The Spotlight is On Practice of Employers Requesting Access to the Social Media Accounts of Employees and Job Applicants

As we discussed earlier this week, both houses of the Maryland General Assembly have passed legislation that would prohibit employers in Maryland from asking current employees and job applicants for their usernames and passwords to social media sites, for example, Facebook and Twitter.  The legislation passed unanimously in the Maryland Senate and by a substantial margin in the House, and has now been sent to the Governor for his signature.  If the Governor should sign, the legislation will be the first of its kind in the country. 

The Maryland legislation was birthed as a result of a controversy that ensued between the Maryland Department of Public Safety and Correctional Services and the ACLU of Maryland when, back in 2010, the Department required job applicants to submit usernames and password information related to their social media sites, purportedly to check for gang affiliations.  The Department suspended and then dropped the requirement after protests by the ACLU.  In this correspondence, the ACLU asserted that the Department’s conduct violated the Stored Communications Act, 18 U.S.C. § 2701-11 and its Maryland analog, Md. Courts & Jud. Proc. Art., § 10-4A-01, et seq.  The ACLU also noted that the Department’s conduct may give rise to violations of the common law tort of invasion of privacy and arguably chilled the First Amendment rights of employees.  The ACLU argued that “there can be little question but that forced ‘authorization,’ such as that demanded of [the applicant], is not proper authorization under the SCA, given the disparate bargaining power of the employer and employee or applicant.”  In the wake of the ACLU’s allegations, some commentators, such as Orin Kerr of the George Washington University School of Law, have likened surrendering social media passwords to handing over the keys to one’s home. 

While the Maryland legislation attempts to resolve these concerns, as passed it does not explicitly provide for a private cause of action, complaint procedures, or criminal sanctions.  This appears to relegate enforcement of the Maryland legislation to the realm of tort suits for wrongful termination in violation of public policy under Adler v. Am. Standard Corp., 291 Md. 31 (1981) and its progeny.  Similar legislation has been introduced  in Illinois, Michigan, Minnesota, Massachusetts, and California.  More information on the Michigan bill is available in a recent blog post by Jason Shinn of the Michigan Employment Law Advisor. John Holmquist of the Michigan Employment Law Connection, Emil Protalinski of ZD Net, and Mitchell H. Rubinstein of the Adjunct Law Prof Blog recently published blogs about a Michigan teacher’s aide was fired for refusing to hand over his Facebook. New Jersey Assemblyman John Burzichelli has announced that he will introduce a bill on the subject.

Two United States Senators have requested that the Department of Justice and EEOC review the matter, citing an uptick in requests by employers for job applicants’ username and password for social media sites.  The letter to DOJ notes that this practice appears to violate Facebook’s terms of service and cites cases which, according to the authors, may subject employers who request usernames and passwords from applicants to liability.  See Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002); Pietrylo v. Hillstone Rest. Group, Civ. No. 06-5754, 2009 U.S. Dist. LEXIS 88702 (D.N.J. Sept. 25, 2009).  The letter follows with a request that the DOJ issue a legal opinion regarding whether requesting and using job applicants’ social media passwords violates current federal law, including the Stored Communications Act and the Computer Fraud and Abuse Act.

The letter to EEOC asks it to investigate whether such requests violate the anti-discrimination laws, expressing a concern that access to such sites would give employers access to personal information about the job applicants’ religious views, national origin, family history, gender, marital status, and age.  The letter states that the two Senators “are concerned that collecting this sensitive information under the guise of a background check may simply be a pretext for discrimination.”  As with the letter to the DOJ, the letter to the EEOC asks the Commission to issue a legal opinion as to whether this practice violates current federal law. 

