Maryland was the first state in the country to do it. According to the National Conference of State Legislatures, as of January 2, 2018, twenty-six states in total, plus Guam, have joined Maryland in enacting laws protecting employees’ social media privacy rights and/or their internet privacy rights. Sixteen states (including Maryland and Virginia) and the District of Columbia have enacted laws that prohibit educational institutions from requiring students to reveal their social media names and/or passwords.
Under the Maryland law, which went into effect October 1, 2012 and is codified at Md. Labor & Employment Code Sec. 3-712, an employer may not request or require that an employee or applicant disclose any user name, password, or other means for accessing a personal account or service through an electronic communications device. An employer is prohibited from discharging, disciplining, or otherwise penalizing (or threatening to do any of those things to) an employee or applicant who refuses to disclose such information. The size of the employer does not matter; all employers are covered by this law.
This being said, the law protects employers, too. The Maryland law prohibits an employee from downloading the employer’s proprietary information or financial data to an employee’s personal web site, an internet web site, a web-based account, or a similar account without authorization. An employer who receives information that such web sites or accounts are being used for business purposes may conduct an investigation to ensure that there has been compliance with applicable securities or financial laws, or with regulatory requirements.
Virginia’s law went into effect in 2015 and is codified at Va. Code Sec. 40.1-28.7:5. The law prohibits an employer from requiring a current or prospective employee to disclose his or her social media username and password, or from requiring that person to add an employee, supervisor, or administrator to the individual’s list of contacts for his or her social media account. Should an employer inadvertently obtain the employee’s username and password (or other login information), the employer is not allowed to use that information to gain access to the employee’s social media account. Of course, there are certain exceptions, and it is crucial to review the entire statute when issues of permissible social media access arise.
This area of law is evolving, so employers and employees alike should stay current on proposed legislation. Gaps exist, and the best way for an individual to ensure that a potential or current employer does not discover on social media his or her questionable antics is…you guessed it: Don’t put it on social media in the first place!
As with so many problems, the solution is obvious ‐ but not always easy to implement.