Another state gives a new legal spin to "password protection."
California just passed legislation that will prevent employers from demanding the social media passwords of employees current and potential -- and, at the same time, prevent institutions of higher education from demanding the same of their students. Yesterday, Jerry Brown signed two bills into law. The first, AB-1844, prevents employers from asking their staff for their social media usernames or passwords (and, in another iteration, from logging into social media in their presence). The second, SB-1349, extends that protection to students at California's many private and public colleges and universities. As Brown put it in a Facebook post, "California pioneered the social media revolution. These laws protect Californians from unwarranted invasions of their social media accounts."
While it's unclear how widespread the problem the new laws are addressing actually is, the author of the one of the California bills says that more than 100 cases currently before the National Labor Relations Board involve employer workplace policies around social media. And there are the high-profile cases: the Maryland Corrections department applicant who had his password demanded, the Michigan teacher's aide who was suspended after she refused to provide access to her Facebook account. Facebook, CNET notes, has also said it has experienced an increase in reports of employers seeking to gain "inappropriate access" to people's Facebook profiles or private information.
Here's the relevant language of the Assembly bill:
(a) As used in this chapter, "social media" means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.
(b) An employer shall not require or request an employee or applicant for employment to do any of the following:
(1) Disclose a username or password for the purpose of accessing personal social media.
(2) Access personal social media in the presence of the employer.
(3) Divulge any personal social media, except as provided in subdivision (c).
(c) Nothing in this section shall affect an employer's existing rights and obligations to request an employee to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding.
(d) Nothing in this section precludes an employer from requiring or requesting an employee to disclose a username, password, or other method for the purpose of accessing an employer-issued electronic device.
(e) An employer shall not discharge, discipline, threaten to discharge or discipline, or otherwise retaliate against an employee or applicant for not complying with a request or demand by the employer that violates this section. However, this section does not prohibit an employer from terminating or otherwise taking an adverse action against an employee or applicant if otherwise permitted by law.
The Senate bill, a companion bill to its Assembly-originated counterpart, added to that by extending the rights of nondisclosure to California's college and university students:
(a) Public and private postsecondary educational institutions, and their employees and representatives, shall not require or request a student, prospective student, or student group to do any of the following:
(1) Disclose a user name or password for accessing personal social media.
(2) Access personal social media in the presence of the institution's employee or representative.
(3) Divulge any personal social media information.
(b) A public or private postsecondary educational institution shall not suspend, expel, discipline, threaten to take any of those actions, or otherwise penalize a student, prospective student, or student group in any way for refusing to comply with a request or demand that violates this section.
(c) This section shall not do either of the following:
(1) Affect a public or private postsecondary educational institution's existing rights and obligations to protect against and investigate alleged student misconduct or violations of applicable laws and regulations.
(2) Prohibit a public or private postsecondary educational institution from taking any adverse action against a student, prospective student, or student group for any lawful reason.
The laws come on the heels of similar legislation passed in Delaware, Illinois, and Maryland. And a social media-oriented federal bill, the Password Protection Act Of 2012, is under consideration in Washington.