A recent survey of hiring managers and human resource professionals reports that more than two in five companies use social networking sites to research job candidates.1 This interest in social networking does not end when the candidate is hired: To the contrary, companies are seeking to leverage the personal social media networks of their existing employees, as well as to inspect personal social media in workplace investigations.
As employer social media practices continue to evolve, individuals and privacy advocacy groups have grown increasingly concerned about employers intruding upon applicants’ or employees’ privacy by viewing restricted access social media accounts. A dozen states already have passed special laws restricting employer access to personal social media
accounts of applicants and employees (“state social media laws”), and similar legislation is pending in at least 26 states.2
Federal legislation is also under discussion.3
These state social media laws restrict an employer’s ability to access personal social media accounts of applicants or employees, to ask an employee to “friend” a supervisor or other employer representative and to inspect employees’ personal social media. They also have broader implications for common practices such as applicant screening and workplace investigations, as discussed below.
II. KEY RESTRICTIONS UNDER STATE SOCIAL MEDIA LAWS
As a general matter, these state social media laws bar employers from requiring or even “requesting” that an applicant or employee4 disclose the user name or password to his or her personal social media account. Some of these state laws
This survey was conducted online within the U.S. by Harris Interactive© on behalf of CareerBuilder among 2,184 hiring managers and human resource professionals (employed full-time, not self-employed, non-government) between February 11 and March 6, 2013. http://www.careerbuilder.com/share/aboutus/pressreleasesdetail.aspx?sd=6%2F26%2F2013&id=pr766&ed=12%2F31%2F2013.
See National Conference of State Legislatures, Employer Access to Social Media Usernames and Passwords 2013, http://www.ncsl.org/issues-research/telecom/employer-access-to-social-media-passwords-2013.aspx.
A bill in committee in the House of Representatives, the Social Networking Online Protection Act, would prohibit employers from requiring an employee or applicant to provide the employer with access to a personal email account or social media account. Additionally, in mid May 2013, House lawmakers introduced the Password Protection Act of 2013, and in August 2013, Senate lawmakers introduced the Password Protection Act of 2013, functionally identical legislation that would penalize employers who compel or coerce any person to disclose a password allowing the employer access to a computer not owned by the employer, including access to employees’ social media information on such computers. See H.R. 2077: Password Protection Act of 2013, http://www.govtrack.us/congress/bills/113/hr2077/text; S. 1426; Password Protection Act of 2013, https://www.govtrack.us/congress/bills/113/s1426/text. A similar bill, the Password Protection Act of 2012, died before receiving a vote after being referred to the House Subcommittee on Crime, Terrorism, and Homeland Security. See H.R. 5684 (112th) Password Protection Act of 2012 http://www.govtrack.us/congress/bills/112/hr5684.
Eleven of the twelve states with social media laws protect current employees and applicants, while New Mexico only protects applicants.
also impose other express restrictions, such as prohibiting an employer from requiring or requesting that an applicant or employee:
These laws also prohibit an employer from retaliating against, disciplining or discharging an employee or refusing to hire an applicant, for failing to comply with a prohibited requirement or request.
Although these laws have the common goal of protecting employee privacy, their scope and terms vary, which creates a confusing landscape for multistate employers to navigate.5 Some of these laws only prohibit employers from seeking passwords or other login credentials to the personal social media account, while other states impose broader restrictions described above. For example, Arkansas, Colorado, Oregon and Washington prohibit an employer from requesting that
an employee allow the employer access to his or her personal social media accounts, and California, Michigan and Washington prohibit an employer from requesting an employee to access his or her personal account in the presence of the employer. Certain states prohibit an employer from requiring an employee to change his or her privacy settings to allow the employer access to his or her private social media accounts, although it is possible that such a restriction might be inferred from at least some of the other state laws as well. Even more confusing are the inconsistencies across state laws with respect to exceptions for workplace investigations, as discussed below.
However, while state laws differ significantly, the general message is clear: Employers must evaluate their current practices and policies to ensure compliance with these laws.
III. WHAT EVERY EMPLOYER SHOULD KNOW ABOUT STATE SOCIAL MEDIA LAWS
In general, these state social media laws do not limit an employer’s ability to review public information, such as information that may be available to the general public on an applicant’s social media pages. Instead, these laws limit an employer’s attempts to gain access to the individual’s social media accounts by means such as requesting login credentials, privacy setting changes or permission to view the accounts. Additionally, most of these laws explicitly state
The penalties for violations of these laws are similarly inconsistent: some states have private rights of action with a range of monetary caps (Utah, Washington, Michigan, Illinois, Maryland, Oregon), some only create administrative remedies, like Nevada’s administrative fine of up to $9,000 per violation and New Jersey’s civil penalties of up to $1,000 for the first violation and $2,500 for each subsequent violation, and others (Arkansas and New Mexico) provide no express private or administrative remedy.
that they do not prohibit viewing information about an applicant that is available to the public.6 However, all of these state social media laws prohibit employers from seeking access to the nonpublic social media pages of applicants. In practice, this means that employers should avoid asking applicants about the existence of personal social media accounts and requesting or even suggesting that an applicant friend the employer or a third party, including a company that provides applicant background investigations.
