Employers are increasingly vetting applicants or keeping tabs on current employees by monitoring their personal online social media accounts, such as Facebook. Part of this trend is that employers are requesting or requiring applicants and employees to turn over their user names and passwords for employers to gain complete access.

Several states have started combatting this practice, which some people view as an invasion of employees’ privacy. At least 15 states have passed laws limiting an employers’ ability to request or require access or login information, and Oklahoma just joined those other states.

On May 21, 2014, Governor Mary Fallin signed a bill that prohibits almost all employers from requiring employees or prospective employees to provide user names, passwords, or access to their social media accounts. The new law, which goes into effect November 1, 2014, makes it illegal for employers to take personnel action that negatively affects the terms and conditions of the job (like firing, docking pay, or changing job duties) of a current employee that refuses to give the employer access to his or her social media account. Likewise, it makes it illegal for employers to refuse to hire a prospective employee for refusing to give access.

But there are exceptions to when an employer can require access to social media accounts. For instance, nothing prohibits employers from requiring access to an employee’s account for purposes of a work-related investigation. Also, employers can still require access to all work-related accounts and electronic devices, such as smartphones or work e-mail accounts. Further, the employee or applicant refusing to give access must be the sole reason for any employment decision. That is, employers can still make personnel decisions based on an employee’s poor performance or other legal reasons even if an employee refuses access. And, importantly, nothing stops employers from accessing any information that is available to the general public.

‘Friendship’ is not (always) illegal

Nothing in the law prohibits employers from requesting access to social media accounts; it only prohibits requiring access as condition for employment. But there may be a thin line between a request and a requirement. If a supervisor knows a subordinate well, a friend request would not likely violate the law. But a request from an interviewer before a hiring decision is made or requesting a new employee be friends might appear to be a requirement.

Even when an employer does violate this law, it only amounts to a slap on the wrist in comparison to other employment laws. An employee or applicant may bring a lawsuit against the employer, but he must do so within six months of the violation. He also has to show that there was a violation of the law by clear and convincing evidence, a higher burden of proof than in most employment lawsuits. An employee’s or applicant’s financial damages are also limited to $500 per occurrence, and they cannot receive any punitive damages or emotional distress damages.

The law also offers a unique benefit: it protects employers from any liability from negligent hiring (and other lawsuits) if employers do not request or review online social media accounts. In fact, the law makes an employer’s failure to access such information inadmissible in any legal proceeding.

Takeaway for employers

Having a written policy is the best plan. The new Oklahoma law appears to give employers more of a carrot than a stick for not requiring or requesting access to social media accounts. Should an employer still want to review an applicant’s or employee’s account, employers should develop a policy that lays out how and when they will request access. This policy should make it clear that the employer will not retaliate against an employee for refusing access unless one of the exceptions applies. Having a policy will also protect employers from other employment laws that involve social media.