On September 27, 2012, California Governor Jerry Brown signed into law Assembly Bill 1844, which prohibits employers from requiring or requesting an employee or applicant for employment to: (1) disclose a username or password for personal social media, (2) access their accounts in the presence of employers, or (3) divulge any personal social media. It also makes it illegal to discipline or retaliate against an employee or applicant for not complying with a request or demand for access to personal social media.

The bill carves out two exceptions. First, an employer can require disclosure of usernames and passwords if it is relevant to an investigation of employee misconduct or employee violations of laws or regulations. Second, the bill does not preclude employers from requiring or requesting an employee to disclose a username or password for the purpose of accessing an employer-issued electronic device.

While the bill was largely aimed at protecting the privacy of employees' social networking sites such as Facebook, Twitter, and LinkedIn, its definition of "social media" is broad. The definition includes "videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations."

Finally, this legislation states that the Labor Commissioner is not required to investigate or determine alleged violations of this law. Presumably this will allow employees and applicants to proceed directly to file lawsuits for alleged violations.

This legislation makes California the third state (after Maryland and Illinois) to ban employers from requiring access to employee and applicant social networking sites. At least ten other states and the federal government are currently considering similar legislation.

Employers should evaluate current technology policies and practices to ensure compliance with the new law. The law does not prohibit electronic monitoring of employer-provided electronic devices. Such electronic monitoring, such as key-stroke monitoring for the purpose of reviewing Internet usage, is still permitted.