The two Senators, Richard Blumenthal (D-Ct) and Charles E. Schumer (D-NY) have indicated that they intend to introduce federal legislation.  It is unclear, however, whether federal legislation on this topic is necessary.  In Borchers v. Franciscan Tertiary Province of the Sacred Heart, Inc., 962 N.E.2d 29 (Ill. App. 2012), the court found that an employer had violated the Stored Communications Act by looking at an employee’s personal e-mail.  The court reached this holding even though the employee accessed the e-mail account from her work computer, and the account could be accessed without entering a username or password.  Similarly, in Shefts v. Petrakis, No. 10-cv-1104, 2011 U.S. Dist. LEXIS 136538 (C.D. Ill. Nov. 29, 2011), the court found that employee e-mails stored on the employer’s servers were in “electronic storage” under the Stored Communications Act and it was a violation for the employer to access them without authorization. 

On another front, Facebook recently threatened to sue employers who request that job applicants provide access to their Facebook profiles.  Facebook’s Chief Privacy Officer, Mr. Erin Egan, in a statement issued March 23, 2012, stated: “We’ll take action to protect the privacy and security of our users, whether by engaging policymakers or, where appropriate, by initiating legal action.”  Mr. Egan indicated that asking for someone else’s Facebook password violates Facebook’s user agreement. 

Employer requests for the username and passwords needed to access the social media accounts of employees and job applicants has kicked up a great deal of discussion throughout the legal community.  Phil Miles at Lawffice Space has made several posts on this issue, and concludes that, while the question is not yet settled, “[the] consensus amongst employment law bloggers [is] that it’s not cool and potentially not legal[.]” As a practical matter, Dave Copeland of Read Write Web, quoting career coach Ms. Sandra Lamb, believes that “[i]f your FaceBook or other social media password is requested (or required) [by an employer or potential employer] that goes beyond a red flag – it’s a deal breaker.” Jon Hyman of the Ohio Employer’s Law Blog notes that the law will affect a small number of owners because a “small percentage of employers [] engage in this practice”. Justin Keith of GreenbergTraurig’s L&E Blog points out that “[t]he law also makes it unlawful for an employer to refuse to hire an applicant who refused to disclose the same information.”

Ms. Kara Mignanelli reports that only approximately 18 percent of companies use social media to screen job applicants, 89% use it for recruiting.  Companies seeking to employ this less intrusive method of screening would, accordingly, be well advised to ensure that they employ reputable agencies that comply with all applicable laws.  In particular, if an employer outsources review of social media sites, it would appear that the requirements of the Fair Credit Reporting Act apply which would, among other things, require that the written consent of the employee or job applicant be obtained. See Fair Credit Reporting Act, 15 U.S.C. § 1681; Letter from Federal Trade Comm’n to Nixon Peabody, LLP on May 9, 2011.  Should companies decide to conduct social media screening in-house, they must be careful about how such screening is structured.  While any company considering such a program would be well advised to seek in-depth legal advice, Ms. Dawn Lomer explains that – at a minimum – the person making the hiring decision should not participate in the screening. 

Furthermore, it is as yet unclear what effect, if any, legislation such as that passed by Maryland will have on the ongoing debate in the courts regarding discovery of Facebook material. Compare Zimmerman v. Weis Mkts., Inc., No. CV-09-1535, 2011 Pa. Dist. & Cnty. Dec. LEXIS 187, 2011 WL 2065410 (Pa. C.P. Northumberland May 19, 2011); McMillen v. Hummingbird Speedway, Inc., No. 113-2010, 2010 Pa. Dist. & Cnty. Dec. LEIS 270, 2010 WL 4403285 (Pa. C.P. Jefferson Sept. 9, 2010) (both allowing discovery of Facebook materials); with Piccolo v. Paterson, No. 2009-4979, 2011 Pa. Dist. & Cnty. Dec. LEXIS 45 (Pa. C.P. Bucks May 6, 2011); Kennedy v. Norfolk S. Corp., No. 100201437 (Pa. C.P. Phila. Jan. 15, 2011) (both denying discovery of Facebook materials). 

