Beginning in March 2024, New York employers will be restricted from accessing employee social media accounts. The new law, A.386, amends New York’s labor law and will restrict employers from requesting, requiring, or coercing an employee or applicant for employment to provide their username and password to social media websites. In recent times, it has become common for employers to access employee and applicant social media pages, as employers are increasingly held accountable for employee’s posts and face the backlash of posts made on employee’s personal time. Some employers request social media information to conduct pre- or post-offer reviews of employee social media posts to protect themselves.
In New York, with limited exceptions, this will no longer be allowed. Employers may not request, require, or coerce an employee or applicant to provide their login information. They may not request an employee or applicant log into the social media website in the employer’s presence. If accessed unlawfully, the employer may not “reproduce in any manner” the information found therein, presumably including sharing the information so as to determine the employment status of an applicant or existing employee. “Employer” here is defined broadly to include an entity engaged in a business in the state.
This applies to “personal accounts,” defined as accounts used “exclusively for personal purposes.” It specifically does not apply to “accounts known to an employer to be used for business purposes,” so employers should expect litigation on this definition. It also does not apply when an employer pays for the communications device and previously conditioned payment on access to the employee’s accounts.
There are exceptions for compliance with federal law, state law and court orders. Also, an employer is still specifically allowed to be “voluntarily added” to a “list of contacts associated with a personal internet account.” This means an employer or agent can be the “friend” of an employee or applicant and, therefore, have greater access to their posts as long as the relationship is truly voluntary. An employer is still allowed to view publicly available information, or information that is voluntarily shared, on an employee's or applicant’s social media page to investigate misconduct and to comply with its duty to screen employees and monitor employee communications.
New York is the latest of several states to enact similar restrictions. California’s C.A. Labor Code § 980 (2021) also prohibits an employer from requiring or requesting an employee or applicant’s username and password or requiring an employee or applicant to log into the social media website in the employer’s presence. California also prohibits requiring an employee or applicant to “divulge” any personal social media. California law does not contain the same carve out for voluntarily “friending,” nor does it restrict this.
Enforcement of social media workplace privacy laws varies from state to state, either through a state agency (New York’s through the state’s Department of Labor’s Division of Labor Standards) or giving employees and applicants a private right of action to sue the employer in civil court for a violation. Penalties vary, ranging from flat civil penalties to actual damages, job reinstatement, and attorneys’ fees and costs. Colorado’s similar law, C.R.S. § 8-2-127, restricts requests and requirements for employee and applicant usernames and passwords and “compelling” an employee to “friend” the employer. Colorado employers are subject to a fine of up to $1,000 for the first offense and up to $5,000 for each subsequent violation.
In the world of social media, employers can be caught between a rock and a hard place – somehow held responsible for employee postings on their personal pages on their own time but unable to continually monitor employee activity. New York’s law has now made this more difficult for New York employers. Given the lead time until its enactment, employers should now take note and modify their employment policies and practices accordingly. Creating or modifying an effective social media policy requires pinpointing key themes for use by both the business and its employees. Under the new law, employees and job applicants will enjoy greater privacy on personal social media platforms. Still, they should also remember that employers can access content posted on public social media profiles.
If you have employees in any affected states, contact your experienced Gordon Rees Scully Mansukhani attorney, including Samantha Gerken and Jeff Schagren, to develop a plan to keep your workplace and reputation safe while complying with changing state laws.