State Leaders Work to Protect the Privacy of Employees’ and Students’ Social Media AccountsSocial media has had a disruptive effect on expecta-tions of privacy. From Facebook applications that automatically share what a person is reading online to friends uploading and tagging embarrassing pho-tos, social media users have faced a series of privacy challenges that could leave them exposed.

When sharing on these sites, users supply a trove of personal information that may be associated with their identity indefinitely. Users who are diligent in protecting their online privacy can tweak privacy settings to keep certain sensitive information hid-den from others. Recently, however, employers and educational institutions have taken extra steps to access information hidden behind the privacy walls that users erect.

People have been asked to delete their social media accounts, “friend” a human resources direc-tor or coach, or even hand over the username and password of a personal account. The latter could mean the employer or school administrator could view very personal information about the individual in question, including, for example, his or her history of Facebook messages.

States leaders are taking the first steps in address-ing the public’s concerns regarding requests to access this personal information.

Public controversiesSocial media and a person’s expectation of privacy

first received serious attention when the Associated Press ran a story about a job applicant named Justin Bassett.1 He was interviewing for a job when the employer asked him to provide the username and password to his personal Facebook account. Bassett refused and removed himself from the pool of appli-cants because he did not want to work for a company that he believed would be so invasive. The incident touched a public nerve.

In April 2012, Maryland became the first state to approve legislation addressing the privacy of person-al social media accounts. It was also home to a social media controversy. The state’s second largest higher education institution, Towson University, faced a

public relations crisis when a football player tweeted a racial slur before a game.2 The NCAA suspended the player. The coach reacted by prohibiting his team members from using Twitter. It brought to light a key issue: Can educational institutions control students’ social media accounts?

A related issue occurred in Michigan, which is also working to regulate social media account privacy. A teacher’s aide at Frank Squires Elementary in Cassapolis, Mich., was fired because she refused to provide the login credentials to her account after a parent reported seeing an inappropriate photo on her page in April 2011.3 The core issue in this case is whether an employer can demand an employee’s private social media account credentials. Kimberly Hester, the teacher’s aide involved, is in a legal battle with the school regarding the dismissal. A bill being considered by the Michigan legislature would prevent employers or schools from demanding an individual’s social media account information.

APRIL 2012

The Council of State Governments

CAPITOL RESEARCHSOCIAL MEDIA

THE COUNCIL OF STATE GOVERNMENTS

1

2

IssuesEmployers and schools requesting access to social

media accounts has become so high profile that Facebook’s chief privacy officer Erin Egan released a statement addressing the requests, calling the increase in reports of employers and others seeking access to profiles and private information “distress-ing.” The emerging controversies noted by Facebook include:4

• Undermining expectations of privacy—Users ex-pect to be able to keep some parts of their profile private. Messages, for example, are intended to be private conversations. Accessing that person’s ac-count not only violates an expectation of privacy, but it also exposes much of his or her friends’ personal information.

• Violating Facebook’s terms of service—Face-book’s terms of service intend each profile to be an accurate representation of the person who owns the account. Therefore, Facebook requires that each person who signs onto the service not share his or her username and password.

• Unintended liabilities—Employers and educa-tional institutions open themselves up to a host of liabilities by having access to a person’s account. If a third party sees evidence of criminal activity on another person’s account, or if an employer learns the applicant is part of a protected class, they could be open to a series of legal obligations. Employers also may need to train third parties who review the accounts how to do so appropriately.

Government Leaders Take ActionState Activity

Several states—California, Illinois, Maryland, Massachusetts, Michigan, New York, South Caro-lina and Washington—have begun to address this controversy.5 The bills generally focus on two areas of third-party account access: educational institutions asking for students’ passwords and employers asking for employees’ passwords. The latter is the common denominator for the bills.

• California—In California, Assembly Bill 1844, introduced by Assembly Member Nora Campos, states that employers cannot require prospective employees to provide their private social media account password.6 Senate Bill 1349 applies only to public and independent postsecondary institutions. It would protect both students and employees from having to surrender their personal social media ac-count information.7

• Illinois—House Bill 3782 and House Bill 5713 amend the Right to Privacy in the Workplace Act and focus on employers. It protects employees from having to disclose their personal social media ac-count passwords.8

• Massachusetts—Rep. Cheryl Coakley-Rivera presented a bill on the Massachusetts docket that would prevent employers from demanding their employees’ social media account passwords.9

• Maryland—Maryland was the first state to pass legislation, House Bill 964 and Senate Bill 433, which was recently signed by Gov. Martin O’Malley. The legislation prohibits employers from request-ing access to private social media accounts, but does not address higher education. Bills that addressed students’ accounts are either in committee or have been withdrawn from consideration.10

• Michigan—Michigan’s House Bill 5523 is broad in scope. It protects employees and prospective employees from being forced to release their social media access information to employers. It also protects students in both K-12 and higher education from having to release login credentials to schools.11

• Minnesota—The Minnesota legislature is reviewing three bills—House File 2963, House File 2982 and Senate File 2565—all focused on protecting em-ployees or potential employees from being forced to provide access to their accounts as a condition of employment.12

• Missouri—A Missouri House committee is con-sidering H.B. 2060, which would prevent employ-ers from requesting login credentials from their employees.13

• New York— S.B. 6938 regulates employers, but it also specifically excludes the official social media accounts of the business or organization. Thus if an employee is tweeting from a company account, he or she could be required to surrender those credentials as a prerequisite for continued employ-ment.14 A.B. 965415 and S.B. 683116 in New York also prohibit employers from requesting access to social media accounts.