Courts are also divided as to the discovery of social media passwords in particular.  As reported by Ethan Wall on the Richman Greer Blog, some courts have ordered individuals to supply passwords to Facebook and other websites.  See Gallion v. Gallion, FA 114116955S (Ct. Super. Ct. Sept. 30, 2011).  However, as noted by Daniel E. Cummins at the Tort Talk blog,  the court in Kalinowski v. Kirschenheiter & Nat’l Indemn. Co., No 6779 of 2010 (C.P. Luz. Co. 2011), other courts have refused to order the production of social media passwords.  Note that the court in Zimmerman, which ordered discovery of Facebook materials, emphasized that its decision should not be read to open the door to unlimited discovery of a party’s private social media accounts.  Zimmerman, 2011 Pa. Dist. & Cnty. Dec. LEXIS 187.  Having reported the foregoing, the advice of the Employment Law Bits blog is well taken: individuals should think twice about the information and pictures posted on any social media site. 

Please be sure to visit our website at http://RobertBFitzpatrick.com

Supreme Court Update

MetLife v. Glenn, No. 06-923, 461 F.3d 660 (6th Cir. 2006)

The Solicitor General recently filed an invitation-brief (available at http://www.usdoj.gov/osg/briefs/2007/2pet/6invit/2006-0923.pet.ami.inv.pdf) in support of the petition for cert. in this case, which presents the recurring ERISA issue as to the standard of review that the trial court's should utilize in ERISA benefit cases when the plan administrator is the employer, and thus evaluates whether or not to pay claims out of its own pocket. The first question that the Solicitor recommended the Court grant cert. on is whether or not that constitutes a conflict of interest that must be considered in determining the standard of judicial review. The Solicitor also recommended to the Court that it order the parties to brief how the Courts should weigh such conflicts of interest in reviewing discretionary benefit determinations made by such a "dual-role administrator."

The Fourth Circuit in Carolina Care Plan, Inc. v. McKenzie, 467 F.3d 383, 386-87 (4th Cir. 2006), cert. dismissed, Nos. 06-1182 & 06-1436 (July 30, 2007) held that a plan administrator that also pays plan benefits operates under a conflict of interest that must be taken into account on judicial review of a benefit determination. And, the 4th Circuit in Doe v. Group Hospitalization & Med. Servs., 3 F.3d 80, 87 (4th Cir. 1993) applied abuse-of-discretion review in such cases on a "sliding scale," whereby the plan administrator's decision is reviewed for reasonableness, and the particular degree of deference under Firestone to be afforded depends on the seriousness of the conflict of interest.

Employee Manuals - Disclaimers Of Contractual Intent

The D.C. Court of Appeals over the past decade has issued a series of decisions, finding that the particular language of the employee handbook and the language of the employer's disclaimer of contractual intent read together, raised a question for the jury as to whether or not the disclaimer effectively trumped any contract argument or not. See, e.g, Dantley v. Howard Univ., 801 A.2d 962 (D.C. 2002); Strass v. Kaiser Found. Health Plan of Mid-Atlantic, 744 A.2d 1000 (D.C. 2000); U.S. ex rel. Yesudian v. Howard Univ., 153 F.3d 731 (D.C. Cir. 1998); and Sisco v. GSA Nat'l Capital Fed. Credit Union, 689 A.2d 53 (D.C. 1997).

Over the holidays, I tripped over a 2006 opinion by Judge Lamberth, which draws a brighter line as to when this is a jury issue and when the employer gets summary judgment on this issue. See Youngblood v. Vistronix, Inc., 2006 U.S. Dist. LEXIS 51460 (D.D.C., July 27, 2006).

