Skip to content

Menu

Jackson Lewis P.C.  logo
HomeAboutServicesContactSubscribe
Search
Close

Workplace Privacy, Data Management & Security Report

More States Limit Employer Access to Employee Social Media Accounts

By Joseph J. Lazzarotti on May 23, 2013
Posted in Featured, Information Risk, Social Networking, Workplace Investigations, Workplace Privacy

Earlier this year, we posted about new laws in Utah and New Mexico that limit employers’ ability to access the online accounts of their employees. Since then, Washington and Colorado have joined these and other states, such as Maryland, Illinois, California, Michigan, that have enacted similar laws. Oregon and New Jersey appear to be not far behind regulating employers in this area. 

Increasingly, employers across the country will need to revisit some of the hiring and monitoring practices they may be following, in particular, those of lower level managers and supervisors who may not be aware of these developments. Companies also need to reconsider what role they want employees to play in the businesses’ marketing strategies in social media.  

Colorado. Governor John Hickenlooper signed HB 13-1046 into law on May 11, 2013. Under the new law, employers may not "suggest, request or require" or cause employees or applicants to (i) disclose the means of accessing the employees or applicants’ personal account or service through the employees or applicants’ electronic communication device, or (ii) change their privacy settings for an associated social networking account. An employer also may not compel an employee or applicant to become a friend, contact or connection of the employer or the employer’s agent. Employers may not fail or refuse to hire applicants, or discipline or otherwise penalize employees, who refuse to provide access to their personal accounts or add the employers to their contacts.

The good news for employers is that the law does not prohibit them from requiring employees to provide access, including user name and password, to non-personal accounts or services that allow access to employers’ information systems. The law also does not prohibit certain employers (those in certain industries (e.g., securities, finance) who have to comply with certain regulatory requirements) from conducting investigations concerning the use of personal websites, web-based accounts or similar accounts by an employee for business purposes. The same is true for investigations involving the unauthorized downloading of employer proprietary or financial information to a personal website, web-based account or similar account.

The new Colorado law does not provide for a private right of action, but injured persons may file a complaint with the Department of Labor and Employment, which may impose fines of up to $1,000 for a first offense, and not more than $5,000 for subsequent offenses.   

Washington. Gov. Jay Inslee signed a similar law (SB 5211) on May 21, 2013, that contains restrictions on employers concerning the personal online accounts of their employees. The law also contains similar exceptions concerning employee investigations. The law becomes effective on July 28, 2013. 

Oregon. Last week, the Oregon legislature sent HB 2654 to the Governor’s desk for signature. Like the two measures above, the law would prohibit employers from requiring or requesting access to the personal social media accounts of employees or applicants, as well as prohibiting employers from requiring employees or applicants to make the employer a contact or connection of the employer. Unlike the laws discussed above, the current version of the bill does not include an investigation exception.

New Jersey. Responding to Governor Chris Christie’s concerns about a prior version of the bill (such as objecting to a provision that would have made it illegal to ask an employee if he or she has a Facebook account), the New Jersey General Assembly recently approved unanimously modifications to A2878, making it virtually certain to become law in New Jersey in the short term. The Governor has already signed a similar law protecting access to the social media accounts of university students and applicants.

Similar to the laws described above, A2878 would prohibit employers from requiring or requesting employees or applicants to disclose login information for their personal social media accounts. The law also proscribes retaliating or discriminating against any employee or applicant who fails to provide such information, reports a violation of the law, participates in an investigation or otherwise opposes a violation of the law. However, the new version of the law no longer provides for a private right of action, but civil penalties can be imposed for violations – up to $1,000 for the first violation,  $2,500 for each subsequent violation.

