Recently, Montana became the 20^th state to enact legislation restricting an employer’s access to employees’ and job applicants’ personal social media accounts. The new statute prohibits an employer from requiring or requesting an employee or applicant:

• to disclose to the employer user names and passwords for their personal social media accounts for the purpose of permitting the employer to access those accounts;

• to provide access to personal social media in the presence of the employer; and

• to disclose to the employer any personal social media or information contained in their personal social media accounts.

Employers also are prohibited from disciplining or threatening to discipline an employee in retaliation for the employee’s refusal to comply with a request that violates the new law.

In the context of the employment relationship, the statute does provide some key exceptions, however. For example, the new statute requires an employee, if requested by the employer, to provide their user name or password to access personal social media accounts when:

• the employer has specific information about:

  • an activity by the employee that indicates work-related employee misconduct or criminal defamation;

  • an employee’s unauthorized transfer of the employer’s proprietary or confidential information, trade secrets or financial data to a personal online account or service;

• necessary to comply with federal laws, federal regulations or the rules of a self-regulatory organization; and

• the requested information is necessary to make a factual determination in a pending investigation the employer has undertaken.

Under the new law, employees or job applicants can bring an action in small claims court within one year of an alleged violation to seek statutory damages of $500 or any actual damages up to $7,000.

While Montana’s statute mirrors aspects of similar statutes enacted in other states, there also are important differences, such as the circumstances under which an employer may require an employee to provide access to personal social media accounts. Employers that have employees in multiple states would be wise to take this into account when considering whether a one-size-fits-all social media policy is appropriate for them.