Insights / Privacy & Security Law Blog
Information Security & Data Breach Response

Oregon Restricts Employers' Access to Private Social Media Accounts

By Christie S. Totten and Angela C. Galloway
01.24.14
Print this page
Oregon recently joined numerous states in prohibiting employers from seeking access to employees’ or prospective employees’ private social-media accounts, personal email, and other online content. Employers may not:
  1. Require or request that an employee or applicant allow the employer access to the individual’s personal social media account (e.g. cannot ask for the password);
  2. Compel an employee or applicant to add the employer to the individual’s social media contact list, (e.g. cannot require the employee to “friend” the employer on Facebook); or
  3. Compel an employee or applicant to allow the employer to view the personal account.
The law applies to “social media” far beyond Facebook and Twitter, including electronic mediums allowing users to create, share or simply view user-generated content such as email, videos, photos, blogs, video blogs, podcasts, instant messages, and website profiles and locations. The law took effect Jan. 1, 2014.
The law also prohibits retaliation, including taking or threatening to take action to discipline, discharge, or “otherwise penalize” an employee or applicant who asserts his or her rights under the law.
Employers may still act with respect to social media and email accounts operated on behalf of the employer and may conduct investigations regarding illegal or work-related misconduct that do not require the user name or password. The law does not affect an employer’s ability to access information already available to the public about the employee or applicant. An employer who inadvertently receives a user name and password through electronic monitoring is not liable but may not use the information to actually access the social media account.
This sort of legislation may become commonplace. Similar legislation has been introduced in at least three dozen states. Last year, such legislation was enacted in Washington, Arkansas, Colorado, Nevada, New Mexico, Utah and Vermont.
Employers should review their hiring and investigation practices to ensure that employees and applicants are not inappropriately asked for usernames and passwords for their private social media accounts. Questions regarding permissible access to social media accounts should be referred to an experienced labor and employment attorney to ensure compliance.

Related Insights