In Youngblood, the manual used permissive language, that is, repeatedly the word "may". For example, the manual in the disciplinary portion stated that the "employee may be notified" "Vistronix may take disciplinary steps" and "Vistronix may terminate the employee". Judge Lamberth held that such permissive language in conjunction with a disclaimer which stated as follows: "These guidelines do not constitute a contract or promise. Any individual employee can be terminated, at any time, with or without cause and without notice." Additionally, the employer had the employee Youngblood sign a receipt that affirmed his status as an at-will employee and that disclaimed any implied contract. Judge Lamberth contrasted this with Strass, where the handbook used mandatory language, that is, the word "shell".

Then, Judge Lamberth drew the bright line, saying that in Youngblood, there was "no logical incongruity between Vistronix's disclaimer and the language contained elsewhere in the handbook, or in the parties' bargain." In contrast, the disclaimer in Strass is "rationally at odds with some aspect of the parties' bargain, [and] the ambiguity as to the parties' intention raises a question of fact for a jury."

I commend Judge Lamberth's opinion as it seems to harmonize these cases that some of us have read too liberally as suggesting a jury question when there is not one.

Paid Sick and Safe Days Act of 2007

My thanks to Karen Minatelli of District of Columbia Employment Justice Center for being able to provide me with the revised version of this proposed District of Columbia legislation. On the D.C. City Council's website, you can find the original version of the bill, but not the revised version that was voted on by committee this past December.

The legislation provides that an employer of six or more employees shall provide for each employee not less than one hour of paid leave for every 26 hours worked, up to a maximum of 10 days within this minimum standard, per year.

An employer of less than 6 employees shall provide not less than one hour of paid leave for every 52 hours worked, up to a maximum of five days within this minimum standard, per year.

Paid leave so accrued may be used by the employee for an absence resulting for, among other reasons, an absence if the employee or the employee's family is a victim of stalking, domestic violence or sexual violence, provided the paid leave is directly related to social or legal services pertaining to the stalking, domestic violence or social violence. The legislation then lists several covered instances including time to relocate and time to take legal action.

Enforcement action is to be taken pursuant to the terms of the District of Columbia's Family and Medical Leave Act of 1990.

San Francisco, in a 2006 initiative supported by 61% of the electorate requires that employers of more than 10 employees give 9 days sick leave and employers of less provide 5 days of paid leave.

International Employment Law - Corporate Social Responsibility

Over the holidays I read a relatively new book on the toy industry. For those who are interested in where the overwhelming percentage of toys in the U.S. come from, and most particularly, the circumstances under which they are manufactured, I highly recommend chapter 8 entitled "Santa's Sweatshop" of Eric Clark's The Real Toy Story: Inside The Ruthless Battle For America's Youngest Consumers (2007 Free Press).

If you are interested in this issue and want to continue to monitor developments, I recommend China Labor Watch/National Labor Committee (http://www.chinalaborwatch.org/).

It will be interesting to see what effect China's new Employment Contract Law, which went into effect January 1st, will have on the practices described in Mr. Clark's book. For more on the new law, see http://www.chinalawblog.com/2007/11/chinas_new_labor_law_its_a_hug.html.

Federal Legislative Update

Senator Kohl (D - WI) has introduced last year S.1577, the Patient Safety and Abuse Prevention Act. The legislation would require long-term care facilities and providers to conduct criminal history background checks before hiring a direct patient access employee. This requirement would not go into effect until January 1, 2011. It provides immunity from liability for such employers in denying employment if the employer reasonably and in good faith relies upon credible information about such applicant provided by a criminal history background check. The legislation prohibits the hiring of an applicant who has disqualifying information disclosed in the background check. A quick read does not readily indicate whether compliance with the proposed legislation's procedures would trump a negligent hiring or negligent retention claim.

Proposed Legislation Prohibiting Discrimination Against Transgendered Persons

For those who have been following this issue, there is a provocative op-ed in last Friday's Wall Street Journal at W13 authored by the Journal's deputy Taste Editor, Naomi Schaefer Riley entitled Crossing Over (available at http://www.opinionjournal.com/taste/?id=110011050).