Labor and Employment Alert: Virginia Limits Employer Access to Employee Social Media Accounts

Underscoring a national trend, Virginia joined 18 states (Arkansas, California, Colorado, Illinois, Louisiana, Maryland, Michigan, Nevada, New Hampshire, New Jersey, New Mexico, Oklahoma, Oregon, Rhode Island, Tennessee, Utah, Washington, and Wisconsin) limiting employer access to the social media accounts of job applicants and employees.

Beginning on July 1, 2015, employers in Virginia will be prohibited from requiring that applicants and employees disclose their username and/or password to their personal social media accounts.  Employers also will be prohibited from requiring that applicants and employees add an employee, supervisor or administrator to the list of contacts associated with those accounts.  Employers are prohibited from discharging, disciplining, or otherwise penalizing an employee and from refusing to hire an applicant for refusing to provide their username and password.

However, the law contains several important provisos:

• First, the law only applies to an applicant’s or employee’s “personal” social media account.  So the law does not apply to accounts opened at the employer’s request, accounts provided to the employee by the employer or accounts set up by the employee on behalf of the employer.

• Second, an employer may request that employees disclose their username and password if the employer  “reasonably believes” that the social media account is “relevant” to the employer’s “formal investigation or related proceeding” of the employee’s violation of federal, state, or local laws or regulations or the employer’s written policies.

• Third, employers may view information about an applicant or employee that is publicly available.

• Fourth, an employer does not violate the law if the employer “inadvertently” obtains an employee’s username and password through the use of an employer-provided electronic device or a program that monitors the employer’s network (however, the employer cannot use the information to access the account).

• Fifth, an employer may still obtain usernames and passwords in order to comply with federal, state, or local laws, rules, or regulations (including those of a self-regulatory organization such as those dealing with securities trading).

Virginia’s social media law highlights the need to be aware of the ever-shifting landscape of laws and regulations affecting social media.  Similar legislation has been or is likely to be introduced in other states.  In Ohio, for example, a bill to restrict employer’s access to social media accounts has been introduced to make unauthorized access an unlawful discriminatory practice.  We outlined this proposed legislation in a previous Labor and Employment Alert. The National Labor Relations Board has aggressively scrutinized employers’ social media policies to see whether the policies interfered with employees’ rights to engage in concerted activity.  And the Equal Employment Opportunity Commission has reiterated that employers may not use personal information, including that obtained from social media postings, to make employment decisions on prohibited bases, such as race, gender, national origin, color, religion, age, disability or genetic information.  Contact your Vorys lawyer if you have questions about your company’s social media policies.