State Leaders Work to Protect the Privacy of Employees' and Students' Social Media Accounts

Monday, May 7, 2012 at 05:11 PM

Social media has changed the public's expectations of privacy, but a backlash has risen against employers' requests for access to current and potential employees' personal social media accounts. Schools have also faced similar controversies for attempting to exercise control over students' online behavior. Several state leaders from across the country have written legislation to address these concerns and ensure the privacy of personal social media accounts. The proposed bills protect, at a minimum, employees from having to turn over personal social media account information.

Download the brief in PDF / e-reader compatible format

Social media has had a disruptive effect on expectations of privacy. From Facebook applications that automatically share what a person is reading online to friends uploading and tagging embarrassing photos, social media users have faced a series of privacy challenges that could leave them exposed.

When sharing on these sites, users supply a trove of personal information that may be associated with their identity indefinitely. Users who are diligent in protecting their online privacy can tweak privacy settings to keep certain sensitive information hidden from others. Recently, however, employers and educational institutions have taken extra steps to access information hidden behind the privacy walls that users erect.

People have been asked to delete their social media accounts, “friend” a human resources director or coach, or even hand over the username and password of a personal account. The latter could mean the employer or school administrator could view very personal information about the individual in question, including, for example, his or her history of Facebook messages.

States leaders are taking the first steps in addressing the public’s concerns regarding requests to access this personal information.

Public controversies

Social media and a person’s expectation of privacy first received serious attention when the Associated Press ran a story about a job applicant named Justin Bassett.¹ He was interviewing for a job when the employer asked him to provide the username and password to his personal Facebook account. Bassett refused and removed himself from the pool of applicants because he did not want to work for a company that he believed would be so invasive. The incident touched a public nerve.

In April 2012, Maryland became the first state to approve legislation addressing the privacy of personal social media accounts. It was also home to a social media controversy. The state’s second largest higher education institution, Towson University, faced a public relations crisis when a football player tweeted a racial slur before a game.² The NCAA suspended the player. The coach reacted by prohibiting his team members from using Twitter. It brought to light a key issue: Can educational institutions control students’ social media accounts?

A related issue occurred in Michigan, which is also working to regulate social media account privacy. A teacher’s aide at Frank Squires Elementary in Cassapolis, Mich., was fired because she refused to provide the login credentials to her account after a parent reported seeing an inappropriate photo on her page in April 2011.³ The core issue in this case is whether an employer can demand an employee’s private social media account credentials. Kimberly Hester, the teacher’s aide involved, is in a legal battle with the school regarding the dismissal. A bill being considered by the Michigan legislature would prevent employers or schools from demanding an individual’s social media account information.

Issues

Employers and schools requesting access to social media accounts has become so high profile that Facebook’s chief privacy officer Erin Egan released a statement addressing the requests, calling the increase in reports of employers and others seeking access to profiles and private information “distressing.” The emerging controversies noted by Facebook include:⁴

Undermining expectations of privacy—Users expect to be able to keep some parts of their profile private. Messages, for example, are intended to be private conversations. Accessing that person’s account not only violates an expectation of privacy, but it also exposes much of his or her friends’ personal information.
Violating Facebook’s terms of service—Facebook’s terms of service intend each profile to be an accurate representation of the person who owns the account. Therefore, Facebook requires that each person who signs onto the service not share his or her username and password.
Unintended liabilities—Employers and educational institutions open themselves up to a host of liabilities by having access to a person’s account. If a third party sees evidence of criminal activity on another person’s account, or if an employer learns the applicant is part of a protected class, they could be open to a series of legal obligations. Employers also may need to train third parties who review the accounts how to do so appropriately.

Government Leaders Take Action State Activity

Several states—California, Illinois, Maryland, Massachusetts, Michigan, New York, South Carolina and Washington—have begun to address this controversy.⁵ The bills generally focus on two areas of third-party account access: educational institutions asking for students’ passwords and employers asking for employees’ passwords. The latter is the common denominator for the bills.

