On September 27, 2012, California Governor Jerry Brown signed two pieces of legislation intended to protect the privacy of social media accounts. The first, AB 1844, covers employees, and the second, SB 1349, covers students at postsecondary educational institutions. I wrote an earlier post about how some employers are demanding that employment applicants give them their Facebook user names and passwords so that they can review their accounts while vetting their applications. Other employers have been asking employment applicants to log in to their accounts so they can view applicants' accounts. Under the new legislation, both of these practices are now illegal in California.
Under AB 1844, an employer may not require or request an employee or applicant to disclose a user name or password for a social media account. In addition, an employer must not require or request an employee or applicant to access social media in the presence of the employer. Further, employers must not require or request an employee or applicant to divulge any social media to the employer. AB 1844 also bars employers from disciplining, firing, or retaliating against employees for failing to comply with such demands.
SB1349 does the same thing for postsecondary educational institutions. It covers students, prospective students, and student groups. Educational institutions cannot require or request the disclosure of a user name or password for a social media account. SB 1349 also bars an educational institution from requiring or requesting access to social media in the presence of the institution. Institutions are also barred from requiring or requesting disclosure of social media to the institution. Finally, SB 1349 precludes educational institutions from suspending, expelling, disciplining, or otherwise penalizing students for failing to comply with such demands.
Both bills define social media the same way. The term "social media" means "an electronic service or account, or electronic content, including, but not limited to, videos, or still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations." Both bills also make it clear that these laws are not intended to affect existing rights to investigate misconduct or violations of law.
AB 1844 also says that the law does not prevent an employer from demanding login credentials for purposes of accessing an employer-issued electronic device. Thus, employers with a "Bring Your Own Device" (BYOD) policy, in which employees use their personal devices for work, face additional limitations in comparison with employers that issue devices for employees' use. Employers should take this difference into account when considering the risks of BYOD programs.
Partner, Cooke Kobrick & Wu LLP