Lately, we’ve been witnessing some quite positive developments in privacy law of the US. Some of them are foreign-influenced: the Court of Justice of the European Union has declared US digital privacy laws inadequate last month. Some efforts come from beloved California where the police must now get warrants before requesting online data, starting Oct 8, 2015. Many other states are following in the right direction, too, which brings us to
On Wednesday, MA Senators voted, 39-0, on S.2034 – An Act Relative to Social Media Privacy Protection. If enacted, the bill would prohibit educational institutions and employers to request a user name, password or other means for access to a personal social media account. The bill also prohibits compelling a student or employee to add anybody as a “friend,” including but not limited to, a coach, teacher, other school employee or school volunteer, or any agent of the employer.
An aggrieved student may institute a civil action for damages or to restrain a violation of the Act and may recover $1,000 for each violation.
The bill does not apply to information that has been publicly shared by a student or employee. The bill does not limit an educational institution’s or employer’s right to promulgate and maintain lawful policies governing the use of the educational institution’s electronic equipment, including policies regarding use of the internet, email or social media.
The bill includes exemptions for employers to deal with investigations related to social network accounts. However, an employer, prior to requesting access to a personal social media account, shall notify the employee of the grounds for the request; and provided further, that (i) any access to an employee’s personal social media account shall be limited to identifying relevant evidence, (ii) the social media is used solely for purposes of the investigation or a related proceeding, and (iii) the employer has no other means of obtaining the relevant information.
MA State Senators are currently considering amendments to the bill that would cover interns and prevent employers and schools from requesting printed copies of social media account contents. After that, the bill will go to the House for a round of votes.
In 2012, state legislators began introducing privacy bills to prevent employers and schools from requesting passwords to personal Internet accounts.
A number of lawsuits challenged the legality of employers and schools demanding passwords. For example, in 2014, Riley Stratton (photo: Associated Press), a Minnesota sixth-grader, represented by ACLU, achieved a $70,000 settlement after her school accessed her Facebook profile and emails to look into the disparaging comments about a teacher’s aide she had left from her home computer.
In 2015, at least 23 states have considered the legislation and nine states have enacted it this year.
The National Conference of State Legislatures maintains a list of state statutes related to social media privacy at work and in schools.
California has already enacted similar laws. The relevant excerpts are below.
Education Code
Section 99120-99122
99120. As used in this chapter, “social media” means an electronic
service or account, or electronic content, including, but not limited
to, videos or still photographs, blogs, video blogs, podcasts,
instant and text messages, email, online services or accounts, or
Internet Web site profiles or locations.
99121. (a) Public and private postsecondary educational
institutions, and their employees and representatives, shall not
require or request a student, prospective student, or student group
to do any of the following:
(1) Disclose a user name or password for accessing personal social
media.
(2) Access personal social media in the presence of the
institution’s employee or representative.
(3) Divulge any personal social media information.
(b) A public or private postsecondary educational institution
shall not suspend, expel, discipline, threaten to take any of those
actions, or otherwise penalize a student, prospective student, or
student group in any way for refusing to comply with a request or
demand that violates this section.
(c) This section shall not do either of the following:
(1) Affect a public or private postsecondary educational
institution’s existing rights and obligations to protect against and
investigate alleged student misconduct or violations of applicable
laws and regulations.
(2) Prohibit a public or private postsecondary educational
institution from taking any adverse action against a student,
prospective student, or student group for any lawful reason.
99122. A private nonprofit or for-profit postsecondary educational
institution shall post its social media privacy policy on the
institution’s Internet Web site.
Labor Code
Section 980
980. (a) As used in this chapter, “social media” means an
electronic service or account, or electronic content, including, but
not limited to, videos, still photographs, blogs, video blogs,
podcasts, instant and text messages, email, online services or
accounts, or Internet Web site profiles or locations.
(b) An employer shall not require or request an employee or
applicant for employment to do any of the following:
(1) Disclose a username or password for the purpose of accessing
personal social media.
(2) Access personal social media in the presence of the employer.
(3) Divulge any personal social media, except as provided in
subdivision (c).
(c) Nothing in this section shall affect an employer’s existing
rights and obligations to request an employee to divulge personal
social media reasonably believed to be relevant to an investigation
of allegations of employee misconduct or employee violation of
applicable laws and regulations, provided that the social media is
used solely for purposes of that investigation or a related
proceeding.
(d) Nothing in this section precludes an employer from requiring
or requesting an employee to disclose a username, password, or other
method for the purpose of accessing an employer-issued electronic
device.
(e) An employer shall not discharge, discipline, threaten to
discharge or discipline, or otherwise retaliate against an employee
or applicant for not complying with a request or demand by the
employer that violates this section. However, this section does not
prohibit an employer from terminating or otherwise taking an adverse
action against an employee or applicant if otherwise permitted by
law.