California—In California, Assembly Bill 1844, introduced by Assembly Member Nora Campos, states that employers cannot require prospective employees to provide their private social media account password.⁶ Senate Bill 1349 applies only to public and independent postsecondary institutions. It would protect both students and employees from having to surrender their personal social media account information.⁷
Illinois—House Bill 3782 and House Bill 5713 amend the Right to Privacy in the Workplace Act and focus on employers. It protects employees from having to disclose their personal social media account passwords.⁸
Massachusetts—Rep. Cheryl Coakley-Rivera presented a bill on the Massachusetts docket that would prevent employers from demanding their employees’ social media account passwords.⁹
Maryland—Maryland was the first state to pass legislation, House Bill 964 and Senate Bill 433, which was recently signed by Gov. Martin O’Malley. The legislation prohibits employers from requesting access to private social media accounts, but does not address higher education. Bills that addressed students’ accounts are either in committee or have been withdrawn from consideration.¹⁰
Michigan—Michigan’s House Bill 5523 is broad in scope. It protects employees and prospective employees from being forced to release their social media access information to employers. It also protects students in both K-12 and higher education from having to release login credentials to schools.¹¹
Minnesota—The Minnesota legislature is reviewing three bills—House File 2963, House File 2982 and Senate File 2565—all focused on protecting employees or potential employees from being forced to provide access to their accounts as a condition of employment.¹²
Missouri—A Missouri House committee is considering H.B. 2060, which would prevent employers from requesting login credentials from their employees.¹³
New York— S.B. 6938 regulates employers, but it also specifically excludes the official social media accounts of the business or organization. Thus if an employee is tweeting from a company account, he or she could be required to surrender those credentials as a prerequisite for continued employment.¹⁴ A.B. 9654¹⁵ and S.B. 6831¹⁶in New York also prohibit employers from requesting access to social media accounts.
South Carolina—South Carolina has addressed this issue through House Bill 5105, which prohibits employers from asking for credentials to log in to a private social networking account and protects employees from retaliation if they do not provide access after a request.¹⁷
Washington—Senate Bill 6637 would prohibit employers in the state from requesting their employees’ social media account access information.¹⁸

Federal Activity

Sens. Charles Schumer of New York and Richard Blumenthal of Connecticut in March 2012 asked U.S. Attorney General Eric Holder to investigate whether employers requiring job applicants to provide private social media account information violates the Stored Communications Act or the Computer Fraud and Abuse Act.¹⁹ Holder has not taken any action, but Reps. Eliot Engel and Jan Schakowsky have introduced the Social Networking Online Protection Act (H.R. 5050) at the federal level.²⁰ This bill, like the majority of the state bills, focuses on prohibiting employers from accessing their employees’ social media accounts.²¹

REFERENCES

1 Valdes, Manuel; McFarland, Shannon. “Employers Ask Job Seekers for Facebook Passwords.” Associated Press. l March 20, 2012.

2 Korman, Chris. “Towson Twitter Ban Comes as Legislators Move to Protect Student Freedoms.” The Baltimore Sun. February 13, 2012.

3 Protalinski, Emil. “Teacher’s Aide Fired for Refusing to Hand Over Facebook Password.” ZDNet. April 1, 2012

4 Egan, Erin. “Protecting Your Passwords and Your Privacy.” Facebook. March 23, 2012.

5 “Employer Access to Social Media Usernames and Passwords.” NCSL. . April 19, 2012.

6 AB 1844.

7 SB 1349.

8 HB 3782.

9 “An Act relative to social networking and employment. ”

10 SB 433.

11 HB 5523.

12 "Employer Access to Social Media Usernames and Passwords.” NCSL. April 19, 2012.

13 HB 2060.

14 S6938-2011.

15 A.B. 9654

16 S.B. 6831

17 H. 5105.

18 SB 6637.

19 The Associated Press. “Senators Question Employer Requests for Facebook Passwords” The New York Times. March 25, 2012

20 H.R. 5050.

21 Albanesius, Chloe. PC Magazine. “Bill Would Ban Employers From Requesting Usernames, Passwords.” April 30, 2012

Attachment	Size
cr_socialmediapassword.pdf	1.07 MB

Tags:

Capitol Research

Policy Area›Technology›Privacy