Starting March 12, New York employers are prohibited from asking or requiring employees or job applicants to disclose usernames and login information to personal social media accounts.

The new law brings New York in line with California, Colorado, Illinois, New Jersey, and several other states that have legislated to protect employees’ and job applicants’ social media privacy. It applies to employers operating in the state of New York.

The protections are part of a bill that was signed into law by New York Governor Kathy Hochul in September.

The prohibitions

Starting March 12, employers in New York are prohibited from requesting or requiring employees or job applicants to:

• disclose their usernames (sometimes called “handles”), passwords, or login information related to a personal social media account;
• access their personal social media accounts in the presence of the employer/prospective employer; or
• reproduce personal social media account posts, such as photos, videos, or communications.

The law defines “personal account” broadly to include “an account or profile on an electronic medium where users may create, share, and view user-generated content” that “is used by an employee or an applicant exclusively for personal purposes”.

Employers may not retaliate against employees by firing, disciplining, or otherwise penalizing employees for refusing to disclose their personal social media account information or accessing their accounts in front of their employer. And employers cannot refuse to hire job applicants who refuse to disclose this information.

Exceptions

As you would suspect, there are a number of exceptions to this prohibition, and employers will still be permitted to:

• screen job applicants using information from publicly available social media accounts found without asking applicants to disclose their usernames;
• access electronic devices it provides to an employee, as long as the employer provides prior notice of this access right, and the employee agrees to such conditions. Employers may not access an employee’s personal social media account on any employer-provided electronic device, however;
• restrict employees’ access to certain websites while using the employer’s network or an employer-provided electronic device;
• require employees to disclose login information for the employer’s business social media accounts and its internal IT systems;
• accept voluntary friend or other contact requests from employees and job applicants;
• comply with court orders to obtain or provide information from or access to an employee’s personal social media accounts.

Publicly available information and information that is voluntarily disclosed by an employee or job applicant is considered “fair game” under the law.

That means, for example, that if a job applicant voluntarily discloses their Instagram account username within their CV – a common practice for applicants in certain industries, especially creative ones – an employer may view publicly available information associated with the username.

Compliance considerations

Despite these carveouts, employers should keep in mind other laws that could limit their exercise, such as an employer’s effort to stymie protected unionization activity (or other concerted activity) conducted online.

New York employers should review their employee policies and job application materials to ensure compliance with the new rule and train relevant personnel – such as Human Resources and all hiring managers more generally – on the rule. While you’re at it, remind those conducting internal investigations of misconduct on it as well.

Remind everyone of the different expectations of privacy you have in posting to or managing a corporate social media account versus posting to and managing one’s own.

Given the attention on claims made over social media, use of finfluencers, the monitoring and archiving of off-channel communication apps, and these state-based rules on employee social media information, employers should consider whether their electronic communications device and social media policies as a whole need to be updated.