You have probably seen news accounts of employers requesting or requiring employees or applicants to disclose their usernames or passwords for their online accounts at services like Facebook and Twitter. Employers ostensibly request this information to learn more about job applicants and to monitor employee compliance with workplace requirements. Many employees and observers, however, see such requests as overly intrusive. The resulting controversy has led some states to pass laws restricting employers’ rights to make such requests. On March 7, 2013, the Utah State Legislature joined these states and passed the Internet Employment Privacy Act (the “Act”).
Under the Act, Utah employers may not request that an employee or job applicant disclose a username and password allowing access to a personal internet account. It also prohibits employers from taking an adverse employment action (like refusing to hire, demoting or firing) against an employee who fails or refuses to disclose a username or password for a personal internet account. A “personal internet account” is defined under the Act as an online account used by the employee or applicant for purely personal reasons unrelated to work.
Although the Act prohibits requests for employee usernames and passwords, it does allow employers to do other things, such as:
- Request usernames and passwords to access a device provided or paid for by the employer or to access internet accounts used by an employee for business purposes.
- Discipline or discharge employees who transfer proprietary information of the employer to a personal internet account without permission.
- Investigate certain types of misconduct and require employees to participate in those investigations.
- Restrict employee access to certain websites while using a device provided or paid for by the employer.
- Monitor, review access or block electronic data stored on a device provided or paid for by the employer.
- View, access or use information about an employee or applicant that is in the public domain or can be accessed without a username or password.
The Act provides a private right of action for any person aggrieved by such an action, but limits any potential award to $500. Even with this limited exposure, the Utah Internet Employment Privacy Act requires that employers proceed with caution when accessing or requesting access to employee information on the internet.