Over the past few years, states around the country have enacted laws limiting an employer’s ability to access the personal social media accounts of applicants and employees. Earlier this year, Montana’s Governor Steve Bullock signed HB 343 into law. Before that, Virginia enacted a similar measure. On May 19, Connecticut’s Governor added the Nutmeg state to the list, signing S.B. 426 into law, becoming effective October 1, 2015. Taking the protection of employee social media accounts a step further, a measure in Oregon, S.B. 185 A, would amend its existing law to prohibit employers from requiring employees or applicants (i) to establish or maintain personal social media accounts or (ii) to authorize the employer to advertise on their personal social media accounts. That bill, unanimously passed by the State’s legislature, awaits consideration by the Governor.

Similar to the social media privacy laws passed in other states, Connecticut’s law prohibits employers from requesting or requiring an employee or applicant to provide a user name and password, password or any other authentication means for accessing a personal online account. Under the law, employers also cannot require employees or applicants to authenticate or access a personal online account in front of the employer, nor can employers require employees or applicants to invite the employer or accept an invitation from the employer to join a group affiliated with the employee’s or applicant’s account. Like some of the laws in other states, a personal online account is one that is used by the employee or applicant “exclusively for personal purposes and unrelated to any business purpose of such employee’s or applicant’s employer or prospective employer, including, but not limited to, electronic mail, social media and retail-based Internet web sites.”

However, the Connecticut law does not prohibit employers from conducting certain investigations, such as to ensure compliance with state or federal laws, regulatory requirements or prohibitions against work-related employee misconduct based on the receipt of specific information about activity on an employee or applicant’s personal online account. Employers also may monitor, review, access or block electronic data stored on an electronic communications device paid for, in whole or in part, by the employer, or traveling through or stored on the employer’s network. The law also does not “prevent an employer from complying with the requirements of state or federal statutes, rules or regulations, case law or rules of self-regulatory organizations.”

This last point may be helpful for those employers that may have a duty to monitor certain employee communications. For example, in expressing concerns over the effects of these state laws, the Financial Industry Regulatory Authority (FINRA) noted that its Regulatory Notices 10-06 and 11-39 provide that securities firms must establish procedures to review registered representatives’ written and electronic business correspondence, including interactive electronic communications that the firm or its personnel send through social media sites. In addition, firms must adopt policies and procedures reasonably designed to ensure that their associated persons who participate in social media sites for business purposes are reasonably supervised to ensure that their communications are fair and balanced. Of course, employers in these regulated businesses and generally will have to carefully review what is prohibited under these state laws, but also the exceptions, in order to shape a strategy for compliance.

As a way of enhancing their exposure and reach in social media, some employers are looking to leverage their employees’ social media presence to more broadly promote the companies’ products and services. Putting aside potential labor, wage and hour, and other employment issues, the bill in Oregon would address potential privacy issues resulting from the practice of compelling employees to allow employers to use employees’ personal social media accounts to advertise. One effect of the law may be that employees will not allow their personal accounts to be used for business purposes. That may address some of the concerns FINRA and others raise about monitoring business communications by employees in their personal social medical accounts. Another effect of the law may be the difficulty created in determining whether the employer required, or the employee permitted, the personal online account to be used for advertising the company’s products or services. For certain categories of employment, increased exposure and sales of the company’s products and services result in direct benefits to the employee, as well as the employer.

If passed, employers subject to the Oregon law will have to exercise caution in their approach to employees about using their personal accounts for business purposes. Also, like the popularity of the social media account protection laws themselves (21 states have now enacted these in one form or another), this twist in Oregon may be followed elsewhere.