New York will soon join the majority of states that prohibit employers from requesting or requiring job applicants or employees to provide their personal social media information.  First enacted in Maryland more than a decade ago, these laws grant employees a measure of privacy in their online postings, but only to the extent that posted information is not otherwise publicly accessible.

Protects “Personal” Social Media Accounts

Starting on March 12, 2024, the New York version of this law will restrict access to “personal accounts,” which are broadly defined to include electronic accounts used to create, share and view content.  Electronic accounts of photos, videos, blogs, podcasts and instant messages, as well as internet website profiles or locations are all covered if they are exclusively for personal purposes.

Employers cannot request usernames, passwords, or “other authentication information” to access any of these covered accounts. Employers also cannot ask an employee or applicant to reproduce information contained within their social media account, or to allow the employer to read over the employee’s shoulder after the employee accesses a personal account.

The law further provides that employers cannot fire, discipline or penalize an employee—or threaten to do so—if the employee refuses to disclose their personal social media information. Similarly, an employer cannot reject or refuse to hire an applicant if the applicant refuses to disclose such information.

Exceptions to Allow Access

The law is limited to personal social media accounts; those used for business reasons can still be accessed, provided the employer has given employees prior notice of the employer’s right to access such information.  Employers also can access the content of electronic communications devices paid for by the employer and can restrict employees’ access to certain websites while using the employer’s network or while using a device paid for by the employer, subject to three conditions:

• that the provision or payment for the device was conditioned on the employer’s right of access;
• that the employer provided prior notice of its rights related to access; and
• that the employee explicitly consented to those terms.

Notably, even if the device is employer-provided and all those conditions are met, the employer is still prohibited from accessing any of the employee’s personal accounts on the device.

What Is Not Covered

The law does not affect an employer’s duty to screen employees or applicants before hiring them, or to monitor or retain employee communications established under federal law or the rules of a self-regulatory organization.

Employers also can still view, access or utilize information about an employee or applicant that is in a public profile or in the public domain.  Employers also can review and consider photos, video, messages or other information that an employee voluntarily shares in the context of a report or investigation of misconduct.

Next Steps

Now is the time for employers to review their hiring practices, update relevant employment policies, including those related to monitoring of electronic communications and social media usage, and revise agreements with employees that relate to employer-provided electronic devices to ensure compliance. Employers should also be mindful that reviewing an employee or applicant’s social media information can separately implicate federal, state and local laws against harassment and discrimination.

By Julie Ficks and Tracey I. Levy