On May 22, 2013, Oregon's governor signed HB 2654, which amends the state's existing antidiscrimination statute to restrict employer access to applicants' and employees' personal password-protected social media accounts. Oregon joins nine other states with similar laws: Maryland, Illinois, California, Michigan, Utah, New Mexico (which ostensibly applies to prospective employees only), Arkansas, Colorado, and Washington. The U.S. Congress and other state legislatures have proposed comparable legislation.
To understand the new Oregon law, which takes effect January 1, 2014, this alert discusses its coverage, prohibitions, exceptions, and remedies.
The new Oregon law appears to incorporate the general "definitions" provision of the state's existing antidiscrimination statute. That provision expansively defines "employer" as any person in the state who, directly or through an agent, engages or uses the personal service of one or more employees, reserving the right to control the means by which such service is or will be performed. "Employee" – a term also expansive in scope – is defined by exclusion; that is, it does not include any individual employed by the individual's parents, spouse or child, or in the domestic service of any person.
Under the new Oregon law, it is an "unlawful employment practice" for an employer to:
- Request or require that an employee or applicant disclose the "username and password, password, or other means of authentication" (hereinafter, "authentication information") used to access his or her personal social media account;
- Compel an employee or applicant to add the employer or an employment agency to the list of contacts associated with his or her social media Web site; or
- Compel an employee or applicant to access a personal social media account in the presence of the employer so as to enable the employer to view contents of the account that cannot be accessed without the account holder's authentication information.
An employer also may not take, or threaten to take, any action to discharge, discipline or otherwise penalize an employee (or fail or refuse to hire an applicant for employment) for engaging in any conduct protected under the new Oregon law. Moreover, as discussed in the "Remedies" section below, separate provisions of the state's existing antidiscrimination statute provide additional remedies and protections to employee whistleblowers and to employees and applicants who, for pursuing administrative remedies, are subject to alleged retaliation by an employer.
Notwithstanding the general ban on requesting disclosure of social media passwords, the new Oregon law permits an employer to require an employee to disclose authentication information used for accessing an account provided by the employer (or an account used on the employer's behalf).
In addition, nothing in the new law prevents an employer from:
- Conducting an investigation, without requiring an employee to provide authentication information for his or her personal social media account, for the purpose of ensuring compliance with applicable laws, regulatory requirements or prohibitions against work-related employee misconduct based on the employer's receipt of specific information about the employee's activity on a personal online account or service;
- In the course of a "permitted" investigation, requiring an employee, without providing authentication information used to access his or her personal social media account, to share content that has been reported to the employer that is necessary for the employer to make a factual determination on the matter;
- Complying with state and federal laws, regulations and rules (including the rules of self-regulatory organizations); or
- Accessing publicly available information about the employee or applicant through an online account.
Moreover, if an employer inadvertently receives authentication information for an employee's personal social media account through the use of an electronic device or program monitoring the use of the employer's network or employer-provided devices, the employer is not liable for possessing that information. Nevertheless, the employer may not use that information to access the employee's personal social media account.
The new Oregon law does not include a separate provision for remedies and, we assume, will incorporate the remedies available under the state's existing antidiscrimination statute. That statute permits aggrieved individuals to file a verified written complaint with the Commissioner ("Commissioner") of Oregon's Bureau of Labor and Industries ("Bureau") within a specified time frame – generally one year – of the alleged unlawful employment practice to obtain various forms of injunctive relief. An employer also may file a complaint with the Bureau if an employee fails to comply with the new Oregon law. In addition, the Commissioner or the Oregon Attorney General may, of his or her own accord, pursue a complaint with the Bureau against an employer believed to have committed an unlawful practice.
In general, the Bureau is tasked with taking all steps necessary to eliminate and prevent the practices prohibited in the state's existing antidiscrimination statute, including promoting voluntary affirmative action by employers. The Commissioner has the authority to perform investigations, encourage settlement, bring formal charges, provide injunctive relief and, in some cases (although not necessarily here), impose civil penalties.
It does not appear at this time that violations of the new Oregon law will give rise to a right of private action by aggrieved employees and applicants, with two possible exceptions. First, if an aggrieved person files a complaint with the Commissioner alleging an unlawful practice, the state's existing antidiscrimination statute protects that employee or applicant from retaliation. Second, the state's existing antidiscrimination statute also includes a whistleblower provision protecting an employee from discrimination and retaliation for reporting, in good faith, information that the employee believes is evidence of a violation of state law. Accordingly, it appears that, by amending the state's existing antidiscrimination statute, the new Oregon law may allow a whistleblower employee, as well as an employee or applicant alleging retaliation for pursuing a complaint with the Commissioner, to bring a civil action for remedies that include injunctive and equitable relief, compensatory damages, punitive damages, costs, and reasonable attorneys' fees.
The new Oregon law's coverage, prohibitions, exceptions, and remedies are similar to the social media laws adopted in other states, as well as the legislation pending in the U.S. Congress and numerous state legislatures. Given the breadth and ambiguity of some of these new laws, employers should consider whether to restrict managers working in such jurisdictions from sending Facebook friend requests, requests to connect through LinkedIn, or similar requests to subordinates or other employees. Indeed, the new Oregon law's prohibition of compelling an employee or applicant to add the employer to his or her list of contacts – a prohibition also found in the social media laws of Colorado, Washington, and Arkansas – seems to suggest that such a rule might be prudent. Ironically, the overbreadth of these laws may have negative repercussions for employees who wish to utilize social media for professional purposes and desire to have connections with work colleagues, including managers, who now may be hampered in their use of these sites.