Happy New Year everyone!
New year, new laws… A California law protecting the privacy of social media accounts of employees and university students took effect on January first.
California’s Labor Code now prevents an employer from discharging, disciplining, threatening to discharge or discipline, or otherwise retaliating against an employee or applicant for not complying with the employer’s request that he discloses a username or password for the purpose of accessing personal social media, or that he accesses personal social media in the presence of the employer, or that he divulge any personal social media (Labor Code paragraph 980).
However, an employer still has the right to request an employee “to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding.”
The California Education Code now prevents public and private postsecondary educational institutions, and their employees and representatives to require that a student, a prospective student, or a student group to disclose a personal social media user name or password, or to access personal social media in the presence of the institution’s employee or representative, or to divulge any personal social media information. Such educational institutions may not suspend, expel, discipline, or threaten to take such actions, or even penalize a student, a prospective student, or a student group for refusing to comply with such social media requests (paragraphs 99120 to 90122 of the Education Code).
In Michigan, the Internet Privacy Protection Act that took effect in December 2012, has an even broader scope as it prohibits employers and all educational institutions, not only post-secondary institutions, from requiring employees, applicants, students and prospective students to grant access to, or to allow observation of, or to disclose information that allows access to or observation of their personal internet account. The law defines “personal internet account” as an “account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, utilize, or edit the user’s account information, profile, display, communications, or stored data.” It thus also protects the privacy of emails accounts, private blogs, or bookmarking sites.
Legislators in several others states including New York and Massachusetts introduced similar legislation in 2012. Illinois enacted a similar law in August 2012. Texas has introduced in November 2012 a bill, SB118, which would prevent an employer from requiring access to employees’ and applicants’ personal electronic communication accounts.
There is still no similar federal law. Several bills were introduced in Congress in 2012, such as H.R.5050, the Social Networking Online Protection Act, introduced in April 2012 by Rep. Eliot Engel (D-N.Y.), which would prevent employers to request access to person.al social media accounts. The Password Protection Act of 2012 that Rep. Martin Heinrich (D-NM) introduced (H.R. 5684), has even a broader scope as at would prohibit employers from compelling or coercing any person to authorize access to ‘a protected computer.’