New York “Denies Access” to Employers Seeking Login Credentials for Employee’s Social Media Accounts

New York employers should take note: 2024 will bring significant changes in the state’s labor law, restricting the ability to seek login credentials for the private social media accounts of employees and job candidates.

Specifically, beginning on March 12, 2024, employers in New York will be barred from “request[ing], requir[ing], or coerc[ing]” an employee or job applicant from providing their username and password to their private social media accounts. Similarly, under the new law, employers will be prohibited from accessing the accounts of employees whose login information they acquire in a prohibited manner, reproducing any images or information from the employee’s improperly accessed account, or taking any adverse action against an employee or applicant who refuses to provide their login credentials.

The law is broad in its application — defining “employer” to mean all “person[s] or entit[ies] engaged in a business, industry, professional, trade or other enterprise in the state,” as well as any “agent, representative or designee of the employer.”

While the law is a stringent and sweeping prohibition on an employer’s ability to gain access to employee social media accounts, there are certain limited exceptions. Among the exceptions, if an employer gives prior notice of its right to request such information, employers are still entitled to seek usernames and passwords for accounts that are provided by the employer and used by the employee for “business purposes,” or are business accounts used on an electronic device paid for (in whole or in part) by the employer. An employer also may seek login information from an employee if a court order so requires.

Notably, nothing in the law prohibits an employee from voluntarily giving an employer (or a fellow employee) access to their social media accounts. And, once the employee provides such voluntary access, the employer may use the access to obtain photographs, video, messages, and information from the accounts, even if they obtain such information indirectly through a third-party intermediary (like a co-worker) to whom the employee provided authorized access. Of course, an employer’s access to a publicly available account is always permitted.

While this new law is fairly comprehensive and detailed, some open questions remain and will need to be ironed out after it takes effect. For example, are employers of domestic workers included in the sweeping definition of “employer?” While it does not appear so from the explicit language of the definition, the rule’s stated justification would appear to cover all types of employers, including those who hire workers (like nannies and housekeepers) in their homes. In particular, the bill’s justification states that it seeks broadly to protect employees in New York from “unfair and discriminatory hiring [] practices” and to allow “people who do not have the option to walk away from a job” the means to resist the “severe invasion of privacy” that employers impose when they seek access to private social media accounts. Furthermore, determining when a social media account is, in fact, “used for business” may prove difficult, particularly when the account may be subject to mixed use. Finally, it seems inevitable that the exact contours of what constitutes an employee giving “voluntary access” will be tested.

As we previously reported, many states have long since enacted laws prohibiting employers from seeking access to their employees’ social media accounts. Therefore, it seems likely that the interpretations of these other state rules may serve as a guide for New York. Time will tell. For the moment, employers are well-advised to have counsel review and modify their social media policies and recruitment practices to ensure that they do not improperly seek access to their employees’ or job applicants’ private social media accounts. Further, to the extent employers pay for and provide electronic communication devices to their employees, they must be careful to explicitly condition acceptance of those devices by the employees on access to social media accounts used for business purposes.

Descargo de responsabilidad

Foley & Lardner LLP ("Foley" o "la Firma") pone a disposición este blog únicamente con fines informativos. No pretende transmitir la posición jurídica de la Firma en nombre de ningún cliente, ni tampoco asesoramiento jurídico específico. Las opiniones expresadas en este artículo no reflejan necesariamente los puntos de vista de Foley & Lardner LLP, sus socios o sus clientes. En consecuencia, no actúe sobre la base de esta información sin buscar el asesoramiento de un abogado autorizado. Este blog no pretende crear, y su recepción no constituye, una relación abogado-cliente. La comunicación con Foley a través de este sitio web por correo electrónico, entrada de blog, o de otro modo, no crea una relación abogado-cliente para ningún asunto legal. Por lo tanto, cualquier comunicación o material que usted transmita a Foley a través de este blog, ya sea por correo electrónico, entrada de blog o de cualquier otra manera, no será tratado como confidencial o de propiedad. La información de este blog se publica "TAL CUAL" y no se garantiza que sea completa, exacta o actualizada. Foley no hace representaciones o garantías de ningún tipo, expresas o implícitas, en cuanto a la operación o el contenido del sitio. Foley rechaza expresamente todas las demás garantías, condiciones y representaciones de cualquier tipo, ya sean expresas o implícitas, ya se deriven de cualquier estatuto, ley, uso comercial o de otro tipo, incluidas las garantías implícitas de comerciabilidad, idoneidad para un fin determinado, titularidad y no infracción. En ningún caso Foley o cualquiera de sus socios, directivos, empleados, agentes o afiliados serán responsables, directa o indirectamente, bajo ninguna teoría legal (contrato, agravio, negligencia u otra), ante usted o cualquier otra persona, por cualquier reclamación, pérdida o daño, directo, indirecto especial, incidental, punitivo o consecuente, resultante de u ocasionado por la creación, uso o confianza en este sitio (incluyendo información y otros contenidos) o cualquier sitio web de terceros o la información, recursos o material al que se acceda a través de cualquiera de dichos sitios web. En algunas jurisdicciones, los contenidos de este blog pueden considerarse publicidad de abogados. En su caso, tenga en cuenta que resultados anteriores no garantizan un resultado similar. Las fotografías son sólo para fines de dramatización y pueden incluir modelos. Los parecidos no implican necesariamente la condición actual de cliente, socio o empleado.