The number of states enacting social media password protection laws has risen once again, as such legislation continues to gain traction across the country. On May 1, 2013, Colorado's General Assembly became the ninth legislature to submit a bill to its governor restricting an employer's ability to access the personal social media accounts of employees and applicants. The other states are Arkansas, California, Illinois, Maryland, Michigan, New Jersey, New Mexico, Utah and Washington. Compared to several of the more recent social media protection laws, such as New Jersey's A.B. 2878, Colorado's bill is relatively weak.
Colorado's bill, H.B. 13-1046, prohibits an employer from engaging in three activities. First, an employer cannot "suggest, request, or require" an employee or applicant to disclose "any user name, password, or other means for accessing the employee's or applicant's personal account or service through the employee's or applicant's personal electronic communications device." Second, H.B. 13-1046 prohibits an employer from compelling an employee or applicant to add anyone, including the employer or its agent, to the employee's or applicant's list of contacts associated with a social media account. Third, under the bill, an employer cannot cause an employee or applicant to change the privacy settings associated with a social networking account. An employer, for example, cannot coerce an applicant into making his Facebook page public, which would allow the employer to see his relationship status or posts.
The Colorado bill contains the same two exceptions as Maryland's User Name and Password Privacy Protection Act, H.B. 13-1046. Specifically, the bill appears to allow an employer to request an employee's log-in information to investigate suspected violations of securities laws or regulations, or suspected misappropriation of trade secrets when the employer suspects the misconduct involves the employee's personal social media account. H.B. 13-1046 does not contain a more generalized exception for an investigation into suspected unlawful conduct or violations of employer policies.
The Colorado bill has one of the weaker remedial schemes as compared to other recent laws. H.B. 13-1046 does not confer a private right of action on applicants or employees to recover unlimited compensatory and consequential damages. Instead, the bill allows an employee or applicant to file a complaint with Colorado's Department of Labor (DOL). The DOL must investigate the complaint, hold a hearing, and issue findings. The DOL may promulgate rules authorizing a fine of up to $1,000 for the first offense and up to $5,000 for each subsequent offense.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.