New York employers should take note of a new law that recently took effect that impacts their ability to access applicant and employee social media accounts. The law applies to all employers covered by the New York Labor Law (with the exception of law enforcement agencies, fire departments, and departments of corrections and community supervision) and took effect on March 12, 2024.

A836/S2518A amends the NY Labor Law to add a new Section 201-I addressing employer access to employees’ and applicants’ “personal accounts,” defined as “an account or profile on an electronic medium where users may create, share, and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or internet website profiles or locations that is used by an employee or an applicant exclusively for personal purposes.” Specifically, the law makes it unlawful for any employer to “request, require or coerce” any employee or applicant to:

• disclose any user name and password, password, or other authentication information for accessing a personal account through an electronic communications device (defined as “any device that uses electronic signals to create, transmit, and receive information, including, but not limited to computers, telephones, personal digital assistants and other similar devices”);
• access the employee’s or applicant’s personal account in the presence of the employer; or
• reproduce in any manner photographs, video, or other information contained within a personal account obtained by the means prohibited under the law.

Employers also may not discharge, discipline or otherwise penalize an employee (or threaten to do so) for an employee’s refusal to disclose any information covered above, nor can they fail or refuse to hire any applicant for such a refusal.

However, the law also contains numerous carveouts and exceptions for employers. Importantly, an employer may still view, access, or utilize information about an employee or applicant: (i) that can be obtained without any required access information; (ii) that is available in the public domain; or (iii) for the purposes of obtaining reports of misconduct or investigating misconduct, photographs, video, messages, or other information that is voluntarily shared by an employee, client, or other third party that the employee subject to such report or investigation has voluntarily given access to contained within such employee’s personal account.

An employer also may still:

• require an employee to disclose any user name, password or other means for accessing non-personal accounts that provide access to the employer’s internal computer or information systems;
• request or require an employee to disclose access information to an account provided by the employer where such account is used for business purposes and the employee was provided prior notice of the employer’s right to request or require such access information;
• request or require an employee to disclose access information to an account known to an employer to be used for business purposes;
• access an electronic communications device paid for in whole or in part by the employer where the provision of or payment for such electronic communications device was conditioned on the employer’s right to access such device and the employee was provided prior notice of and explicitly agreed to such conditions (though an employer may not access any personal accounts on such device);
• restrict or prohibit an employee’s access to certain websites while using an employer’s network or while using an electronic communications device paid for in whole or part by the employer, where the provision of or payment for such electronic communications device was conditioned on the employer’s right to restrict such access and the employee was provided prior notice of and explicitly agreed to such conditions; and
• comply with a court order in obtaining or providing information from, or access to, an employee’s accounts as such court order may require.

Further, an employer acting to comply with the requirements of a federal, state or local law shall have an affirmative defense under the law. The law also does not prohibit or restrict an employer from complying with a duty to screen employees or applicants prior to hiring, or to monitor or retain employee communications, under federal law or by a self-regulatory organization, as defined in section 3(a)(26) of the Securities and Exchange act of 1934.

Additionally, for purposes of the law, the term “access” does not include an employee or applicant voluntarily adding an employer, agent of the employer, or employment agency to their list of contacts associated with a personal internet account.

* * *

New York employers should review their policies and practices related to social media account access to ensure that they are in compliance with this new law.