I have previously posted about the intersection of social media and the workplace. Prior posts are here and here. Recently, however, there has been a lot of buzz around how employers are attempting to obtain from employees or prospective employees the username and password (“login”) information relating to their social media accounts so they can snoop around and see what they are doing in their spare time. Employers are then purportedly using this information when making hiring and other employment decisions. Here is a good interview of a law professor that discusses many of these issues.
Whether employers can request this information and access your private accounts is unclear. The determination of where an employer’s right to gain knowledge about its employees invades an employee’s right to privacy in the world of social media requires the application of existing law in a manner that was never contemplated when the law was originally passed. This often proves very challenging for courts and lawyers.
I have a visceral reaction to the idea of providing login information to an employer. But why is that? And if asked, are you required to provide your employer access to your social medial profiles? What are the consequences if you refuse the request?
The reason providing access to your private social media is so personally offensive to us is because we come to this issue with real-life experience that informs our understanding of the employment relationship. While it is rarely discussed or defined, there is clearly a line between the information we typically are required to disclose to our employers and the information we choose to keep private. We generally understand that we need to provide some personal information such as our address, social security number, work history, educational background and the like in order to apply for and be considered for employment. Past that point (let’s refer to it as the “disclosure line”), the employee has generally controlled the amount and nature of personal information that is provides to the employer and coworkers.
When posting to Facebook, we often don’t think about that disclosure line. We may post unflattering pictures or information about ourselves that we intend to only be shared with our “friends,” not our employer. So those unflattering pictures, personal posts and rants about a jerk supervisor are clearly things we would typically choose to keep private from our employer. The thought of sharing this information with our employer feels like a massive breach of the disclosure line and explains why requests from employers for our account information seems so offensive.
Do you have to provide the information requested? There are arguments that existing law may prohibit an employer from accessing your private social media accounts. The stored Communications Act (SCA) and Computer Fraud and Abuse Act (CFAA) both arguably prohibit “unauthorized” access to electronic data. The question then becomes, if your employer asks for your username and password and you give it to them, is their access unauthorized? One courthas held that where the employee provided the information because they feared they would suffer some type of adverse job consequence if they refused, the employer’s access was unauthorized and violated the SCA. Interestingly, the jury in that same case held that the employer DID NOT violate the employee’s common law right to privacy by accessing the social media site.
Adding to the confusion, however, is the question of whose authorization is needed to “authorize” access? Facebook has a policy prohibiting anyone other than the account owner from logging on to any particular account. So if you authorize your employer to access your account but Facebook has not, is the access authorized or not? This issue is unresolved.
And if you refuse your employer’s request for login information because you have a good faith belief that your employer’s accessing your Facebook page is illegal (say, for example, a violation of the SCA), and the employer takes some adverse employment action because of your refusal, you may have a claim under Minnesota’s whistleblower statute. The whistleblower statute prohibits an employer from retaliating against an employee who refuses to follow an order that the employee believes (in good faith) violates any law, rule or regulation.
And what if you are an applicant for employment who is asked to provide your login information? We oftentimes put information on our social media pages that may disclose our birthdays, ethnicity, national origin, disabilities, sexual orientation, marital status, veteran status, etc. Typically, employers are prohibited by the Minnesota Human Rights Act and other federal anti-discrimination laws from inquiring into these areas during the hiring process because employers may not consider these factors in making the hiring decision. But by asking for your login information, are they in essence asking for this information and violating the law? This is unresolved as well. Some in congress are taking action to investigate this practice and put a stop to it.
There are also situations where coworkers may use social media to harass another coworker based on their sex, race or other prohibited reason. If the employer has a credible report that social media accounts have been used to discriminate or harass in the workplace, should the employer be allowed to request access to social media sites in those situations? Again, this issue is unresolved.
Then, of course, the employer needs to ask itself whether it is really worth all the hassle to ask for social media access in the first place? One law firm that represents employers believes the possible legal complications in requesting social media login information far outweighs any benefit the employer may receive from obtaining access to this information. I tend to agree.
But what should you do today if your employer asks for this information? First, ask your employer why it needs the information. There may be a less intrusive way to get the employer what they want.
Second, ask what will happen if you choose not to provide the login information. Will you be fired? Is there some other negative consequence that will occur?
Third, ask if you can consult with an attorney before making a decision. If your employer won’t let you talk to a lawyer and want an answer immediately, you need to exercise your best judgment in determining how to proceed. If you decide to provide the information to the employer, I would be sure to communicate to them (in writing where possible) that you feel compelled to provide the information for fear of losing your job or suffering some other negative consequence. You may also want to consider telling them that you believe what they are doing may violate the law.
All of these decisions have consequences that cannot be predicted. The best course of action is to try talk to a lawyer and evaluate the situation against what is in your personal best interest.