It’s no secret that the use of social media has expanded exponentially in recent years. On any given day, millions of people log onto platforms such as Facebook/Meta, Twitter/X, Instagram, Pinterest, LinkedIn, TikTok, YouTube, Snapchat and many others to be entertained, and stay in touch with friends and family.
Many businesses use these platforms as well to promote their brand and generate and maintain interest in their products and services. However, problems can arise when employees use their social media accounts to vent about supervisors, vent about working conditions, or share confidential company information with others. There have been instances (and occasionally lawsuits) involving employers who, concerned about what their employees may have posted online, have demanded access to their employees’ social media account credentials. Litigation has also resulted where employees tasked with handling their employer’s social media account have refused to provide passwords and account information upon their termination.
In recognition of these issues, New York Governor Kathy Hochul recently signed into law an amendment to New York’s Labor Law that, when it takes effect on March 12, 2024, will prohibit employers from requiring that an employee or job applicant:
- Disclose the log-in information for any personal social media account;
- Log into personal social media accounts (without disclosing the log-in credentials) so the employer can view non-public content; and/or
- Provide copies of photos, videos or other content from the account.
Employers may not discharge, discipline, or otherwise penalize or threaten an employee or applicant for refusing to provide access to a personal social media account. “Personal accounts” are defined as “an account or profile on an electronic medium where users may create, share, and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or internet website profiles or locations that is used by an employee or an applicant exclusively for personal purposes.”
The law’s protections do not extend to the disclosure of (a) social media content that is made available for viewing by the public without logging into the employee’s account, (b) content an employee or job applicant voluntarily chooses to share to the employer or a third party, or (c) content an employer has been directed to obtain and produce pursuant to court order. Nor does the law apply to “non-personal accounts.” Thus, employers may require that an employee provide passwords and access to:
- Nonpersonal accounts that provide access to the employer’s internal computer or information systems; and
- Social media accounts maintained by the employer for business purposes (such as a company Facebook account for example).
The law also clarifies that employers are permitted to access electronic communications devices the employer pays for in whole or in part provided the employer’s agreement to pay for the device was conditioned upon the employer’s right of access and the employee was provided prior notice of, and explicitly agreed to, such conditions. While employers may not access an employee’s personal social media accounts through such a company-provided device, they are nonetheless free to restrict employees from using an employer-provided device or network to access social media and other websites.
In preparation for this new law, employers in New York State should undertake a review of their current policies and make appropriate adjustments. Hiring personnel must be made aware that they cannot request or use any non-public social media content as part of the hiring process, and supervisory personnel must likewise be made aware that they cannot force an employee to disclose such content or grant access to a personal account. Any employees who utilize company-provided cell phones or similar devices should be required to acknowledge in writing that the device is for business purposes, and they should expect no right of privacy in the device (aside from any personal accounts, which you’re free to restrict them from accessing). Lastly, misuse of social media, and a company social media account in particular can cause substantial damage. Employees should be prohibited from posting anything that can reflect negatively on the company, and any employees responsible for maintaining your company’s social media accounts should be mature, trustworthy and reliable. More than one individual should possess the log-in credentials, and they should be immediately changed in the event one of those individuals separates from the company.
