Recently, Governor Walker signed into law a statute that limits employers’ ability to require applicants and employees to divulge the user names, passwords, and other “security information” that protect their internet accounts (including social media sites). The law similarly prohibits educational institutions and landlords from requiring the same of their prospective students, current students, and tenants, respectively. With this law, Wisconsin joins several other states that have passed legislation aimed at limiting employers’ ability to access employees’ social media accounts as a condition of employment.

The law limits employers’ ability to request “access information” for applicants and employees’ “personal internet account[s].” “Access information” includes user names, passwords, and “any other security information that protects access to a personal internet account.” “Personal internet accounts” are accounts “created and used by an individual exclusively for purposes of personal communications.”

The new law contains several restrictions relating to employers’ access to applicants and employees’ personal internet accounts. Employers may not condition employment on an applicant or employee disclosing access information or on an applicant or employee allowing the employer to observe what is on a personal internet account. Additionally, employers may not discharge or refuse to hire employees or applicants for failing to divulge access information. Finally, employers may not retaliate against employees who file complaints under the new law.

But the law provides several helpful exceptions for employers, including the following:

• Employers may obtain access information to electronic communication devices for which they have paid. Similarly, an employer may access an account or service provided by the employer or used for the employer’s business purposes.

• Employers may discipline or terminate employees who transfer confidential or proprietary information to their personal internet accounts without authorization.

• Employers may require an employee to cooperate in an investigation of employment-related misconduct, violations of law, or violation of employee handbook rules if the employer has “reasonable cause” to believe that the personal internet account contains information related to the violation or misconduct. This exception allows the employer to view the employee’s personal internet account; it does not allow the employer to obtain access information.

• Employers may view, access, and use information that can be obtained without access information or that is available in the public domain.

Violations of the law can be costly. The statute allows for a forfeiture of up to $1,000 for a violation. But the statute also provides that violations can be investigated by the Equal Rights Division (ERD) just as an employment discrimination claim would. If the ERD finds a violation, it can award remedies available in other ERD cases, such as back pay and attorneys’ fees. Furthermore, this law specifically makes front pay available as well.

Several questions remain regarding the new law. Because employees often use e-mail accounts for work and personal purposes, what qualifies as a personal internet account (accounts used “exclusively” for personal communication) may be narrower than expected. Additionally, what constitutes “reasonable cause” for an employer to require an employee to allow the employer to observe a personal internet account remains to be seen.

With the passage of this law, employers should review their hiring policies and practices. Federal agencies, such as the Equal Employment Opportunity Commission and the Federal Trade Commission, already scrutinize employers’ hiring practices, particularly regarding their use of social media in hiring decisions. The new Wisconsin law only adds to the ways that employers can potentially end up in litigation over a refusal to hire. Accordingly, employers should review whether their hiring policies and practices are compliant with both state and federal law.