New York Governor Kathy Hochul recently signed legislation into law that will bar employers from accessing the personal social media accounts of employees and prospective employees.

Quick Hits

• New York governor signs legislation into law to restrict employers from requesting or gaining accessing to employees’ and applicants’ personal social media accounts.
• The new law will not prohibit employers from requiring employees to provide login information to company accounts used for business purposes.
• The law is set to go into effect in March 2024.

On September 14, 2023, Governor Hochul signed Assembly Bill (A) 00836 and Senate Bill (S) 02518A, which will restrict employers’ access to employee and applicant personal social media accounts.

Specifically, A00836/S02518A will prohibit employers from requesting or requiring employees or job applicants to: (1) disclose their user names, passwords, or login information to social media or other personal electronic communication accounts; (2) access their personal accounts in the presence of the employer; or (3) reproduce any posts, including photographs, videos, or other information, from personal accounts.

Under the law, employers will be prohibited from discharging, disciplining, or otherwise penalizing an employee or applicant, or threatening to do so, because of the employee’s or applicant’s refusal to disclose such protected information.

Covered Accounts and Access

“Personal account[s]” covered by A00836/S02518A is broadly defined as accounts or profiles “on an electronic medium” through which “users may create, share, and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or internet website profiles or locations” that are used by employees or applicants “exclusively for personal purposes.”

However, the law will not apply to user names and passwords to “nonpersonal accounts” that provide access to employers’ “internal computer or information systems.” Further, the law does not stop employees from “voluntarily adding” an employer or the employer’s agent as a social media connection.

Exemptions

At the same time, the law contains several carveouts that will permit employers to access social media accounts under certain circumstances. Specifically, employers will not be prohibited from:

• requesting or requiring employees to disclose access information to an account provided by the employer where the account is used for business purposes and prior notice was given to the employee of “the employer’s right to request or require such access information”;
• requesting or requiring employees “to disclose access information to an account known to an employer to be used for business purposes”;
• accessing electronic communications devices “paid for in whole or in part by the employer” where the payment for such devices “was conditioned on the employer’s right to access,” the employee had prior notice, and “explicitly agreed to such conditions,” although employers would not be allowed to access any personal accounts on such a device;
• accessing an account to comply with a court order; and
• restricting access to certain websites while using an employer’s network or while using a device paid for by the employer.

The law will not prevent employers from viewing or accessing information about an employee or job applicant that is publicly available without login information. Employers will be permitted to view social media posts, including photographs, videos, or messages, that an employee, client, or third party voluntarily shares with an employer for purposes of reporting misconduct.

Next Steps

A00836/S02518A is set to take effect on March 12, 2024. Employers may want to review their employment policies and hiring practices in light of the new law’s restrictions. Employers may also want to consider revising their employee social media policies in accordance with the law’s restrictions on accessing personal accounts and to ensure proper notice is provided to employees about accessing “nonpersonal” or company accounts and company-paid-for devices.