An increasing number of states are passing laws that prohibit employers and academic institutions from requesting or requiring employees, job applicants, students, and prospective students to turn over their social media usernames and passwords. To date, six states have enacted such legislation: California and Michigan laws apply to both employers and academic institutions, while Illinois and Maryland laws apply only to employers and Delaware and New Jersey laws apply only to academic institutions.
Each state defines social media differently, with some states applying the laws to broadly include electronic services, accounts, and content, while others cover only websites that allow specifically for social networking. As a result, employers and academic institutions must review their policies in light of the state law or laws to which they are subject.
In general, these laws prohibit employers and/or academic institutions from:
- Asking or requiring an employee, applicant, student, or prospective student to disclose his/her social media username or password so that the employer or academic institution can access a social media account;
- Asking or requiring an employee, applicant, student, or prospective student to access his/her social media account with the employer or a representative of the academic institution present to observe the account;
- Punishing or threatening to punish an employee, applicant, student, or prospective student who refuses to comply with a request that violates these laws.
With the exception of New Jersey, the state laws include the following exemptions:
- Employers and academic institutions are able to request social media usernames and passwords as part of an investigation of alleged employee or student misconduct or illegal activity.
- Generally, the laws do not interfere with an employer's right to monitor the use of employer-issued e-mail and/or electronic devices.
- It is still lawful for employers and academic institutions to access information about employees, applicants, students, and/or prospective students that exists in the public domain.
The following states have similar legislation pertaining to employers pending: Delaware, Minnesota, Missouri, New Jersey, New York, Ohio, Pennsylvania, South Carolina, Texas, Vermont, and Washington. Maryland is considering a bill that will apply to academic institutions.
Legislation May Create Complications for Employer Compliance with Federal Securities Regulations
For some financial industry employers, requiring access to employee personal social media accounts has become a routine part of their efforts to comply with federal regulations requiring, either directly or by implication, that employers supervise and/or monitor their employees' activities, including their use of social media, to ensure compliance with federal securities laws. Indeed, during the California legislative process that resulted in that state's prohibition, representatives from the Financial Industry Regulatory Authority (FINRA) and the Securities Industry and Financial Markets Association (SIFMA) expressed concern to state lawmakers that the legislation would conflict with employers' compliance obligations, and accordingly requested that an exemption be written into the law for this purpose. In California, the request was ignored.
Other states have included this type of exemption with varying degrees of specificity. Among the states with currently enacted laws pertaining to employers, Maryland specifically exempts employers who are, based on specific information, conducting an investigation to ensure "compliance with securities or financial law and regulations." Michigan similarly provides an exemption when an employer must "conduct an investigation to ensure compliance with laws [or] regulatory requirements." Of all the states that have either enacted or considered this type of legislation, Delaware's pending law for employers has the most robust financial industry exemption. It allows employers subject to financial regulators, specifically naming the Securities and Exchange Commission (SEC) and FINRA, to request usernames and passwords in order to comply with the supervision requirements of those and other federal financial regulators.
It may be argued that the rules and regulations promulgated by the SEC and self-regulatory organizations like FINRA preempt these state laws to the extent that the state laws would impair the ability of employers to meet their supervisory obligations. This argument has not yet been tested in the courts, however, and may carry some risks. Another approach for regulated financial services employers might be to adopt company policies forbidding discussion of the company and its products and services on employees' personal social media accounts and online message boards, industry-specific or otherwise (with an exception, discussed in a previous Alert, for workplace communications protected by federal labor laws). For employees who are expected to use social media for the company's benefit, an employer could require that employees do so only on a company-established social media platform, for which the company created the password in the first instance. It would also be appropriate to periodically spot check employees' publicly available information and/or require periodic, written certification from employees that they are in compliance with these company policies.
Client Practice
Employers in California, Illinois, Maryland, and/or Michigan, and academic institutions in California, Delaware, Michigan, and New Jersey, are advised to not request or require and/or to cease requesting or requiring social media usernames and passwords from employees, applicants, students, and prospective students. Because the impact of these laws is business- and state-specific, we encourage you to seek legal advice before instituting new policies or practices designed to conform to the new and changing laws.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
