network, and may monitor, access, or review electronic data stored on a device paid for by the employer or traveling through the employer’s network. The employer can also screen employees or applicants prior to hiring or monitor or retain employee communications pursuant to federal law or FINRA. Finally, the employer can still view information available in the public domain.
A violation of the statute subjects the employer to a misdemeanor fine of not more than $1,000. It also creates a private right of action permitting the employee or applicant to seek an injunction and recover not more than $1,000 in damages, plus reasonable attorneys’ fees and costs. Sixty days prior to filing a civil action for money damages, the employee or applicant must make a written demand to the employer for not more than $1,000.
On April 5, New Mexico’s governor signed into law a statute (S.B. 371) that prohibits an employer from requesting or requiring a job applicant to provide a password to gain access to the applicant’s account or profile on a social networking website, or to demand access to such a website. The law does not apply to federal, state, or local law enforcement agencies, including their background checks for employment. No Social Media Access for Employers, S.B. 371, 51st Leg., 1st Sess. (N.M. 2013). The law took effect June 14, 2013. New Mexico’s law does not prohibit an employer from obtaining information about a job applicant that is in the public domain. Thus, an employer can look at an applicant’s profile available to the general public on a social media website.
This law does not apply to employers’ requests for access to their current employees’ social media accounts. Nor does it restrict an employer from monitoring employees’ usage of the employer’s electronic mail system.
On May 22, Oregon enacted H.B. 2654, 77th Leg. (Or. 2013) (to be codified at Or. Rev. Stat. ch. 659A). Subject to exceptions, the Oregon statute, effective Jan. 1, 2014, makes it unlawful for an employer to require or request an employee or job applicant to disclose a password or provide access to a personal social media account, and prohibits adverse action based on an employee’s or applicant’s refusal to provide such access. On the other hand, an employer cannot be held liable by a third party (as in negligence lawsuits) for its failure to request or require disclosure of such information.
The Oregon law provides several exceptions. A broad exception excludes requests needed to comply with “state and federal laws, rules and regulations and the rules of self-regulatory organizations.” Another exception permits an employer to require employees to disclose passwords or other means needed to access social media accounts “provided by, or on behalf of, the employer or to be used on behalf of the employer.”
The Oregon law permits an employer to require that employees “share content” from a personal social media account in connection with an investigation aimed at “ensuring compliance with applicable laws, regulatory requirements or prohibitions against work-related employee misconduct,” provided that the employer has received “specific information” about activity on such an account. However, the employee cannot be required to provide a user name, password, or other means for the employer to directly access the account on its own.
The new Oregon law does not address private causes of action for violation of the new prohibitions. However, the Oregon legislature is considering a bill to provide such a remedy.
On March 26, Utah’s governor signed into law the Utah Internet Employment Privacy Act, Utah Code Ann. 34-48-102 et seq..
This act prohibits an employer from requesting or requiring that an employee, or an applicant for employment, provide a password that allows access to a personal internet account, or from taking any adverse action (including failure to hire) for not disclosing such a password. The law does not apply to information in the public domain or that can be accessed by the employer without employee-provided passwords.
The statute, however, permits an employer to demand access to an employee’s personal internet account in a variety of situations. Foremost among these are investigations intended to ensure compliance with laws, regulatory requirements, or prohibitions against work-related employee misconduct, or unauthorized transfers of the employer’s proprietary data, provided that “there is specific information about activity on the employee’s personal Internet account” that is relevant.
In addition, the statute does not prohibit an employer from complying with any duty to screen employees or applicants before hiring, or to monitor or retain employee’s communications, established by federal law, by a self-regulatory organization under the 1934 Securities and Exchange Act, or in the course of screening an applicant for a law enforcement position or in conducting an investigation of a law enforcement officer’s conduct.
The act establishes a private right of action exists for violations, with an award of no more than $500 upon proof of a violation.
On May 21, Washington’s governor signed into law Substitute Senate Bill 5211 (Ch. 330, Laws of 2013), effective July 28, 2013. Generally, the statute prohibits employers from requesting, requiring, or coercing job applicants or employees to provide access to private social media accounts, or from taking any adverse action against people who refuse to provide such access.
The exceptions to this prohibition include the circumstance where the employer asks the employee to “share content” of personal social media account while undertaking an investigation in response to “receipt of information” to ensure compliance with laws and prohibitions against work-related misconduct, or to investigate an “allegation” of an unauthorized transfer of the employer’s proprietary or financial information. Even in the case of such an investigation, the employer may only require the sharing of content and may not request or require that the employee provide login information.
Other exceptions permit an employer to require access needed to comply with the requirements of state or federal statutes, rules, “case law,” or rules of self-regulatory organizations. An employer also may demand access to an online account paid for by the employer or to an employer-provided account or service.
The Washington statute provides a private cause of action to employees or applicants, and allows for the award of actual damages, a penalty of $500, injunctive relief, and reasonable attorneys’ fees and costs. However, the statute also authorizes courts to award employers their reasonable attorneys’ fees and expenses upon a court finding that a lawsuit was frivolous.
1 Pietrylo v. Hillstone Rest. Group, No. 06-5754, 2009 BL 205184 (D.N.J. Sept. 25, 2009) (9 DDEE 349, 11/1/09).
2 Pure Power Boot Camp Inc. v. Warrior Fitness Boot Camp, 587 F. Supp. 2d 548 (S.D.N.Y. 2008).
3 United States v. Spokeo Inc., No. 12-05001 (C.D. Calif. June 7, 2012) (complaint and consent decree).
4 E.g., Ehling v. Monmouth-Ocean Hosp. Serv. Corp., 872 F. Supp. 2d 369 (D.N.J. 2012) (12 DDEE 241, 6/21/12).