The Right to Privacy in the Workplace Act was amended, effective Jan. 1, 2017, to broaden the scope of what an employer may not access or request from an employee in regards to online accounts.
A major change is that the category of “personal online account” was added to the statute, which encompasses any online account “that is used by a person primarily for personal purposes.” The prior definition was focused only on social networking accounts.
Some of the new prohibitions for employers include: any request or requirement to access an employee’s personal online account with the employer present, as well as any requirement that the employee be required to join with an online group/social media. The law continues to prohibit an employer from requiring an employee to provide a user name and/or password to any personal online account.
While much of the new language in the act adds prohibitions to employers, employers are also provided some limited protections and rights to access personal account information. For instance, an employer may require an employee to share specific content that has been reported to the employer, without requesting or requiring an employee or applicant to provide a user name and password.
An employer may require an employee to share content in this manner only if the employer is ensuring compliance with the law, investigating an allegation of unauthorized transfer of an employer’s proprietary or confidential information to an employee’s personal account, investigating a violation of laws or work-related misconduct, or certain other circumstances. As with any changes to law that incorporate broad definitions, what exactly constitutes an employer obtaining personal account information to ensure compliance with law or investigating a violation of laws, for example, remains to be tested by the courts.
Nothing in the amended law prohibits the employer from enacting lawful policies governing the use of electronic devices and/or the internet in the work place or on employer-provided devices. So an employee could be justly disciplined for using a personal online account on employer devices if the employer has a policy that prohibits such activity.
The amended Act now also clarifies that an employer can only directly access accounts which are provided by the employer or are accounts created at the direction of the employer related to the employee’s employment.
• Brad Stewart is an attorney with Zukowski, Rogers, Flood & McArdle in Crystal Lake. Stewart mainly practices corporate and local government law. He can be reached at firstname.lastname@example.org.