States begin push for implementation of employee password protection laws

October 12, 2012

Facebook lockCalifornia just became the third state to implement legislation that prohibits employers from requiring or requesting that an employee or applicant disclose a username or password for the purpose of accessing personal social media, to access personal social media in the presence of the employer or to divulge any personal social media.

For purposes of this law, the term “social media” was defined as meaning an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations. [Ca Lab C § 980(a)]

There are, however, important exceptions to these employee privacy rights regarding social media use that employers may rely upon in certain instances.  For example, employers have the right and obligation to request an employee to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding. [Ca Lab C § 980(c)]  In addition, employers may require or request an employee to disclose a username, password, or other method for the purpose of accessing an employer-issued electronic device. [Ca Lab C § 980(d)]

California is actually just one of several states that has been considering, and implementing, “password protection” laws and the issue for lawmakers seems to be the scope of the explicit exceptions that will be included in their statutes with respect to preserving the employers’ legitimate business interests to require access to the social media tools used by employees.  For discussion of the debate in this area, see a recent article from Littler on “Rethinking and Rejecting Social Media Password Protection Laws”Other states have either adopted broad prohibitions on requesting or requiring applicants and employees to disclose their personal social media passwords or have limited the exceptions to situations where an investigation is going with respect to suspected securities law violations and/or trade secret misappropriation.

In light of these developments, consideration should be given to reviewing and perhaps updating social media policies to specifically address the issues raised by “password protection” laws.  For example, the following italicized language has been added the social media policy appearing in § 100:212.20 of Business Transactions Solutions on Westlaw:

Local Policies and Procedures: It is Company’s intention to comply with all applicable legal requirements. Accordingly, if a provision of this Policy conflicts with applicable local legal requirements, Company will follow the local legal requirement (provided the local requirement does not conflict with U.S. law).  For example, the Company intends to comply with state laws that may limit or prohibit the company, as an employer, from requiring or requesting that an employee or applicant disclose a username or password for the purpose of accessing personal social media, to access personal social media in the presence of Company personnel or to divulge any personal social media; however, employees should acknowledge and understand that the Company intends to maintain any all rights and obligations under applicable laws that would permit the Company to, for example, require or request an employee to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, such as suspected securities law violations and/or trade secret misappropriation; or disclose a username, password, or other method for the purpose of accessing an employer-issued electronic device.  In addition, Company may adopt regional or country-specific policies on this subject to accommodate local conditions or legal requirements, and will inform employees in the applicable region or country of the terms of any such policy.