On September 27, 2012, California Governor Brown signed two laws that will provide social media protections in California. Effective January 1, 2013, California Assembly Bill 1844 (“AB 1844”) prohibits employers from demanding user names and passwords from employees and job applicants and Senate Bill 1349 ("SB 1349") makes it illegal for colleges and universities to demand social media user names and passwords from students, prospective students and student groups.  California joins Maryland and Illinois as being among the first states to have passed such social media laws. 

Law #1: AB 1844 prohibits employers from requiring or requesting an employee or job applicant to disclose a user name or password for the purpose:

  1. of accessing personal social media;
  2. to access personal social media in the presence of the employer; or
  3. to divulge any personal social media.

This new California law also includes three exceptions:

  1. Employers still have the right to request an employee to divulge social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations;
  2. Employers may require or request username, password, or other method for the purpose of accessing an employer-issued electronic device; and
  3. employers may still terminate or take adverse action against employees if otherwise permitted by law. 

Opponents of this law argue that the law will limit an employer’s ability to regulate their workplace or identify workplace harassment. Financial firms are concerned that the law conflicts with FINRA regulations and the duty of security firms to supervise, record, and maintain their employees' business communications.  Additionally, the exception that permits employers to request usernames and passwords on employer-issued electronic devices ignores the reality of social media and raises possibilities for litigation. Social media is not divided into personal vs. work-related. What about a personal Facebook account password that was accessed on an employer-issued device? Who has the right to the password of a work-related blog that is maintained by an employee at home? Can an employer request passwords for social media accounts that are both personal and work-related? This law leaves these issues unresolved. 

AB 1844 prohibits an employer from discharging, disciplining, threatening to discharge or discipline, or otherwise retaliating against an employee or applicant for not complying with a request or demand by the employer that violates this law.  However, AB 1844 has no “teeth” behind it: the law specifically states that the Labor Commissioner is not required to investigate or determine any violation of this act. Additionally the law does not create a private right of action for employees and potential employees. Therefore, the remedies an employee or job applicant may recover under this law are limited. 

Despite these drawbacks, proponents of the law hope that it will shield California businesses from plaintiffs who claim that businesses have a legal duty to monitor employees’ and prospective employees’ social media accounts. 

Law#2: SB 1349 states that employees and representatives of public and private postsecondary education institutions shall not require or request a student, prospective student or student group to do any of the following:

  1. disclose a user name or password for accessing personal social media;
  2. access personal social media in the presence of the institution’s employee or representative; or
  3. divulge any personal social media information.

The law specifies that the postsecondary education institution shall not suspend, expel, discipline, threaten to take any of those actions, or otherwise penalize a student, prospective student, or student group in any way for refusing to comply with a request or demand that violates SB 1349.

Similar to AB 1844, the two exceptions to SB 1349 clarify that the law does not:

  1. affect postsecondary educational institution’s rights to protect against and investigate alleged student misconduct or violations of applicable laws and regulations; and
  2. prohibit a postsecondary educational institution from taking any adverse action for any lawful reason.

Additionally, SB 1349 mandates that all postsecondary educational institutions post their social media privacy policies on the institution’s Internet Web site.  

SB 1349, similar to Delaware HB 309 that protects college students and post-secondary schools, is among the first of its kind to specifically protect students’ rights to social media passwords and privacy. However, the ACLU complains that the law does not go far enough.  SB 1349  law only applies to post-secondary students at colleges and universities, and not middle and high school students who are also active users of social media. 

While SB 1349 and AB 1844 appear to be drafted to focus on Facebook and other social media accounts, the broad definition of social media could be problematic for employers. Both laws contain a very comprehensive definition of social media: “an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.” This definition seems to imply both content on the Internet and stored in local storage devices.

For California employers, the two social media laws will require another review of social media policies to ensure compliance. For everyone else, continue to check your state’s new laws. California’s social media laws represent a continuing trend in the social media world to protect employees’ passwords. Over a dozen states have introduced similar bills this year and members of Congress proposed federal legislation including the Password Protection Act (PPA) and the Social Networking Online Protection Act (SNOPA) with the same goals of social media privacy.