Add Oklahoma to the list of states prohibiting employers from requesting or demanding access to the personal social media accounts of employees or applicants. Signed into law by Gov. Mary Fallin, H.B. 2372 becomes effective November 1, 2014.

In addition to being prohibited from requesting or demanding usernames or passwords from employees or applicants to their personal social media accounts, the new law makes clear that Oklahoma employers cannot demand that employees or applicants access those accounts in the presence of the employer, allowing the employer to see the contents of those accounts. As in other states with similar laws, employees and applicants that refuse to provide access to their personal social media accounts generally cannot be fired, disciplined, denied employment, or otherwise penalized.

Employers may, however, request or demand access information to information systems or electronic communications devices owned or subsidized by the employer, as well as any accounts or services provided by the employer “or that the employee uses for business purposes.” It will be interesting to see whether this language will be interpreted to apply to accounts such as LinkedIn, which employees might use for business purposes – e.g., connecting with customers or clients of the employer. The Act also does not prohibit employers from engaging in certain investigations, such as where the employer has specific information about activity on the employee’s personal social media account and the investigation is for the purpose of ensuring compliance with applicable laws regulatory requirements, or prohibitions against work-related employee misconduct.

The law protects Oklahoma employers from inadvertently acquiring the access information for employee personal social media accounts, so long as the employer does not use that information to access the accounts. However, the law states:

Neither this section nor any other Oklahoma law shall prohibit an employer from reviewing or accessing personal online social media accounts that an employee may choose to use while utilizing an employer’s computer system, information technology network or an employer’s electronic communication device.

So, while employers cannot ask employees for their usernames or passwords to personal social media accounts, it appears employers can monitor the activities and communications of employees made in their personal social media accounts when the employees access their accounts through employer-provided information systems, networks or devices. Employer should exercise caution here as federal law and laws in other states may be triggered, such as the Stored Communications Act.

Employers may have legitimate needs to access employee or applicant personal social media or other online accounts – such as in cases involving theft of trade secrets, disclosures of confidential information and other reasons. However, as these state laws develop, employers will need to be careful in determining which law applies and what the applicable law permits them to do, particularly for larger multi-state employers.