Tags: Colorado, Featured, information risk, New Jersey, Oregon, password, personal social media account, social media, social networking, Washington, Workplace Investigations, Workplace Privacy
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP)…

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

Privacy and cybersecurity experience – Joe counsels multinational, national and regional companies in all industries on the broad array of laws, regulations, best practices, and preventive safeguards. The following are examples of areas of focus in his practice:

  • Advising health care providers, business associates, and group health plan sponsors concerning HIPAA/HITECH compliance, including risk assessments, policies and procedures, incident response plan development, vendor assessment and management programs, and training.
  • Coached hundreds of companies through the investigation, remediation, notification, and overall response to data breaches of all kinds – PHI, PII, payment card, etc.
  • Helping organizations address questions about the application, implementation, and overall compliance with European Union’s General Data Protection Regulation (GDPR) and, in particular, its implications in the U.S., together with preparing for the California Consumer Privacy Act.
  • Working with organizations to develop and implement video, audio, and data-driven monitoring and surveillance programs. For instance, in the transportation and related industries, Joe has worked with numerous clients on fleet management programs involving the use of telematics, dash-cams, event data recorders (EDR), and related technologies. He also has advised many clients in the use of biometrics including with regard to consent, data security, and retention issues under BIPA and other laws.
  • Assisting clients with growing state data security mandates to safeguard personal information, including steering clients through detailed risk assessments and converting those assessments into practical “best practice” risk management solutions, including written information security programs (WISPs). Related work includes compliance advice concerning FTC Act, Regulation S-P, GLBA, and New York Reg. 500.
  • Advising clients about best practices for electronic communications, including in social media, as well as when communicating under a “bring your own device” (BYOD) or “company owned personally enabled device” (COPE) environment.
  • Conducting various levels of privacy and data security training for executives and employees
  • Supports organizations through mergers, acquisitions, and reorganizations with regard to the handling of employee and customer data, and the safeguarding of that data during the transaction.
  • Representing organizations in matters involving inquiries into privacy and data security compliance before federal and state agencies including the HHS Office of Civil Rights, Federal Trade Commission, and various state Attorneys General.

Benefits counseling experience – Joe’s work in the benefits counseling area covers many areas of employee benefits law. Below are some examples of that work:

  • As part of the Firm’s Health Care Reform Team, he advises employers and plan sponsors regarding the establishment, administration and operation of fully insured and self-funded health and welfare plans to comply with ERISA, IRC, ACA/PPACA, HIPAA, COBRA, ADA, GINA, and other related laws.
  • Guiding clients through the selection of plan service providers, along with negotiating service agreements with vendors to address plan compliance and operations, while leveraging data security experience to ensure plan data is safeguarded.
  • Counsels plan sponsors on day-to-day compliance and administrative issues affecting plans.
  • Assists in the design and drafting of benefit plan documents, including severance and fringe benefit plans.
  • Advises plan sponsors concerning employee benefit plan operation, administration and correcting errors in operation.

Joe speaks and writes regularly on current employee benefits and data privacy and cybersecurity topics and his work has been published in leading business and legal journals and media outlets, such as The Washington Post, Inside Counsel, Bloomberg, The National Law Journal, Financial Times, Business Insurance, HR Magazine and NPR, as well as the ABA Journal, The American Lawyer, Law360, Bender’s Labor and Employment Bulletin, the Australian Privacy Law Bulletin and the Privacy, and Data Security Law Journal.

Joe served as a judicial law clerk for the Honorable Laura Denvir Stith on the Missouri Court of Appeals.

Read more about Joseph J. Lazzarotti
Show more Show less
Related Posts
Supreme Court Adopts Narrow Interpretation of Computer Fraud and Abuse Act
June 9, 2021
Indiana Prohibits Employers from Mandating Device Implantations for Employees
April 1, 2021
Out of Sight is Not Out of Mind – Monitoring Workers Working From Home
April 27, 2020
Jackson Lewis JacksonLewis.com

Stay Connected

Subscribe to this blog via RSS Follow Us on Twitter Add us on Facebook View Our LinkedIn Profile

