One of the hottest and most controversial topics facing employers right now is whether you legally can require an employee or applicant to disclose his or her social media login information as a condition of employment. The short answer is do not do it, but if you must, proceed with extreme caution.

A significant concern that has been raised is that employees or applicants that are asked or required to disclose this type of information will feel compelled to do so to keep their job or not lose out on an opportunity. Many have argued that such disclosures will make employers privy to sensitive and protected personal information such as health status, religion, age, marital status, pregnancy status, and other protected information that employers are not permitted to use as the basis for employment decisions. If you, as an employer, currently do so, you should be aware that your company may be exposed to unanticipated lawsuits and potential liability.

Maryland just became the first state to pass legislation on this topic and other states are following Maryland’s lead, including New York. New legislation has been introduced in the State Senate which, if passed, would amend the Labor Law by adding a new Section 215-D. Like the Maryland law, this proposed law would make it illegal for employers to require employees or applicants to disclose any login names or passwords for personal social media sites, calling it a “gross invasion of privacy.” In addition to creating a right to file a lawsuit against the employer for adverse employment actions based on a refusal to disclose the account information, the law would impose fines on the employer for each offense. Also, Senator Charles Schumer (along with Senator Richard Blumenthal of Connecticut) recently requested that both the Equal Employment Opportunity Commission and the U.S. Department of Justice investigate whether this practice violates federal law, including the Stored Communications Act, the Computer Fraud and Abuse Act, and other anti-discrimination statutes. So far, neither the EEOC nor the DOJ has responded to the senators’ requests.

Despite employee concerns, there may be circumstances where it is appropriate for employers to request personal login information from employees and applicants. For example, if an employer is required to investigate a complaint that one employee is using a website like Facebook to harass another employee, it may be necessary to obtain login information. You also may decide your company has a legitimate business reason for reviewing an applicant’s social media page if the position involves highly-sensitive security issues. Also, the newly proposed New York legislation would specifically authorize employers to require access to non-personal accounts or services that provide access to the employer's internal computer or information systems.

Because the law in this area literally is developing and changing every day, you would be wise to proceed carefully. We can help you craft written policies and procedures to help protect your company from unwanted and unwelcomed legal exposure.

« return to news