As we have previously reported, a growing list of jurisdictions have enacted social media privacy laws applicable to employers.  The most recent state to join the list is Maine, which brings the total to 22 states having enacted similar measures.

Under Maine’s law, an employer may not:

  • Require or coerce an employee or applicant to disclose the password to a personal social media account;
  • Require or coerce an employee or applicant to access a personal social media account in the presence of the employer or its agent;
  • Require or coerce an employee or applicant to disclose any personal social media account information;
  • Require or cause an employee or applicant to add anyone to the list of contacts associated with a personal social media account;
  • Require or cause an employee or applicant to alter or change setting to allow a 3rd party to view the content of a personal social media account;
  • Discharge, discipline, or otherwise penalize (including the threat of same) an employee for refusing to disclosure or provide access to a personal social media account as prohibited above;
  • Fail or refuse to hire an application for refusing to disclosure or provide access to a personal social media account as prohibited above.

Importantly, Maine’s law, like many of the other similar laws which have been enacted, does not prohibit or restrict an employer from requiring an employee to disclose personal social media account information the employer believes to be relevant to an investigation of employee misconduct or a workplace-related violation of laws, rules, or regulations — so long as the information accessed is used solely for purposes of the investigation or a related proceeding.

The prohibition on employer access to personal social media accounts began in 2012 and in the past 3 years has expanded to 21 additional states.  We expect this trend to continue elsewhere in 2016.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Jason C. Gavejian Jason C. Gavejian

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy…

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

As a Certified Information Privacy Professional (CIPP/US), Jason focuses on the matrix of laws governing privacy, security, and management of data. Jason is co-editor of, and a regular contributor to, the firm’s Privacy blog.

Jason’s work in the area of privacy and data security includes counseling international, national, and regional companies on the vast array of privacy and security mandates, preventive measures, policies, procedures, and best practices. This includes, but is not limited to, the privacy and security requirements under state, federal, and international law (e.g., HIPAA/HITECH, GDPR, California Consumer Privacy Act (CCPA), FTC Act, ECPA, SCA, GLBA etc.). Jason helps companies in all industries to assess information risk and security as part of the development and implementation of comprehensive data security safeguards including written information security programs (WISP). Additionally, Jason assists companies in analyzing issues related to: electronic communications, social media, electronic signatures (ESIGN/UETA), monitoring and recording (GPS, video, audio, etc.), biometrics, and bring your own device (BYOD) and company owned personally enabled device (COPE) programs, including policies and procedures to address same. He regularly advises clients on compliance issues under the Telephone Consumer Protection Act (TCPA) and has represented clients in suits, including class actions, brought in various jurisdictions throughout the country under the TCPA.