Topics

Archives

Editors

  • Jason C. Gavejian
  • Joseph J. Lazzarotti

Contributors

  • Christopher E. Hoyme
  • Damon W. Silver
  • Michael R. Bertoncini
  • Marlo Johnson Roebuck
  • Nathan W. Austin
  • Nicky Jatana
  • Jeffrey M. Schlossberg

Blog Authors Show/Hide

  • Joseph J. Lazzarotti
  • Jason C. Gavejian
  • Maya Atrakchi
  • Jackson Lewis P.C.
  • Mary T. Costigan
  • Damon W. Silver
  • Jeffrey M. Schlossberg
  • Michael R. Bertoncini
  • Christopher E. Hoyme
  • Robert Yang
  • Rachel E. Ehlers
  • Frank J. Fanshawe
  • Jody Kahn Mason
  • Delonie A. Plummer
  • Sean Paisan
  • Richard I. Greenberg
  • Jerel Pacis Agatep
  • Catherine R. Tucciarello
  • Cecilie E. Read
  • Ronald V. Sgambati
  • Nathan W. Austin
  • Joshua D. Allen
  • Michelle T. Hackim
  • Gregory C. Brown Jr.
  • Daniel J. Moses
  • Yvonne Arvanitis Fossati
  • Todd R. Dobry
  • Susan M. Corcoran
  • Paul A. Friedman
  • Marlo Johnson Roebuck
  • Joseph J. Lynett
  • Jennifer Shoaf Richardson
  • Francis P. Alvarez
  • Amy L. Peck
  • Zachary A. Ahonen
  • John A. Snyder
  • Stephanie L. Adler-Paindiris
  • Richard F. Vitarelli
  • Kathryn J. Russo
  • Melissa Pascualini
  • Laura A. Mitchell
  • Michael D. Ridenour
  • Kevin D. Holden
  • Jonathan J. Spitz
  • Jason Selvey
  • Valerie K. Jackson
  • Jackson Biesecker
  • Howard M. Bloom
  • Erik J. Winton
  • Eric J. Felsberg
  • Elizabeth S. Walsh
  • David R. Golder
  • Craig W. Wiley
  • Clifford R. Atlas
  • Christopher T. Patrick
  • Chad P. Richter
  • Ashley Solowan
  • Regan Harrison
  • Paige
  • Nicky Jatana
  • Melissa Ostrower
  • Mei Fung So
  • Lara Hamm
  • Kourtney Goebel
  • Kendall Melidosian
  • Gayla Kirkland
  • Kelly
  • Katy Admirand
  • Katharine C. Weber
  • Jessica Poot
  • Jenifer M. Bologna
  • Jonathan L. Crook
  • Haley Nystrom
  • foxtemplate
  • Brendan Ward
  • Ann Albertson

Recent Upates

  • Top Ten for 2023 – Happy Data Privacy Day!
  • Version 2 Proposed Draft Rules for the Colorado Privacy Act
  • Getting Healthcare in 2023 and Beyond…Virtually…and Securely
  • NYC Department of Consumer and Worker Protection Release Revised Version of Proposed Guidance Rules for the City AI Ordinance
  • EEOC to Hold Public Hearing On The Use of Artificial Intelligence

Jackson Lewis

Subscribe to this blog via RSS Follow Us on Twitter Add us on Facebook View Our LinkedIn Profile
Privacy PolicyDisclaimer

About Jackson Lewis

Focused on labor and employment law since 1958, Jackson Lewis P.C.’s 950+ attorneys located in major cities nationwide consistently identify and respond to new ways workplace law intersects business. We help employers develop proactive strategies, strong policies and business-oriented solutions to cultivate high-functioning workforces that are engaged, stable and diverse, and share our clients’ goals to emphasize inclusivity and respect for the contribution of every employee.

Read More...
Copyright © 2023, Jackson Lewis P.C. All Rights Reserved.
Law blog design & platform by LexBlog LexBlog Logo