On May 21, 2013, Washington's governor signed SB 5211 into law, making Washington the latest state to prohibit employers from requiring or requesting that prospective and current employees disclose their username and password to their personal social media accounts. Maryland, Illinois, California, Michigan, Utah, New Mexico (which ostensibly applies to prospective employees only), Arkansas, and Colorado have enacted similar laws. A growing national trend, dozens of states and the U.S. Congress are considering similar legislation. To understand the new Washington law, this alert discusses its coverage, prohibitions, exceptions, and remedies.

Coverage

The new Washington law is expansive in its coverage, defining "employer" to mean any person, firm, corporation, partnership, business trust, legal representative, or other business entity which engages in any business, industry, profession, or other activity in Washington state and employs one or more employees. Moreover, the term includes the state, any state institution, state agency, political subdivision of the state, and municipal corporation (or quasi-municipal corporation), as well as any agent, representative, or designee of the employer.

Prohibitions

Pursuant to the new Washington law, an employer may not request, require, or otherwise coerce a current or prospective employee to disclose login information[1] for a personal social networking account, or access his or her personal social networking account in the employer's presence in a manner enabling the employer to observe the contents of the account.

The new Washington law also prohibits an employer from compelling or coercing a current or prospective employee to add a person, including the employer, to the list of contacts associated with the employee's personal social networking account. Additionally, an employer cannot request, require, or cause a current or prospective employee to alter the settings on his or her personal social networking account so as to affect a third party's ability to view the contents of the account.

Moreover, the new Washington law expressly forbids an employer from taking "adverse action"[2] against a current or prospective employee for refusing to engage in any of the acts prohibited under the statute.

Exceptions

The new Washington law does not prohibit an employer from retrieving content stored on an employee's personal social media account when it is necessary (1) to make a factual determination in the course of conducting an investigation; (2) in response to the receipt of information about the employee's activity on his or her account; and (3) to (i) ensure compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct; or (ii) investigate an allegation of unauthorized transfer of an employer's proprietary information, confidential information, or financial data to the employee's personal social networking account. Note that, even if these conditions exist, an employer cannot request or require the employee's login information.

Additionally, the new Washington law does not apply to a social network, intranet, or other technology platform primarily intended to facilitate work-related information exchange, collaboration, or communication by employees or other workers. Nor does the law prohibit an employer from requesting or requiring that an employee disclose login information for access to an account or service provided by virtue of the employee's employment relationship with the employer, or to an electronic communications device[3] or online account paid for or supplied by the employer.

Moreover, nothing in the new Washington law prevents employers from enforcing existing personnel policies (to the extent such policies stay consistent with the new law), nor from complying with the requirements of state or federal statutes, regulations or rules (rules of self-regulatory organizations), or case law.

Finally, the new Washington law provides that an employer is not liable for possessing an employee's login information inadvertently procured through the use of an employer-provided electronic communications device or an electronic device or program monitoring the employer's network. An employer may not, however, use the login information to access the employee's personal social networking account.

Remedies

Under the new Washington law, an aggrieved individual may bring a civil action and is entitled to:

• injunctive or other equitable relief;
• actual damages;
• a $500 penalty; and
• reasonable attorneys' fees and costs (which may be awarded to any prevailing party (such as the employer) upon final judgment and written findings that the action was frivolous and advanced without reasonable cause).

Takeaway

The new Washington law's coverage, prohibitions, and exceptions are similar to the social media laws adopted in other states, as well as the legislation pending in the U.S. Congress and numerous state legislatures. It should be noted, however, that Washington's new law provides more generous remedies than nearly all of its counterparts. As Washington's new plaintiff-friendly law continues this national movement, it is imperative that employers within the state and across the nation navigate with extreme caution when monitoring or seeking to access an applicant's or employee's personal social media account.