Maryland Legislature Passes Bill Prohibiting Employers from Requesting Social Media Passwords
During the recently completed legislative session, the Maryland General Assembly became the first state legislature in the country to pass legislation prohibiting employers from requesting access to employees' and job applicants' personal computer accounts, most notably Facebook and other social media accounts. This article examines the effects the law will have on how Maryland employers handle hiring decisions and internal investigations.
In recent months, numerous media outlets have presented reports of instances in which job applicants have been requested to provide potential employers with the passwords to their social media accounts in the course of the hiring process, including being asked to log onto personal Facebook pages during job interviews. Although there is considerable doubt as to whether this practice has become widespread, the attention resulting from these reports spurred a number of legislative efforts to restrict the circumstances in which an employer can require an applicant or employee to grant the employer access to his or her personal computer accounts.
Late in its 2012 legislative session, Maryland's General Assembly became the first state legislature in the county to pass a bill addressing this topic. Barring a veto of the legislation by Governor Martin O'Malley, the new legislation will take effect October 1, 2012.
The bill creates a general rule that “an employer may not request or require that an employee or applicant disclose any user name, password, or other means for accessing a personal account or service through an electronic communications device.” The bill is thus quite broad in scope, as it bars any request for access to the personal accounts of either an applicant or an employee. The act further provides than an employer may not “discharge, discipline, or otherwise penalize or threaten to discharge discipline, or otherwise penalize” an employee for refusing to disclose information relating to personal accounts. This same prohibition applies to the refusal to hire applicants who refuse to provide such information.
The most obvious effect of the bill will be to eliminate the disclosure or use of information posted to password-protected computer accounts, such as an applicant's private Facebook page, during the hiring process. Perhaps of even greater concern for employers, however, is that the bill contains only very limited exceptions to the general rule regarding the accessing of such information in the course of workplace investigations. The bill provides that its language shall not be construed as preventing (i) investigations by an employer “for the purpose of ensuring compliance with applicable securities or financial law, or regulatory requirements” where the employer has received a report of an employee's use of a personal website or online account for business purposes, or (ii) investigations regarding unauthorized downloading of an employer's proprietary information or financial data.
Notably absent from these exceptions is a provision that would generally permit employers to request access to personal accounts in the course of workplace investigations unrelated to disclosures of the employer's confidential data, such as in a situation where an employee claims that another employee is using social media to engage in sexual or other harassment. In investigating such claims, Maryland employers will now need to be cognizant of the restrictions on obtaining information relating to such activities via a request to the employees involved for passwords or other access to restricted accounts.
Takeaway for employers: Assuming that this bill is signed by Governor O'Malley and takes effect October 1, 2012, Maryland employers will be barred from requiring applicants to turn over passwords to social media or other online accounts during the hiring process. Employers will likewise be barred from requesting access to such accounts in the course of most investigations of workplace misconduct. Employers will need to evaluate their operating procedures to ensure compliance with these new requirements, and will likewise need to consider alternative steps for gathering necessary information in the course of investigations into workplace misconduct.