Beginning on March 12, 2024, a new social media privacy law for employees and job applicants goes into effect in New York. The new law will amend the New York Labor Law (the “NYLL”) to restrict most employers from accessing the personal social media accounts of employees and job applicants. The new restrictions were approved when Governor Kathy Hochul signed into law two bills, Assembly Bill 836 (A836) and Senate Bill 2518A (S2518A), on September 14, 2023.
The New Rules for Employers
A836/S2518A amends the NYLL in several ways. First, the new law prohibits employers from requesting or requiring that employees or job applicants disclose their user name, password, or other access information for their personal social media account. Second, employees and applicants cannot be asked or required to access their personal social media account in the presence of the employer. Third, the law prohibits employers from requiring or requesting employees or applicants to reproduce photographs, video, or other information from a personal social media account. As written, A836/S2518A applies to all employers covered by the NYLL, with the exception of law enforcement agencies, fire departments, and departments of corrections and community supervision.
A836/S2518A also prohibits employers from retaliating against employees who exercise their rights under the new law. Under A836/S2518A, employers may not penalize or threaten to penalize an employee for his or her refusal to disclose any of the information specified above. And employers cannot fail or refuse to hire any job applicant as a result of the applicant’s refusal to disclose such information.
While employees and applicants appear to have a private right of action under A836/S2518A, it is important to note that an employer’s efforts to comply with applicable law or the requirements of a self-regulatory organization (such as the Financial Industry Regulatory Authority) will provide an affirmative defense to any claim. For instance, A836/S2518A does not prohibit employers from complying with a legally-mandated duty to screen employees or applicants. Likewise, A836/S2518A does not restrict employers from monitoring or retaining employee communications where they have a legal obligation to do so.
Exceptions and Exclusions
A836/S2518A includes several exceptions and exclusions that employers should be aware of. Importantly, the new law does not restrict employer access to nonpersonal accounts that provide access to the employer’s internal computer or information systems. Nor does it prevent employees from voluntarily adding an employer or an agent of the employer as a social media connection.
The new law also does not prohibit employers from requesting or requiring an employee to disclose access information to a business account provided by the employer when the employee had prior notice of the employer’s right to request or require this information. Employers are also not prohibited from accessing an account to comply with a court order.
A836/S2518A also does not prevent employers from viewing, accessing, and using information about an employee or applicant that is available in the public domain or that can be accessed without any required access information. And the law contains an exception that allows employers to view photographs, videos, messages, and other information for the purposes of investigating misconduct if the employee in question voluntarily gives the employer access to such information.
Finally, A836/S2518A ensures that employers may continue to exercise broad access rights over their equipment and networks. For instance, A836/S2518A explicitly permits employers to access electronic communication devices paid for in whole or in part by the employer, provided that payment for the device was conditioned on the employer’s access rights and the employer does not access personal accounts on the device. Likewise, employers may continue to restrict employee access to certain websites (such as social media websites) while using the employer’s network or an electronic communication device provided by the employer.
As A836/S2518A comes into effect, employers should ensure that their hiring and personnel practices comply with the new restrictions imposed by the law. Employers are also advised to review their written policies and handbooks to determine if any changes are needed to ensure compliance with the new law. Employers should consult with their legal counsel to ensure that their policies and practices satisfy the requirements of A836/S2518A.