As we have frequently reported in this blog, social media privacy issues increasingly permeate the workplace.  For example, earlier this year, Montana and Virginia joined a growing number of states in enacting laws restricting employer access to the social media accounts of applicants and employees.  With Governor Dannell Malloy’s approval of similar legislation in Connecticut on May 21, the Constitution State has now become the latest state to follow this trend.

Connecticut’s law (Public Act 15-6) becomes effective October 1, 2015 and is generally similar to social media privacy laws enacted in other states.  Under the new Connecticut law, employers may not:

  • Request or require that an employee or applicant provide such employer with a user name and password, password or any other authentication means for accessing a personal online account;
  • Request or require that an employee or applicant authenticate or access a personal online account in the presence of such employer;
  • Require that an employee or applicant invite such employer or accept an invitation from the employer to join a group affiliated with any personal online account of the employee or applicant; or
  • Fail or refuse to hire any applicant as a result of his or her refusal to (A) provide such employer with a user name and password, password or any other authentication means for accessing a personal online account, (B) authenticate or access a personal online account in the presence of such employer, or (C) invite such employer or accept an invitation from the employer to join a group affiliated with any personal online account of the applicant.
  • In addition, like social media privacy laws in other states, the new Connecticut law has an anti-retaliation provision stating that employers may not “discharge, discipline, discriminate against, retaliate against or otherwise penalize any employee who (A) refuses to provide such employer with a user name and password, password or any other authentication means for accessing his or her personal online account, (B) refuses to authenticate or access a personal online account in the presence of such employer, (C) refuses to invite such employer or accept an invitation from the employer to join a group affiliated with any personal online account of the employee, or (D) files, or causes to be filed, any complaint, whether verbally or in writing, with a public or private body or court concerning such employer’s violation of [the law].”
  • The new law authorizes aggrieved employees and applicants to file complaints with the Connecticut Labor Commissioner, who is required to conduct an investigation and may hold an evidentiary hearing.  Remedies and penalties for violation of the statute include recovery of attorneys’ fees and costs by the aggrieved employee or applicant, back pay, rehiring or reinstatement, reestablishment of employee benefits, and civil penalties.
  • Despite the somewhat onerous penalties that employers can face for violations of the statute, the new law does contain some important exceptions.  Under the statute, employers are not prevented from:
  • Conducting an investigation for the purpose of ensuring compliance with applicable state or federal laws, regulatory requirements or prohibitions against work-related employee misconduct based on the receipt of specific information about activity on an employee or applicant’s personal online account,
  • Conducting an investigation based on the receipt of specific information about an employee or applicant’s unauthorized transfer of the employer’s proprietary information, confidential information or financial data to or from a personal online account operated by an employee, applicant or other source;
  • Monitoring, reviewing, accessing or blocking electronic data stored on an electronic communications device paid for, in whole or in part, by an employer, or traveling through or stored on an employer’s network, in compliance with state and federal law; or
  • Complying with the requirements of state or federal statutes, rules or regulations, case law or rules of self-regulatory organizations.

As other states join the growing chorus of states enacting social media privacy laws, we will continue to report of the latest developments.  In the meantime, employers should review their policies and procedures to ensure that they are up-to-date with the latest legislative enactments.