Data Protection for Employee Social Media in New York

On March 12, 2024 New York joined other states that protect employees’ and applicants’ privacy on social media when its own protections went into effect. These protections should be familiar to Midwest employers as they are like the ones included in Illinois’ Right to Privacy in the Workplace Act for “personal online accounts.” Generally, the new protections prohibit employers from requiring access or disclosure of an employee’s or applicant’s personal social media accounts.

Who Is an Employer?

Under the amended New York Labor Law,  § 201-i, an employer is defined to mean:

(I)  a person or entity engaged in a business, industry, profession, trade or other enterprise in the state;  (II)  the State  of  New  York;  (III)  a county, city, town, village or any other  political subdivision or civil division of  the  state;  (IV)  a  school district or any government entity operating a public school, college, or university;  (V) a public improvement or special district; (VI) a public authority, commission or public benefit corporation; or (VII) any  other public  corporation, agency, instrumentality or unit of government which exercises governmental power under the laws of the  state; and (VIII) shall include an agent, representative or designee of the employer.

In short, if an employer operates in the State of New York, it is likely subject to these new prohibitions, with a few exceptions for law enforcement agencies and correctional departments.

Which Social Media Sites Are Protected?

While social media sites like Instagram and Facebook (Meta), X (formerly known as Twitter) and TikTok might first come to mind, these employee protections are purposefully much more inclusive. Personal email accounts, podcasts, WhatsApp, and networking sites like LinkedIn are also included in the definition of a “personal account.” A personal account is defined to mean:

an account or profile on an electronic medium where users may create, share and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or internet website profiles or locations that is used by an employee or an applicant exclusively for personal purposes.

What Is Prohibited?

Under the amended New York Labor Law,  § 201-i, an employer cannot require or coerce an employee or applicant to disclose their username or password, access their personal account in the presence of the employer, or reproduce in any manner information contained within a personal account after demanding access to or disclosure of the employee or applicant’s account in the first place.

(i) disclose any user name and password, password, or other authentication information for accessing a personal account through an electronic communications device; (ii) access the employee’s or applicant’s personal account in the presence of the employer; or (iii) reproduce in any manner photographs, video, or other information contained within a personal account obtained by the means prohibited in this paragraph.

Employers are prohibited from retaliating against employees who exercise their rights under the new law. Employers cannot penalize or threaten to penalize an employee for his or her refusal to disclose any of the information specified above. Finally, employers are prohibited from failing to or refusing to hire applicants solely because the applicant exercised their rights by refusing to disclose their personal account data.

What Are Some Exceptions?

These prohibitions, however, do not completely protect employee social media from an employer’s considerations in discipline or hiring decisions, as there are several exceptions. Notably, for human resource professionals, the law does not prevent employers from viewing, accessing and using information about an employee or applicant that is available in the public domain or that can be accessed without any required access information. Also, employers are allowed to view photographs, videos, messages, and other information for the purposes of investigating misconduct if the employee in question voluntarily gives the employer access to such information. For example, an applicant can voluntarily add a hiring manager to their connections on LinkedIn, without that manager needing to fear repercussions specifically under this law to review that applicant’s content.

Similarly, if a hiring manager receives an application from a “Nathaniel Doe,” this law does not prevent the same hiring manager from searching for “Nathaniel Doe” on LinkedIn or other locations. However, under this law a hiring manager cannot require “Nathaniel Doe” to disclose that he has a wildly popular Twitch account under “Nate Doe.”

Some other permitted activities include:

• Requiring employees to disclose login information for the employer’s business social media accounts and/or any of its internal systems used for business purposes (think IT).
• Accessing electronic devices which the employer provides to the employee by paying for it even partially, if the employer provides prior notice of this access right, and the employee agrees to such conditions. This does not mean that an employer may access an employee’s social media simply because they are, for example, using their work computer.
• Complying with court orders which require obtaining and providing information from an employee’s personal social media accounts. Employers are also allowed to comply with retention laws or laws which mandate more intensive screening of applicants like those provided under FINRA.
• Restricting employees’ access to certain websites while using the employer’s Wi-Fi or employer-provided electronic device.

What Is the Risk of Noncompliance?

As with other protections under the Labor Law, employees may file a complaint with the New York Department of Consumer and Worker Protection (DCWP). Whether a private right of action applies, however, is currently untested given the new effective date of this law.

March 2024 Update to Workers’ Bill of Rights Poster

Finally, New York employers, especially those operating in New York City, have seen a slew of new regulations over the last year. Also new in March 2024, for those employers specifically doing business in New York City, the New York Department of Consumer and Worker Protection published its Workers’ Bill of Rights Poster on March 1, 2024, which will be required to be posted beginning July 1, 2024.