Joining Maryland (SB 433), Illinois (HB 3782), California (AB 1844), Michigan (PA 478) and New Mexico (SB 371), Utah has enacted legislation limiting an employer’s right to request that an employee or a job applicant provide his or her social media login information, including their username and password. Effective May 14, 2013, Utah HB 100 (enacting the Internet Employment Privacy Act) adds to a growing trend among state legislatures taking an affirmative position on the assessment of the rights of both employers and employees/job applicants in the expanding world of social media. The Utah statute, a mixed bag for employers, significantly curtails an employer’s right to obtain “confidential” information employees place on social networking sites and simultaneously codifies an employer’s right with respect to electronic information directly related to the employer. By enacting the statute, Utah joins the growing number of states acting on this issue, which may provide some insight into the possibility that the Social Networking Online Protection Act (H.R. 537) or similar federal legislation will ultimately be enacted.

The Good

While it is widely recognized that Utah HB 100 will have a stifling effect on an employer’s ability to investigate the activities of prospective or current employees, less emphasis has been placed on the statute’s expansion and codification of employer rights to obtain some forms of personal login information.

For one, employers are now statutorily entitled to request that employees provide personal login information where it pertains to one of the following:

  • An electronic communication device provided by the employer
  • An account or service provided by the employer 
  • An account obtained by virtue of the employment relationship and used for the employer’s business.

The statute also provides that employers have the right to request login information and ultimately discipline an employee or terminate employment when the employer has specific information that the employee is using a personal social media account to transfer proprietary or confidential information or financial data belonging to the employer or its clients.

Finally, so long as its actions remain in compliance with other state or federal law, an employer retains the right to block and/or monitor an employee’s use of social media (or other websites) while using an employer-owned electronic device.

The Bad

Recent statistics indicate that more than 90 percent of employers use social media sites to screen applicants. With an applicant’s ability to customize what personal information is public and what is private, a growing number of employers have asked applicants for personal login and password information to allow access to otherwise “private” social media content. Utah HB 100 (along with its companion state statutes) has targeted such conduct as an invasion of privacy.

Utah HB 100 specifically prohibits an employer (absent the above exceptions) from asking an employee for his or her login information to allow access to the employee’s personal social media site. Employers are also forbidden from terminating the employment of a current employee or not hiring an applicant who has simply refused to provide the requested login information. Utah HB 100 provides damaged employees and/or applicants a private cause of action that may be taken against the employer with a penalty of up to $500 per violation.

The Ugly

With the passage of HB 100, Utah has joined a growing number of state legislatures and federal authorities determined to address growing concerns over the use and regulation of social media in the workplace. With the passage of legislation and an increasing number of decisions issued by federal agencies such as the National Labor Relations Board, the Federal Trade Commission and even the Securities and Exchange Commission, the governing law continues to evolve. What is a conscientious employer to do?

Employers would be wise to closely monitor and regularly review their social media policies to assure compliance with the ever-changing laws. With the increasing number of states that have initiated legislation mirroring what has been enacted in Utah and in light of the pending Social Networking Online Protection Act (or a subsequent, modified equivalent), the issue is one that will soon reach a large percentage of U.S. employers. In this fluid environment, preventative maintenance is certainly preferable to retroactive repair.