coworker shared the information with their employer, the access gained by the
employer fell under the “authorized access” exception to the ACA.
137
Employers who gain unauthorized access to employee accounts and use that
access to discipline or terminate employees risk civil liability under the SCA.
138
Even in cases where employer obtains material through authorized access to those
accounts, employers must be careful not to “unnecessarily infringe on employees’
Section 7 rights under the National Labor Relations Act to gripe about terms and
conditions of employment”.
139 However, Section 7 does not protect employees
whose posts negatively affect a company’s image as long as the employer lawfully
obtained access to the posts.
140 As applied to blogging, several cases have ruled that
an employer who gains unauthorized access to an employee’s password-protected
blog—and punishes or fires the employee for content appearing on that blog—may
violate the SCA and, if found to be liable, could be required to pay damages to the
aggrieved employee.
141
Another key issue with respect to the privacy of employee social media accounts
is whether employers may compel employees or prospective employees to disclose
their passwords to permit the employer to monitor those accounts. Since 2012,
25 states have enacted legislation that prevents employers from forcing employees
to disclose their passwords.
142 Sixteen states have passed legislation that bars
educational institutions from requiring students to reveal their passwords.
143 One
state, Wisconsin, bars landlords from requiring tenants to share their passwords.
144
2.6 Other Protections for Employees’ Personal Data
Conveyed or Stored Electronically
In addition to the SCA’s protection against the unauthorized access of employee
social media posts, a number of federal statutes require that employers protect a
variety of different types of data. These include the obligation to protect medical
records under HIPPA, as well as the diverse requirements under the Family and
Medical Leave Act (FMLA), the Genetic Information Nondiscrimination Act
137 Id., citing 18 U.S.C. § 2701(c)(2).
138 Crane (2012), pp. 639 and 642 citing Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d
965, 991 (C.D. Cal. 2010).
139 Grosdidier (2013).
140 29 U.S.C. §§ 157.
141 Grosdidier (2013).
142 “State Social Media Privacy Laws”, National Conference of State Legislatures, 5 May 2017.
Available online at: http://www.ncsl.org/research/telecommunications-and-information-technol
ogy/state-laws-prohibiting-access-to-social-media-usernames-and-passwords.aspx.
143 Id.
144 Wis. Stat. § 995.55(4).
Data Protection in the United States: U.S. National Report
427
employer fell under the “authorized access” exception to the ACA.
137
Employers who gain unauthorized access to employee accounts and use that
access to discipline or terminate employees risk civil liability under the SCA.
138
Even in cases where employer obtains material through authorized access to those
accounts, employers must be careful not to “unnecessarily infringe on employees’
Section 7 rights under the National Labor Relations Act to gripe about terms and
conditions of employment”.
139 However, Section 7 does not protect employees
whose posts negatively affect a company’s image as long as the employer lawfully
obtained access to the posts.
140 As applied to blogging, several cases have ruled that
an employer who gains unauthorized access to an employee’s password-protected
blog—and punishes or fires the employee for content appearing on that blog—may
violate the SCA and, if found to be liable, could be required to pay damages to the
aggrieved employee.
141
Another key issue with respect to the privacy of employee social media accounts
is whether employers may compel employees or prospective employees to disclose
their passwords to permit the employer to monitor those accounts. Since 2012,
25 states have enacted legislation that prevents employers from forcing employees
to disclose their passwords.
142 Sixteen states have passed legislation that bars
educational institutions from requiring students to reveal their passwords.
143 One
state, Wisconsin, bars landlords from requiring tenants to share their passwords.
144
2.6 Other Protections for Employees’ Personal Data
Conveyed or Stored Electronically
In addition to the SCA’s protection against the unauthorized access of employee
social media posts, a number of federal statutes require that employers protect a
variety of different types of data. These include the obligation to protect medical
records under HIPPA, as well as the diverse requirements under the Family and
Medical Leave Act (FMLA), the Genetic Information Nondiscrimination Act
137 Id., citing 18 U.S.C. § 2701(c)(2).
138 Crane (2012), pp. 639 and 642 citing Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d
965, 991 (C.D. Cal. 2010).
139 Grosdidier (2013).
140 29 U.S.C. §§ 157.
141 Grosdidier (2013).
142 “State Social Media Privacy Laws”, National Conference of State Legislatures, 5 May 2017.
Available online at: http://www.ncsl.org/research/telecommunications-and-information-technol
ogy/state-laws-prohibiting-access-to-social-media-usernames-and-passwords.aspx.
143 Id.
144 Wis. Stat. § 995.55(4).
Data Protection in the United States: U.S. National Report
427