Louisiana Governor Bobby Jindal has signed into law the Personal Online Account Privacy Protection Act. The Act prohibits employers and schools in Louisiana from requesting or requiring access to the personal e-mail, social media and other types of online accounts of employees and job applicants. It also prohibits schools from demanding access to the personal e-mail, social media and other types of online accounts of students and prospective students. 

The new law, signed on May 22, 2014, goes into effect immediately. Tennessee and Wisconsin are two other states that have enacted similar laws this year. 

Following is a brief summary of the new law.

The Act applies to any employer doing business in the state and any educational institution, from nursery schools to universities and business schools. It protects personal online accounts that are unrelated to any business purpose of the employer or educational institution. 

In general, employees and applicants who refuse to provide access to their personal online accounts are protected from being fired, disciplined, denied employment, or otherwise penalized or threatened. In an educational setting, students and prospective students are protected from being expelled, disciplined, denied admission, or otherwise penalized or threatened.

The Act does not protect the individual’s personal activities on devices owned or services provided by the employer or educational institution, except where an educational institution intended to permanently transfer ownership of the device to the student or prospective student. 

It also permits employers to discipline or fire an employee who transfers the employer’s proprietary or confidential information or financial data to the employee’s personal online account without authorization. Employers also may engage in certain investigations, such as one based on specific information about activity on the employee’s personal online account and the investigation is to ensure compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct.

Employers are not prohibited from viewing, accessing, or utilizing information about an employee or applicant that is in the public domain and can be obtained without the employee’s or applicant’s username, password or other authentication information. A similar rule applies for educational institutions. 

The Act recognizes that through permissible monitoring of its information systems, networks, or employer-provided devices, employers may inadvertently receive an employee’s or applicant’s username, password, or other authentication information pertaining to the employee’s or applicant’s personal online account. In those cases, the employer will not be liable for having the information, but it may not use the information to access the employee’s or applicant’s personal online account. Whether use of keylogging or spyware technologies will constitute inadvertent acquisition of an employee’s username or password to a personal online account remains to be seen. However, if there is a reasonable likelihood that such information would be captured by these applications, it may diminish an employer’s ability to argue inadvertence.

Employers and schools will need to be more careful when trying to manage certain online activities in the workplace and in academia. This includes ensuring managers, supervisors, professors and principals understand the legal limitations.