Recently, New York enacted a law that prohibits an employer from requesting or requiring that an employee or applicant for employment disclose any user name, password, or other means for accessing a personal account or service through specified electronic communications devices.  The new law also prohibits employers from retaliating against employees and applicants who refuse to provide such log-in information.

Specifically, the new law prohibits employers from requesting, requiring or coercing any employee or applicant for employment to: (i) disclose any user name and password, password, or other authentication information for accessing a personal account through an electronic communications device; (ii)  access  the  employee’s  or  applicant’s personal account in the presence of the employer; or (iii) reproduce in any manner photographs, video, or other information contained within a personal account obtained by the means prohibited in this paragraph. 

However, an employer may require an employee to disclose any user name, password or other means for accessing nonpersonal accounts that provide access to the employer’s internal computer or information systems.  In addition, the new law does not prohibit an employer from requesting or requiring an employee to disclose access information to an account provided by the employer where such account is used for business purposes and the employee was provided prior notice of  the employer’s right to request or require such access information.  Further, an employer may request or require an employee to disclose access information to an account  known  to  an  employer  to  be  used  for  business purposes.

The new law also does not prohibit an employer from accessing an electronic communications device paid for in whole or in part by the employer where the provision of or payment for the electronic communications device was conditioned on the employer’s right to access such device and the employee was provided prior notice of an explicitly agreed to such conditions.  However, this does not permit an employer to access any personal accounts on the device.

Additionally, the legislation does not bar an employer from complying with a court order in obtaining or providing information from, or access to, an employee’s accounts as such court order may require or restrict or prohibit an employee’s access to certain websites while using an employer’s network or while using an electronic communications device paid for in whole or part by the employer.

The new law will become effective in March 2024.  In preparation of the new requirements, New York employers should review their social media policies to ensure compliance with the law. 

Should you have any questions regarding the legislation or if you need any other employment law related assistance, please contact Ali Law Group.