B. Friend Requests
Certain laws expressly restrict an employer’s ability to encourage an employee to friend or add anyone to the list of contacts for his or her personal social media account. This may include, but is not limited to, the employer, its agents, supervisors or other employees. For example, Colorado’s social media legislation states that an employer shall not “compel an employee or applicant to add anyone, including the employer or his or her agent, to the employee’s or applicant’s list of contacts associated with a social media account.”7 and many other laws contain this type of prohibition against requesting access via what may be intended as a harmless friend request. Although these laws do not prohibit a
subordinate from friending a manager or supervisor, employers should exercise care not to require, or even request or encourage, employees to friend supervisors or other company representatives.8 These restrictions may be particularly significant for employers seeking to leverage employees’ personal social media connections for work-related marketing or business development purposes. Employers should be aware that even in states without an express restriction on
friend requests, a law that generally prohibits an employer from attempting to access an employee’s or applicant’s social media account may effectively limit an employer’s ability to require or encourage employees to friend people.
One of the most challenging areas under state social media laws involves an employer’s ability to inspect or gain access to employees’ personal social media in connection with workplace investigations. An employer may wish to access an employee’s social media account, for example, if an employee complains of harassment or threats made by another employee on social media or if the employer receives a report that an employee is posting proprietary or confidential information or otherwise violating company policy. Some of the state social media laws provide at least limited exceptions for workplace investigations, while others do not.
No express exception for investigations: The Illinois9 and Nevada social media laws do not provide any express exception for workplace investigations that might require access to an employee’s personal social media accounts. This suggests that an employer’s investigation of potential misconduct or legal violations may not justify requesting or requiring an employee to disclose his or her social media login credentials.
For example, the Michigan law “does not prohibit or restrict an employer from viewing, accessing, or utilizing information about an employee or applicant that can be obtained without any required access information or that is available in the public domain.” 2012 Mich. Pub Acts 478 37.725 Sec. 5 (3).
See Colorado Revised Statutes 8-2-127(b)(2)(a).
Employers in states without social media laws or states with laws that allow “friending” should still proceed with caution when requesting access to an employee’s or applicant’s personal social media pages, and think twice about “friending” or “following” employees. If an employer learns about an employee’s legally-protected characteristic (such as religion, pregnancy or medical condition, or family medical history) or legally-protected activity (such as political or labor union activity), the employer may face greater exposure to discrimination claims if it later takes adverse action against the employee.
Perhaps in an effort to broaden employer investigation efforts and clarify an existing ambiguity, Illinois recently amended its law so that where the access sought by the employer relates to a professional account, an employer is not restricted from complying with a duty to screen employees or applicants, or to monitor or retain employee communications as required by law.
Limited exception for investigations of legal violations: California’s social media law provides that it does not limit an employer’s ability to request that an employee divulge personal social media in connection with an investigation of employee violations of applicable laws. However, this exception does not appear to extend to other prohibited activities, such as asking an employee to disclose his or her user name and password for a personal social media account. Other states provide exceptions only for investigations of specific types of legal violations. For example, the Colorado and Maryland social media laws only provide an exception for investigating violations of securities laws or potential misappropriation of proprietary information.
Limited exception for misconduct investigations: Some social media laws extend the exception beyond investigations of legal violations to investigations of alleged misconduct. These states include California, Oregon and Washington. In general, these laws allow an employer to ask an employee to divulge content from a personal social media account, but still do not allow the employer to request the employee’s login credentials. In contrast, Arkansas permits an employer to request any employee’s social media login credentials to investigate workplace misconduct.
Given these differences, employers should be mindful of the broad range of investigative exceptions in state social media laws. Before initiating an investigation that may benefit from or require access to an employee’s personal social media, an employer should first consider the restrictions imposed by the applicable state law and the scope of any investigatory exception offered by that law.
D. Best Practices
Given the inconsistencies among the different laws, it is challenging for multi-state employers to manage compliance with all state social media laws. Even if it is not the employer’s practice to seek access to its employees’ or applicants’ private social media pages, there are less obvious components of the laws that will affect almost every employer and employers should consider the following measures.
Review Hiring Practices for Compliance With Social Media Laws
Employers should ensure that all employees involved in the hiring process are aware of the restrictions imposed by these state social media laws. For example, recruiters and hiring managers should refrain from inquiring about an applicant’s personal social media pages or requesting access to such pages. While these state social media laws do not prohibit employers from accessing publicly available personal social media sites, employers will also want to evaluate whether this practice is advisable, given the risk of stumbling across legally protected information that cannot be used in employment decisions.
Implement Social Media Guidelines
Employers should implement social media guidelines to mitigate potential risks posed by employee social media postings, being mindful of restrictions arising under the National Labor Relations Act and other federal and state laws. Employers also should ensure that their social media guidelines do not run afoul of these state social media laws.
Educate and Train Personnel
Personnel involved in internal investigations, such as human resources and internal audit personnel, need to be aware of the growing restrictions on employer access to employee personal social media accounts. Prior to seeking access to an employee’s personal social media account, or content from such an account, the internal investigators should check any
applicable restrictions. In general, given the general trends in these laws, employers should avoid requesting login credentials to employees’ personal social media accounts, even in the investigation context, unless they have first consulted legal counsel.
This article first appeared in Bloomberg BNA Social Media Law & Policy Report, 03 SMLR 10, 03/11/2014. Reproduced with permission.
About Morrison & Foerster:
We are Morrison & Foerster—a global firm of exceptional credentials. Our clients include some of the largest financial institutions, investment banks, Fortune 100, technology and life science companies. We’ve been included on The American Lawyer’s A-List for 10 straight years, and Fortune named us one of the “100 Best Companies to Work For.” Our lawyers are committed to achieving innovative and business-minded results for our clients, while preserving the differences that make us stronger. This is MoFo. Visit us at www.mofo.com.
Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Prior results do not guarantee a similar outcome.