For members of the American workforce, the use of social media accounts such as Facebook, LinkedIn and Twitter is no longer a new phenomenon – it’s simply a way of life. Sometimes information posted on these sites is publicly available. But access to social media accounts can also be restricted – most often through the use of usernames and passwords.
Some employers believe that access to the personal social media accounts of their employees is necessary so they can comply with federal financial regulations, protect proprietary information and limit legal liability. On that basis, employers have been asking employees to turn over usernames and passwords. An increasing number of state politicians, however, consider such requests to be an invasion of privacy and they have taken steps to curb employer access.
As of December 1, 2013, New Jersey became the 12th state to pass a social media protection law. Under the new law, employers are generally prohibited from requesting social media usernames and passwords from current and prospective employees. In the New York State legislature, Assembly Bill A00443B and Senate Bill S02434-B, currently under consideration, also would prohibit employers from requesting social media usernames and passwords from current and prospective employees.
Given the New Jersey law and the likely implementation of a similar law in New York, employers in the New York metropolitan area – and even nationwide – need to understand what they can and cannot do with respect to the personal social media accounts of employees.
What Not To Do
Do not request personal social media account usernames and passwords
Under the New Jersey law, employers cannot “require or request a current or prospective employee to provide or disclose any username or password, or in any way provide the employer access to a personal account through an electronic communications device.” The law defines “personal account” as “an account, service or profile on a social networking website that is used by a current or prospective employee for personal communications unrelated to any business purposes of employer.”
The New York law, as currently proposed, contains essentially an identical prohibition as the New Jersey law although it does not include a definition of “personal account.” If enacted, the new labor law would make it “unlawful for any employer to request or require any employee or applicant for employment to disclose any user name, password or other means for accessing a personal account or service through an electronic communications device.”
Do not retaliate or discriminate against an employee who refuses to provide access to a personal social media account
Both the New Jersey law and the proposed New York law explicitly prohibit employers from retaliating or discriminating against current or prospective employees who refuse to supply usernames and passwords or otherwise provide access to personal social media accounts.
Do not use publically available information regarding a protected characteristic to make employment decisions
The New Jersey law and the New York proposal do not preclude employers from viewing, accessing or utilizing information that is publically available on social media websites. Employers, however, cannot use information legally obtained from public sources to make improper employment decisions. For example, if an employer learns about a job applicant’s sexual orientation, physical disability or religion from a publically available social media website, the employer cannot use that information in the hiring, firing or promotion process.
While this may seem obvious, it bears repeating because it highlights the potential downside of collecting information about employees and job candidates -- even publically available information. If a candidate challenges a hiring or promotion decision, the employer may have to demonstrate that a protected characteristic was not a factor in the decision. This can be difficult if evidence shows that electronic searches were conducted that revealed a protected characteristic.
What To Do
Ask for social media account information for business purposes
New Jersey’s new law contains an exception to its general prohibition and specifically allows employers to ask for usernames and passwords for accounts that are used for business purposes of the employer such as marketing and communicating with customers. Sometimes, however, it might be difficult to tell if an account is being used for personal or professional purposes.
Establishing company protocols in advance may make it easier to deal with situations where the distinction between personal and business use of social media accounts is blurry.
New Jersey’s new law also allows employers to request usernames and passwords if they are needed to conduct investigations “for the purpose of ensuring compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct based on the receipt of specific information about an activity on a personal account by an employee” or “of an employee’s actions based on the receipt of specific information about the unauthorized transfer of an employer’s proprietary information, confidential information or financial data to a personal account by an employee.”
If one employee is harassing another employee through social media accounts, employers may need to investigate and act.
New York’s proposed law also contains exceptions to the general rule. The current draft states that nothing in the law prohibits employers from “requiring or requesting an employee to disclose access information to an account, service, or network provided by the employer where such account, service, or network is issued for business purposes and the employee was provided prior notice of the employer’s right to request or require such access information.” Nor does the proposed law prohibit an employer from accessing an electronic device “paid for in whole or in part by the employer where the provision of or payment for such electronic communications device was conditioned on the employer’s right to access such device and employee was provided prior notice of and explicitly agreed to such condition” although the employer still cannot access personal accounts on such devices. The New York proposal further permits employers to request access information when doing so is necessary to comply with a court order or “a duty to screen employees or applicants prior to hiring or to monitor or retain employee communications that is established under federal law or by a self regulatory organization, as defined in section 3(A)(26) of the Securities and Exchange Act of 1934, 15 U.S. C. 78C(A)(26).”
Train employees regarding the new laws
Human resource professionals and managers tasked with hiring and firing as well as those responsible for regulatory compliance should be educated about the laws. Without training, it’s easy for those employees to inadvertently violate the law by requesting access when it is not permissible and by failing to gain access when legally necessary.
Establish specific hiring practices and procedures for social media screening
Creating and abiding by formal practices and procedures regarding the use of social media can help avoid discrimination claims and simultaneously facilitate access when required to comply with legal obligations. For example, an employee with no hiring authority can conduct publically available social media searches, filter out information regarding protected characteristics and then pass along the results of the search to the hiring manager. In addition, employers who use social media screening as part of the hiring process (or for other reasons) should do so consistently. They should not “Google” some employees or applicants but not others.
The recently enacted law in New Jersey and the pending legislation in New York seek to balance an employer’s need to know with employee privacy rights. While the laws try to clearly set forth the do’s and don’ts regarding access to employee social media accounts, creating a workable social media policy and understanding exactly what an employer can and cannot do – especially employers operating in in multiple states – can be tricky. Working with an attorney to discuss a proposed action and/or develop a social media policy can help avoid adverse consequences including litigation.
About the Author
Linda Roth is a Partner in Tarter Krinsky & Drogin’s Litigation Practice. She focuses her practice on commercial litigation and, since 1984, has prosecuted and defended numerous matters involving claims for breach of contract, unfair competition, misappropriation of trade secrets and fraud. Linda can be reached at firstname.lastname@example.org.