By Anna A. Cohen and Nancy L. Gunzenhauser
As an increasing number of employers use social media to screen prospective employees and to monitor the activities of current employees, several states have enacted social media privacy laws, including Arkansas, California, Colorado, Illinois, Maryland, Michigan, Nevada, New Jersey, New Mexico, Utah and Washington. Oregon joins those states in 2014.
Oregon’s new law is highly protective of employee and applicant privacy. Employers in Oregon are prohibited from requesting that an employee or applicant disclose a username or password to social media accounts. The law also prohibits employers from compelling employees or applicants to access a personal social media account in the presence of the employer and in a manner that enables the employer to view the contents of the personal social media account that are visible only when the account is accessed by the account holder. Employers cannot retaliate against applicants and employees -- whether in the form of refusal to hire, termination, discipline or otherwise -- where the applicant or employee refuses to disclose or provide access to social media. Nor may an employer retaliate when an applicant or employee refuses to add the employer to the employee’s list of contacts associated with the social media account (e.g. as a friend on Facebook or a connection on LinkedIn). Exceptions apply for accounts provided by the employer, investigations of work-related employee misconduct, and for compliance with state and federal laws, rules and regulations and the rules of self-regulatory organizations.
Illinois, the third state to enact a law that pertains to social media privacy, has amended its Right to Privacy in the Workplace Act, effective January 1, 2014. The amendment differentiates between a “personal account” and a “professional account” used by an applicant or employee exclusively for personal communications, unrelated to any business purpose of the employer. Employers will now be permitted to request access to an applicant or employee’s “professional” social media account, which is defined as an account “created, maintained, used, or accessed by a current or prospective employee for business purposes of the employer.” It is important to note that the law’s definition of a social networking site does not include e-mail and it does not prevent employers from obtaining information in the public domain about current or prospective employees.
Several more states will likely join the social media privacy trend as similar legislation has been introduced in at least 30 states. As these laws evolve, employers should develop, communicate and enforce clear policies with respect to the purposes for which social networking sites may be mined for data about job candidates and should review application forms and interview scripts to ensure that all inquiries made to applicants are lawful with respect to social media and other areas.