New York Prohibits Employers From Requesting Employee's Personal Electronic Account Information

Effective March 12, 2024, employers in New York cannot request or require employees or applicants to disclose their personal account logins as a condition of hiring or employment or for use in a disciplinary action. The law is designed to protect employee privacy, particularly with respect to social media accounts. However, there are important exceptions.

Unlawful Conduct By Employers

The law prohibits employers from requesting, requiring, or coercing any employee or applicant for employment to:

1. disclose any user name and password, password, or other authentication information for accessing a personal account through an electronic communications device;
2. access the employee's or applicant's personal account in the presence of the employer; or
3. reproduce in any manner photographs, video, or other information contained within a personal account obtained by the means prohibited in the law.

Further, employers cannot discharge, discipline, or penalize an employee or refuse to hire an applicant for failing to disclose prohibited account information.

Personal accounts are defined as "an account or profile on an electronic medium where users may create, share, and view user-generated content . . . that is used by an employee or an applicant exclusively for personal purposes."

Exceptions to the New Requirement

Employers are permitted to request or require disclosure of access information for:

1. accounts provided by the employer where such account is used for business purposes and the employee was provided prior notice of the employer's right to request or require such access information;
2. accounts known to an employer to be used for business purposes;
3. an electronic communications device paid for in whole or in part by the employer where the provision of or payment for such electronic communications device was conditioned on the employer's right to access such device, and the employee was provided prior notice of and explicitly agreed to such conditions. (Note that employers do not have the right to access any personal accounts on such devices); and
4. purposes of complying with a court order.

In addition, employers can restrict or prohibit employees from accessing certain websites while using an employer's network or while using an electronic communications device paid for in whole or part by the employer where the device was given or paid for conditioned on the employer's right to restrict such access and the employee was provided prior notice of and explicitly agreed to such conditions.

Publicly Accessible Information

The law does not restrict employers from viewing or using information that is not private, whether because it is publicly available or because an employee subject to a misconduct investigation or report voluntarily shared access to the personal account.

Next Steps

Employers should review and update (if necessary) their policies and procedures regarding requests for access to employee social media and other accounts to comply with the law by March 12, 2024.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.