Effective July 1, 2015 Virginia Code § 40.1-28.7:5 prohibits employers from requiring that its current or prospective employees produce usernames or passwords granting access to the employee’s personal social media accounts.
The new statute defines a “social media account” as “a personal account with an electronic medium or service where users may create, share, or view user-generated content, including, without limitation, videos, photographs, blogs, podcasts, messages, emails, or website profiles or locations.”
The statute applies to social media accounts of both current and prospective employees, and prohibits an employer from requiring an employee to: (1) disclose the username and password to the employee's social media account(s); or (2) add a representative of the employer (fellow employee, supervisor, or administrator) to the list of contacts associated with the account.
The statute allows employers to request an employee disclose his or her username and password as part of the employers investigation into allegations of the employee’s violation of federal, state, or local laws or regulations or of the employer's written policies. If the employee consents, the employer may only use the username and password in that limited context.
The statute is clear, however, that an employer may not take action against, or threaten to discharge, discipline, or otherwise penalize a current employee, or refuse to hire a prospective employee, for refusing to supply their username or password.
While it is clear that requiring access to employees’ personal social media accounts is off limits, there are some exceptions. The new statute does not prohibit an employer from viewing information about a current or prospective employee that is publicly available. Employers may thus continue to monitor the public content of their employees’ social media accounts.
The new statute also does not apply to social media accounts: (1) opened by an employee at the request of an employer; (2) provided to an employee by an employer such as the employer’s email account or other software program owned or operated exclusively by an employer; (3) set up by an employee on behalf of an employer; or (4) set up by an employee to impersonate an employer through the use of the employer's name, logos, or trademarks. This language from the new statute provides employers the ability to monitor (and require access to) social media accounts set up and used as part of employment, and to protect itself against employees using its intellectual property without permission.
Prudent employers will review this new statute with their human resources personnel, supervisors, and managers to ensure compliance.