On May 21, Governor Jay Inslee signed a new Washington state law that makes it unlawful for employers to require an employee or applicant to disclose social networking website usernames or passwords, or to force an employee or applicant to add any person to the employee’s list of social networking contacts. This law becomes effective July 28.

Washington joins a host of other states that have taken legislative action to protect employee social media accounts. Maryland, Illinois, California, Michigan, Utah and New Mexico have passed similar laws, and as many as 20 other states have similar bills pending.

Washington’s Social Media Law Applies to Employers of All Sizes

For purposes of the new law, “employer” is defined broadly to mean “any person, firm, corporation, or the state of Washington, its political subdivisions, or municipal corporations.” Thus, employers of any size will be covered by the law.

Employer Activities That Are Not Prohibited

The law specifically states that it does not prohibit an employer from obtaining information about an employee or applicant through the public domain. Thus, employers may continue to access publicly available social networking profiles or comments. Employers should use caution, however, when accessing even publicly available information. Such activity may implicate state and federal anti-discrimination laws or run afoul of the National Labor Relations Act’s prohibition against taking action based on protected concerted activities. For further guidance on this issue, please refer to Lane Powell Legal Updates and articles regarding this topic, including: “The Times They Are a-Changin’: What Employers Need to Know Now About Legislative Developments, NLRB Activities and the EEOC’s Current Focus,” “How to Regulate Employee Technology Use Without Becoming a Target,” “NLRB Protects Many Employee Facebook Postings” and “Don’t Ignore NLRB Rules: Necessary Action by All Employers.”

Employer-maintained social networking accounts remain fully accessible and are not impacted by this law. Employers are also still free to enforce existing social media policies that do not conflict with the new law or the National Labor Relations Act.

The Law Provides an Exception for Certain Workplace Investigations

When employers are conducting workplace investigations surrounding an employee’s activity on his or her personal social networking account, they are permitted to request content from an employee’s account but are still prohibited from requesting an employee’s login information. Under this narrow exception, the purpose of the investigation must be to: “(i) ensure compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct; or (ii) to investigate an allegation of unauthorized transfer of an employer’s proprietary information, confidential information, or financial data to the employee’s personal social networking account.”

The Law Allows Prevailing Employees and Applicants to Recover Damages and Attorneys’ Fees; Prevailing Employers May Recover Attorneys’ Fees for Defending Frivolous Claims

Employees may bring a private cause of action against an employer for violating the new law. Courts may award actual damages, a $500 penalty and attorneys’ fees to a prevailing applicant or employee. As a safeguard to prevent frivolous claims against employers, the law also permits prevailing employers to recover their attorneys’ fees and costs if the court finds that an employee’s lawsuit was frivolous.

What Should Employers Do Now to Prepare?

Those employers whose policies currently require employees or applicants to disclose personal usernames and passwords should begin implementing a change to those policies. Employers should also train anyone involved in making employment decisions on the new law’s provisions.

If an employer determines that it may need social media content to investigate legal compliance, work-related misconduct, or the improper disclosure of the employer’s proprietary or confidential information, then the law allows employers to request content from personal social media sites. Employers should consider seeking advice of counsel when considering whether such a need exists in a particular situation. Employers should periodically review their existing social media policies and practices to make sure that they are in compliance with all current laws.