With the unprecedented popularity of social media, individuals have increasingly been willing accomplices in undermining their own privacy. Few would have predicted that millions of people would voluntarily log onto the Internet and share detailed private information about themselves, their friends, family and employers. Users of social media have implemented varying privacy safeguards from unrestricted blogs to Facebook posts limited to a customized list of friends. Even those who seek privacy, however, must contend with a growing practice by employers and others of requesting access to password-protected social media accounts. Social media users have lost jobs and educational opportunities as a result of the increased scrutiny of these private postings. Maryland recently became the first state to enact a law prohibiting this practice; several other states and the U.S. Senate and House have similar legislation under review.
The inherent risks of posting personal information on the Internet have been recognized at the highest level of our government: in an address to schools in September 2009, President Obama warned students to "be careful what you post on Facebook. Whatever you do, it will be pulled up again later somewhere in your life." It is too late for many to heed this warning, and many social media users are reluctant to limit their self-expression. To protect these individuals’ privacy, several states and the U.S. Congress are considering legislative action that would prohibit employers and educational institutions from requiring access to password-protected content on social media sites.
From the viewpoint of employers and educational institutions, access to the social media websites of applicants, employees, and students may be regarded as part of their due diligence in making selection decisions. Prospective employers may use social media sites to verify claims in resumés and job applications. (The “Info” tab on Facebook, for example, can reveal a wealth of information about employment and educational history.) Many may also believe that they can assess whether a prospective employee is likely to be reliable based on whether the applicant’s posted photos depict frequent drunken partying or other conduct that may be reflective of poor judgment. Similarly, employers may wish to check up on whether the status updates and other postings of their employees reveal that the employee is bad-mouthing the employer or taking an unapproved beach vacation on a day that the employee called in sick.
Accessing social media sites, however, also comes with potential legal pitfalls. If, for example, an employer learns about an applicant’s pregnancy, disability or religious beliefs through trolling the Internet, that may set the employer up for a potential discrimination lawsuit if the employer then rejects the applicant. In addition, because not all individuals post online with equal abandon, an employer may treat applicants or employees inconsistently, based on uneven access to information – or may be misled by an individual’s selective posting of photographs and information. The hallmark of most employment laws is that employers must limit employment selection decisions to legitimate job-related factors. By opening the door to a flood of potentially extraneous information, employers may find it tempting to stray from that principle.
Regardless of the benefits or risks to employers of accessing individuals’ social media sites, such access violates the widely held belief that employees and students are entitled to privacy in their personal lives, as long as their personal conduct does not adversely affect their job or school performance. Opponents of employer access to social media sites compare such investigations to the intrusiveness of an employer demanding entry into an applicant’s or employee’s house to look through photographs and read the individual’s personal letters. Many states and the U.S. Congress appear to agree, recently introducing bills prohibiting employers, and in some cases post-secondary educational institutions, from requesting or requiring current or prospective employees or students to disclose the usernames and passwords of their social media accounts, or to otherwise provide them with access to these accounts. At least one state is considering a bill to prohibit employers from asking if a current or prospective employee has any social media accounts. Many of these bills, if enacted, would become effective immediately. As of the date of this Alert, states considering social media privacy legislation include California, Delaware, Illinois, Massachusetts, Michigan, Minnesota, Missouri, New Jersey, New York, Ohio, South Carolina and Washington. The attached chart includes more detail about the Maryland law and other pending legislation.
The current legislation highlights one of the many emerging issues that employers and educational institutions face as a result of the rapidly growing use and popularity of social media. Employers and educational institutions should consider avoiding or discontinuing the practice of requesting access to password-protected social networking sites of their applicants, employees, and students, especially in locations where social media privacy laws have been enacted or where such legislation is pending. While a review of publicly available information would not violate these privacy laws, employers should remember that use of any third-party to conduct background checks triggers the authorization and disclosure requirements of the federal Fair Credit Reporting Act and its state law counterparts. All types of entities should ensure that they develop and frequently update comprehensive social media policies and ensure employees' compliance with those policies.