Nebraska’s New Workplace Privacy Act Restricts Employer Access To Employee Internet Accounts
Some employers request or require employees to disclose their usernames or passwords for their personal Internet accounts (including social media accounts) in order to protect proprietary information or prevent exposure to legal liability for their employees’ actions (e.g., harassment). Employees, in contrast, generally consider this disclosure to be an invaasion of their personal privacy – and many lawmakers agree.
Nebraska now joins the ranks of at least two dozen other states with laws that prevent employers from requesting passwords to personal Internet accounts in order for someone to get or keep a job. On April 13, 2016, the Legislature passed the “Workplace Privacy Act” without any vote in opposition. Governor Ricketts signed the bill on April 19 and it will become law three calendar months after the Legislature adjourned on April 20.
What’s Prohibited?
Nebraska’s Workplace Privacy Act restricts an employer (public or private, regardless of size) from requesting or requiring that an employee or applicant provide any user name or password or any other related account information in order to gain access to the employee’s or applicant’s personal Internet account, or that an employee or applicant log into a personal Internet account in the presence of the employer. Additionally, the law prohibits an employer from requiring an employee or applicant to add anyone, including the employer, to the list of contacts associated with the employee’s or applicant’s personal Internet account.
What’s Not Prohibited?
While the law primarily protects employees and applicants, it also affords employers some protections. Among them, an employer may:
- Maintain policies governing the use of the employer’s electronic equipment, including policies regarding Internet use and personal Internet account use;
- Monitor and access electronic data stored on an electronic communication device supplied by or paid for (in whole or part) by the employer or stored on the employer’s network;
- Require an employee to disclose access information to the employer to gain access to an electronic communication device supplied by or paid for (in whole or part) by the employer, or an account provided by the employer by virtue of the employment relationship or used for the employer’s business purposes;
- Require an employee to cooperate in an investigation if the employer has specific information about: (a) potentially wrongful activity taking place on the employee’s personal Internet account, for the purpose of ensuring compliance with applicable laws or prohibitions against work-related employee misconduct; or (b) an unauthorized download or transfer of the employer’s proprietary information to an employee’s personal internet account; and
- Access information about an employee or applicant that is in the public domain or is otherwise obtained in compliance with the Workplace Privacy Act.
Remedies
The Act establishes a civil cause of action in favor of an aggrieved employee or applicant to remedy a violation. Injunctive relief, general and special damages, and reasonable attorney fees may be awarded. The statute of limitations is one year, and it runs from the date of the alleged violation or discovery of the alleged violation, whichever is later.
Takeaways
Employers with employees working in Nebraska should comply with the Workplace Privacy Act and not request or require access to password-protected personal Internet accounts (including social media sites) unless they are confident that their request or directive is expressly permitted by the Act. Additionally, Nebraska employers should review their Internet and social media policies, and recruiting and hiring practices, to ensure compliance with the new law. Finally, managers and others involved with workplace investigations should be trained to ensure that they understand what the new law prohibits, and what it permits.