Yesterday, Montana became the twentieth state to enact a law protecting employees from employer interference with personal social media accounts. The law, which takes effect immediately, prohibits employers from requiring or requesting that a current or prospective employee: disclose a username or password to his or her personal social media account; access a personal social media account in the presence of the employer; or divulge any information contained on personal social media. Employers may not take adverse action against a current or prospective employee for refusing to engage in such activity.
The law includes notable exceptions in the context of employer investigations, allowing employers to require employees to provide access credentials for their personal social media accounts:
- if the employer has “specific information” about (i) activity indicating work-related employee misconduct or criminal defamation, or (ii) the unauthorized transfer of proprietary/confidential information, trade secrets, or financial data to a personal account; or
- where necessary to comply with federal laws or regulatory requirements, or with SEC rules for self-regulatory organizations.
Montana’s law also does not apply to social media accounts opened for or provided by an employer and intended only for business-related purposes. In the event of a violation of the law, employees may pursue a private right of action in small claims court, with damages limited to $500 or actual damages, and legal costs to the prevailing party.
Montana joins Arkansas, California, Colorado, Illinois, Louisiana, Maryland, Michigan, Nevada, New Hampshire, New Jersey, New Mexico, Oklahoma, Oregon, Rhode Island, Tennessee, Utah, Virginia, Washington, and Wisconsin, which have passed similar measures.