The Employee Online Privacy Act of 2014, signed by Governor Bill Haslam on April 29, 2014, becomes effective January 1, 2015.
Under the new Act, employers of any size may not:
1. Request or require an employee or an applicant to disclose a password that allows access to the employee’s or applicant’s personal Internet account;
2. Compel an employee or an applicant to add the employer to the employee’s contacts list associated with a personal Internet account;
3. Compel an employee or an applicant to access a personal Internet account so that the employer can observe its contents; or
4. Take an adverse action or refuse to hire an employee or applicant because of a failure to disclose information or take an action specified above.
There are a few exceptions under the Act so that an employer may still:
1. Require an employee to disclose a username or password needed to access an electronic communications device supplied by or paid for wholly or in part by the employer;
2. Discipline or discharge an employee for transferring the employer’s proprietary or confidential information or financial data to an employee’s personal Internet account without the employer’s authorization;
3. Conduct an investigation or require an employee to cooperate in an investigation involving compliance issues or unauthorized use of confidential information;
4. Restrict an employee’s access to certain websites while using an electronic communications device supplied by or paid for wholly or in part by the employer or while using an employer’s network or resources, in accordance with state and federal law;
5. Monitor, review, access, or block electronic data stored on an electronic communications device supplied by or paid for wholly or in part by the employer, or stored on an employer’s network, in accordance with state and federal law;
6. Comply with a duty to screen employees or applicants before hiring or to monitor or retain employee communications that is established under federal law or by a “self-regulatory organization” (as defined in the Securities and Exchange Act of 1934, 15 U.S.C. § 78c(a)), for purposes of law enforcement employment, or for purposes of an investigation into law enforcement officer conduct performed by a law enforcement agency.
There will be a private cause of action available to employees and applicants providing for recovery of up to $1,000.00 for each violation plus reasonable attorney’s fees and court costs.
Employers with Internet Usage or Social Media Policies should confirm compliance with such state laws where they have operations. Tennessee is merely joining the efforts of a growing number of states with such restrictions.