Add the Commonwealth of Virginia to the ever-growing list of states (now 19) that have enacted legislation to restrict an employer’s ability to seek access to current employees’ or job applicants’ social media accounts.  Signed into law by Governor Terry McAuliffe on March 23, 2015, the new legislation, H.B. 2081, will take effect on July 1, 2015.  Employers with operations in Virginia should take notice of the new restrictions, and make any necessary adjustments over the coming months.

The Restrictions

The new Virginia law prohibits public and private employers, of all shapes and sizes, from:

• Requiring that employees and applicants disclose their social media usernames and passwords,
• Requiring that employees and applicants add the employer, supervisor or administrator to the list of contacts associated with the account (i.e. you can’t make your employees “friend” you – thereby allowing you to see their complete profile); or
• Taking action against, threatening to discharge, disciplining, or “otherwise penaliz[ing]” current employees and/or failing or refusing to hire applicants who don’t provide their social media information. 

Like similar laws in other states, the Virginia law has a fairly expansive definition of “social media account,” covering any “personal account with an electronic medium or service where users may create, share, or view user-generated content, including, without limitation, videos, photographs, blogs, podcasts, messages, emails, or website profiles or locations.”  Because of the breadth of the definition, employers should safely assume that an employee’s account is a covered “social media account.”

What Isn’t Restricted

Thankfully, the new law is not as sweepingly broad as password-privacy laws in other states and contains some common sense exclusions that allow employers to continue to run investigations and enforce workplace policies.

For example, employers are not prevented from seeking information or access to social media accounts as part of legitimate, formal workplace investigations.  Specifically, employers may request that an employee provide his or her log-in information “if the employee’s social media account activity is reasonably believed to be relevant to a formal investigation or related proceeding by the employer of allegations of an employee’s violation of federal, state, or local laws or regulations or of the employer’s written policies.”  Similarly, the Virginia law does not stand in the way of an employer’s ability to otherwise generally comply with federal or state laws, rules or regulations.

The law also permits employers to view on-line information about employees or applicants that is “publicly available” and excuses those employers who inadvertently receive an employee’s information (e.g. through normal monitoring of employees on company networks). The law also specifically excludes from the definition of “social media accounts” those accounts that were set up on behalf of or at the request of the employer, or that were “set up by an employee to impersonate an employer.” 

Recommendations

While the Virginia law does not explicitly restrict every avenue for circumventing an employee’s social media privacy settings, employers would be wise to train their managers and HR representatives to avoid any behavior that would violate the spirit of the new law.  Employers should not ask for, or seek access to, employee and/or applicant social media accounts unless there is a solid business justification that fits squarely within the exceptions provided. In addition, employers should note that just because an action may not violate this new statute, it does not insulate the employer from liability under the National Labor Relations Act or other employment laws.