Personal Online Usernames and Passwords Are Protected in TN as of January 1, 2015
And you thought it couldn’t happen here!
On April 29, Governor Haslam signed into law the Employee Online Privacy Act of 2014.
The new law does not go into effect until January 1, 2015 and will not affect any contracts or other agreements entered into with applicants or employees prior to that date (unless they are subsequently renewed on or after January 1, 2015).
As of January 1, 2015 though, it will be unlawful in Tennessee for employers to- Request or require an applicant or employee to disclose a password that allows access to the individual's personal Internet account;
- Compel an applicant or employee to add the employer or an employment agency (including but not limited to a background check company) to the individual's personal Internet account contacts, associates or "friends" list;
- Compel an applicant or employee to access a personal Internet account in the employer's presence in a manner which enables the employer to observe the contents of the individual's personal Internet account; or
- Take adverse action, fail to hire or otherwise penalize an applicant or employee for failing to disclose information or otherwise comply with one of the prohibited activities described above.
A "personal Internet account" is defined by the Act as an online account used by an applicant or employee exclusively for personal communications that are not business-related. The definition does not include social media accounts that an applicant or employee creates, maintains, uses or accesses for their own business-related communications or an employer's business purposes.
The new law also does not prevent employers from- Requesting or requiring passwords, usernames or other information needed to access an electronic communications device the employer has supplied or fully or partially paid for, or an account or service it provides to employees for business purposes or which is otherwise used for the employer's business purposes;
- Disciplining or discharging an employee who transfers the employer's confidential or proprietary information or financial data to a personal Internet account without the employer's authorization;
- Requiring an employee to cooperate in an investigation regarding legal or regulatory compliance or work-related employee misconduct – even if this involves providing personal Internet account passwords, usernames or other account access information. (In order to do this, the employer must have some specific information that there is information relating to the investigation on the employee’s personal Internet account – they cannot just do this in every employee investigation as a matter of course);
- Restricting or prohibiting employee access to certain websites while the employee is using -- and monitoring, reviewing, accessing or blocking electronic data stored on -- an electronic communications device which is supplied or fully or partially paid for by the employer, or while using the employer's network and resources (be aware that there are also some federal laws which already restrict employer activities in these areas however);
- Conducting background checks or other applicant or employee screening which does not involve obtaining personal account passwords or usernames;
- Conducting background checks relating to law enforcement employment or as required by federal law of "self-regulatory organizations" as defined by the Securities and Exchange Act of 1934; or
- Viewing, accessing and using any public information regarding applicants or employees or information which is otherwise available without violating this Act.
So, not the end of the world – there is still some online fun to be had/dirt to be dug. But for those of you who currently require applicants and/or employees to provide you with passwords or usernames for their personal Internet accounts as part of your applicant or new position vetting process, just be aware that your days to do so (in Tennessee at least) are numbered.
The opinions expressed in this bulletin are intended for general guidance only. They are not intended as recommendations for specific situations. As always, readers should consult a qualified attorney for specific legal guidance. Should you need assistance from a Miller & Martin attorney, please call 1-800-275-7303.
