According to a recent survey, one in 10 individuals between the ages of 16 and 34 reported being rejected for a job because of their social media profile. And in a survey of 2,300 hiring managers last year by an online job website, nearly 40 percent admitted to screening potential hires using social media, with many saying that they had rejected job applications as a result of their findings. This is likely because of the wealth of information that an employee’s (or potential employee’s) social media activities might reveal – including drug use, embarrassing photos or inappropriate comments.
Indeed, “the current trend for young Americans toward using social networks as a primary vehicle for effective positive social and political change establishes social networks as the new digital age ‘public square’ for important discourse,” according to Delaware’s General Assembly. However, because social media is primarily used for personal connections – and not just professional uses – access to such information has the potential to cause individuals to feel like their privacy is being invaded.
Consequently, in an increasing number of states, legislators have passed statutes that prohibit employers from requiring a prospective or current employee to provide password or access information to his/her social media account as a condition of employment. To date, 12 states have enacted such legislation, and similar bills are pending in almost every other state.
Washington’s statute, which became effective last month, is a good example of this type of legislation. It makes it unlawful for an employer to:
- Require, request or otherwise coerce an employee or an applicant for employment to disclose login information for his/her personal social media account;
- Require, request or otherwise coerce an employee or applicant to access a personal social media account in the presence of the employer and in a manner that enables the employer to view the contents of the account;
- Compel or coerce an employee or applicant to add a person, including the employer, to the list of contacts associated with the employee’s or applicant’s personal social media account or
- Require, request or otherwise cause an employee or applicant to alter the settings on his or her personal social media account so as to affect a third party’s ability to view the contents of the account.
It also prohibits the employer from failing to hire or from taking or threatening to take any action to discharge, discipline or otherwise penalize an employee who refuses to engage in an action prohibited by the statute.
While the Washington statute does not define what is a social media account, Illinois’ definition, which has been adopted by several other states, characterizes a social networking website as “an Internet-based service that allows individuals to construct a public or semi-public profile within a bounded system created by the service; create a list of other users with whom they share a connection within the system or view and navigate their list of connections and those made by others within the system.”
In response to arguments that employers need access to social media accounts in order to make sure that employees are not revealing sensitive information or otherwise engaging in activities that might result in employer liability, most statutes allow an employer to request access to the content of the account to make a factual determination in the course of an investigation, so long as the employee is not required to provide the login information. The statute also does not apply to a social media account that the employee is maintaining on behalf of the employer. Also, if the employer inadvertently receives login information (i.e., if it monitors emails), it is not liable for possessing that information, but may not use it to access the employee’s social media account.
Finally, in several states, there are potentially significant consequences for an employer who violates the statute. In Colorado and Washington, for example, an applicant or employee can bring a private cause of action for injunctive relief, compensatory/consequential damages and reasonable attorneys’ fees and costs. In Utah, an aggrieved person can bring a civil cause of action and, if the court finds a violation of the statute, the plaintiff can be awarded up to $500. In Michigan, a person who violates its statute is guilty of a misdemeanor punishable by a fine of up to $1,000.
The lesson here for employers is that while it might seem reasonable to require an employee or potential employee to disclose social media access information, a good corporate compliance policy needs to understand that such a request might be prohibited in your jurisdiction, especially given the large number of states that are considering similar legislation. Thus, it is imperative that employers who are seeking access to an employee’s or applicant’s social media account proceed with extreme caution.
Leslie P. Machado is a partner and co-leader of the Media, Internet & E-Commerce industry team at LeClairRyan, based in the national law firm's Alexandria, Va. office. He has extensive experience counseling and advising companies on privacy policies and also regularly represents employers in a wide variety of employment matters. He can be contacted at: firstname.lastname@example.org