New York Prohibits Employers From Requiring Access To Employee's Social Media Account Information

New York Governor Kathy Hochul signed a bill into law last month that amended New York State Labor Law, prohibiting employers from requesting or requiring employees and job applicants to disclose their social media account information. The law also prohibits employers from retaliating against employees or job applicants who refuse to disclose their social media account information. 

Prohibited Actions by Employers Under the Law

Specifically, the law prohibits an employer from requesting, requiring, or coercing an employee or job applicant to:

(i) disclose their username, password, or other authentication information for accessing a personal account through an electronic communications device;

(ii) access their personal account in the presence of the employer; or

(iii) reproduce any photographs, videos, or other information contained within a personal account by means prohibited under the law.

The law defines a "personal account" as an account or profile on an electronic medium where users may create, share, and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or internet website profiles or locations that are being used by an employee or an applicant exclusively for personal purposes.

The law also broadly defines "employer" as any "person or entity engaged in a business, industry, profession, trade or other enterprise in the state" and "shall include an agent, representative or designee of the employer."

Authorized Actions by Employers Under the Law

Under the law, an employer is permitted to:

(i) require or request an employee to disclose access information to an account provided by the employer where such account is used for business purposes, and the employee was provided prior notice of the employer's right to request or require such access information;

(ii) require or request an employee to disclose access information to an account known to an employer to be used for business purposes;

(iii) access an electronic communications device paid for in whole or in part by the employer where the provision of or payment for such device is conditioned on the employer's right to access such device, and the employee was provided prior notice of and explicitly agreed to such conditions. However, an employer is not permitted to access any personal accounts on such a device;

(iv) comply with a court order in obtaining or providing information from, or access to, an employee's accounts as such court order may require;

(v) restrict or prohibit an employee's access to certain websites while using an employer's network or while using an electronic communications device paid for in whole or part by the employer where the provision of or payment for such electronic communications device was conditioned on the employer's right to restrict such access, and the employee was provided prior notice of and explicitly agreed to such conditions.

Additional Authorized Employer Exceptions

The law also contains other exceptions for employers. Employers may require employees to disclose any username, password, or other means for accessing nonpersonal accounts that provide access to the employer's internal computer or information system. An employer can also view, access, or utilize information about an employee or job applicant that is available in the public domain or for purposes of obtaining reports of misconduct or investigating misconduct, photographs, video, messages, or other information that is voluntarily shared by an employee, client, or other third party.

Further, an employer is permitted to screen employees or job applicants before hiring or monitoring employee communications as allowed by federal law or by a self-regulatory organization. Lastly, the law provides an employer with an affirmative defense where it acted to comply with federal, state, or local law requirements.

The law is set to become effective on March 12, 2024. Employers should reassess and revise their social media policies and ensure their hiring practices comply with this law.