• South Carolina—South Carolina has addressed this issue through House Bill 5105, which prohibits employers from asking for credentials to log in to a private social networking account and protects employees from retaliation if they do not provide access after a request.17

• Washington—Senate Bill 6637 would prohibit em-ployers in the state from requesting their employ-ees’ social media account access information.18

3

1Valdes, Manuel; McFarland, Shannon. “Employers Ask Job Seekers for Facebook Passwords.” Associated Press. http://news.yahoo.com/employers-ask-job-seekers-facebook-passwords-170500338.html March 20, 2012.2Korman, Chris. “Towson Twitter Ban Comes as Legislators Move to Protect Student Freedoms.” The Baltimore Sun. http://articles.baltimoresun.com/2012-02-13/sports/bs-sp-towson-twitter-ban-0214-20120213_1_social-media-bradley-shear-towson-coach-rob-ambrose. February 13, 2012.3Protalinski, Emil. “Teacher’s Aide Fired for Refusing to Hand Over Facebook Password.” ZDNet. http://www.zdnet.com/blog/facebook/teachers-aide-fired-for-refusing-to-hand-over-facebook-password/11246 April 1, 20124Egan, Erin. “Protecting Your Passwords and Your Privacy.” Facebook. https://www.facebook.com/notes/facebook-and-privacy/protecting-your-passwords-and-your-privacy/326598317390057. March 23, 2012.5“Employer Access to Social Media Usernames and Passwords.” NCSL. http://www.ncsl.org/issues-research/telecom/employer-access-to-social-media-passwords.aspx. April 19, 2012.6AB 1844. http://www.leginfo.ca.gov/pub/11-12/bill/asm/ab_1801-1850/ab_1844_bill_20120329_amended_asm_v98.html7SB 1349. http://www.leginfo.ca.gov/pub/11-12/bill/sen/sb_1301-1350/sb_1349_bill_20120327_amended_sen_v98.html8HB 3782. http://www.ilga.gov/legislation/billstatus.asp?DocNum=3782&GAID=11&GA=97&DocTypeID=HB&LegID=61758&SessionID=849“An Act relative to social networking and employment. ” http://faircompetitionlaw.files.wordpress.com/2012/04/ma-social-media-bill-to-ban-employers-from-employees-social-media-login-credentials.pdf10SB 433. http://mlis.state.md.us/2012rs/billfile/sb0433.htm11HB 5523. http://www.legislature.mi.gov/documents/2011-2012/billintroduced/House/pdf/2012-HIB-5523.pdf12Employer Access to Social Media Usernames and Passwords.” NCSL. http://www.ncsl.org/issues-research/telecom/employer-access-to-social-media-passwords.aspx. April 19, 2012.13HB 2060. http://www.house.mo.gov/BillSummaryPrn.aspx?bill=HB2060&year=2012&code=R&style=new14S6938-2011. http://open.nysenate.gov/legislation/bill/S6938-201115A.B. 9654 http://assembly.state.ny.us/leg/?bn=A09654&term=201116S.B. 6831 http://assembly.state.ny.us/leg/?default_fld=%0D%0A&bn=S06831&term=2011&Summary=Y17H. 5105. http://www.scstatehouse.gov/sess119_2011-2012/bills/5105.htm18SB 6637. http://apps.leg.wa.gov/billinfo/summary.aspx?bill=663719The Associated Press. “Senators Question Employer Requests for Facebook Passwords” The New York Times. http://www.nytimes.com/2012/03/26/technol-ogy/senators-want-employers-facebook-password-requests-reviewed.htm. March 25, 201220H.R. 5050. http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.5050:21Albanesius, Chloe. PC Magazine. “Bill Would Ban Employers From Requesting Usernames, Passwords.” http://www.pcmag.com/article2/0,2817,2403759,00.asp? April 30, 2012

REFERENCES

Nathan Dickerson, CSG Research Analyst | ndickerson@csg.org

Federal ActivitySens. Charles Schumer of New York and Richard

Blumenthal of Connecticut in March 2012 asked U.S. Attorney General Eric Holder to investigate whether employers requiring job applicants to provide private social media account information violates the Stored Communications Act or the Computer Fraud and Abuse Act.19 Holder has not taken any action, but Reps. Eliot Engel and Jan Schakowsky have intro-duced the Social Networking Online Protection Act (H.R. 5050) at the federal level.20 This bill, like the majority of the state bills, focuses on prohibiting em-ployers from accessing their employees’ social media accounts.21