Illinois Joins Maryland and Delaware in Banning Requests for Social Media Passwords

As we have previously written, numerous states have proposed legislation intended to prevent employers from demanding access to the social media accounts of employees or job applicants.  Previously only Maryland and Delaware had actually passed such legislation, although as many as fifteen states and the federal government are considering similar legislation.  See Sam Favate “Illinois Becomes Third State to Pass Social Media Privacy Law”, Wall Street Journal Law Blog (Aug. 2, 2012) (available at: http://blogs.wsj.com/law/2012/08/02/illinois-becomes-third-state-to-pass-social-media-privacy-law/?mod=djemlawblog_h).  However, on August 1 Illinois Governor Patrick J. Quinn signed the “Right to Privacy in the Workplace Act” into law, making Illinois the third state to put such legislation on the books.

The Right to Privacy in the Workplace Act provides that:

It shall be unlawful for any employer to request or require any employee or prospective employee to provide any password or other related account information in order to gain access to the employee's or prospective employee's account or profile on a social networking website or to demand access in any manner to an employee's or prospective employee's account or profile on a social networking website.

820 ILCS 55/10(b)(1).  

This prohibition differs somewhat from that found in the Maryland User Name and Password Privacy Protection and Exclusions Act, House Bill 964 (amending Md. Code Ann. Labor & Empl. 3-712), and the Delaware Higher Education Privacy Act, 14 Del. Code 9401 et seq. The Maryland law provides that: “Subject to Paragraph (2) of this subsection, an employer may not request or require that an employee or applicant disclose any user name, password, or other means for accessing a personal account or service through an electronic communications device.”  Among other differences, the Maryland law protects only current employees, while the Illinois law protects both current and prospective employees.  The Delaware law, as its name implies, applies only to “public or nonpublic academic institution[s],” but covers both current students and applicants.  14 Del. Code § 9403(a)-(b).  

Nevertheless, the Illinois law does contain potentially broad carve-outs and omissions.  Of particular note is the fact that the employer is permitted to institute and enforce lawful policies regarding internet use, social networking site use, and electronic mail use.  See 820 ILCS 55/10(b)(1).  More significantly, the Illinois statute provides:

(2) Nothing in this subsection shall limit an employer's right to:

(A) promulgate and maintain lawful workplace policies governing the use of the employer's electronic equipment, including policies regarding Internet use, social networking site use, and electronic mail use; and

(B) monitor usage of the employer's electronic equipment and the employer's electronic mail without requesting or requiring any employee or prospective employee to provide any password or other related account information in order to gain access to the employee's or prospective employee's account or profile on a social networking website.

820 ILCS 55/10(b)(2)(A)-(B).  So, while the employer is prohibited from requiring an employee to provide his or her device, this “exception” appears to make anything the employee does on an employer-provided electronic device or network fair game.    The Maryland law also contains carve-outs regarding employee use of employer devices and the employer’s ability to enforce its policies.  By contrast, the narrower Delaware law provides no such exception.  It contains only a narrow carve-out for investigations of criminal activity or investigations related to an institution’s threat assessment policy.  14 Del. Code § 9405.  

While an individual alleging a violation of the Illinois law may file a complaint with the Illinois Department of Labor which may fine the employer, the Illinois law (like the Maryland and Delaware laws) does not provide for an independent private cause of action in the courts.  Fines under the Illinois law range between $200 and $500 per affected employee, plus costs and reasonable attorneys’ fees.  820 ILCS 55/15(d)(1)-(3).  Although the Delaware law specifically details the actions which public and nonpublic academic institutions might take, it also fails to spell out an explicit penalty for violation of this mandate:

“No public or nonpublic academic institution may discipline, dismiss or otherwise penalize or threaten to  discipline, dismiss or otherwise penalize a student for refusing to disclose any information specified in subsection (a) or (b) of § 9403.  It shall also be unlawful for a public or nonpublic academic institution to fail or refuse to admit any applicant as a result of the applicant’s refusal to disclose any information specified in subsection (a) or (b) of § 9403.” 

14 Del. Code § 9404.  Apart from the fines provided for by the Illinois law, the primary method of enforcement for these laws appears to be a tort action for wrongful termination in violation of public policy.  It remains to be seen whether such an enforcement mechanism is adequate.

These laws often fail to expressly address the much larger issue of employer monitoring of employee behavior on work related electronic devices – an issue of growing consequence in a world where increasing numbers of individuals use one device for both work and personal purposes.  In fact, both the Maryland and Illinois laws contain broad carve-outs for this sort of behavior.  See 820 ILCS 55/10(b)(2)(B); Md. Code Ann. Labor & Empl. 3-712(b)(2), (e).   It remains to be seen whether, and how, this issue will be addressed.  For further information See Martha Neil, Ill. Gov. Signs ‘Facebook Bill’, ABA Journal (Aug. 1. 2012) (available at: http://www.abajournal.com/mobile/article/ill._gov_signs_facebook_bill_as_of_jan._1_employers_who_ask_for_passwords/?utm_source=maestro&utm_medium=email&utm_campaign=daily_email); Eric B. Meyer, Snoop Dog Becomes Snoop Lion! And News of a New Employee Facebook Law, The Employer Handbook (Aug. 2, 2012) (available at: http://www.theemployerhandbook.com/2012/08/illinois-becomes-the-2nd-state.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+employmentlaw-blog%2FimGSCom+%28Employment+Law+Blog%29).