Maine has now enacted legislation that restricts an employer’s ability to demand information regarding an employee’s or job applicant’s social media account.  The passage of H.P. 640 - L.D. 921, An Act to Strengthen the Rights of a Victim of Sexual Assault or Domestic Violence to Take Necessary Leave from Employment and to Promote Employee Social Media Privacy (the “Act”), was not without controversy.  The Act, sponsored by Rep. Matthea Daughtry (49th Dist.) and Sen. James Hamper (19th Dist.), was passed by the Maine Senate and House of Representatives on June 30, 2015. 

In July, Governor LePage attempted to veto 65 bills passed by the Legislature, including the Act.  Maine lawmakers, however, argued that the Governor missed the veto deadline and, therefore, all 65 bills became law.  Governor LePage then sought an advisory opinion from the Maine Supreme Judicial Court, which ruled on August 6, 2015, that the Governor had missed the veto deadline and the bills (including the Act) had, indeed, become law. 

The Act will take effect on October 14, 2015, and applies to both public and private employers, including the State and political subdivisions of the State and municipalities. 

The Act expressly prohibits employers from requiring, coercing or requesting an employee or job applicant provide the employer with the password or other means of accessing his or her social media accounts.  This prohibition applies to any online account or service through which users share, view or create user-generated blogs, videos, instant and text messages, e-mails, and photographs.  The law also prohibits employers from requiring, coercing or requesting an employee or job applicant access a personal social media account in the presence of the employer (otherwise known as “shoulder surfing”). 

The Act further prohibits employers from requiring or causing an employee or applicant to add anyone to his or her “list of contacts associated with a personal social media account.”  This provision of the law is unusually broad, as it prohibits employers from causing an employee or applicant to add anyone to his or her “list of contacts,” and is not limited to the employer or an agent of the employer.  The Act also broadly prohibits employers from requiring or coercing an employee or job applicant from disclosing “any personal social media account information.” 

Finally, like several similar laws in other states, the Act prohibits an employer from requiring or causing an employee or job applicant to alter his or her privacy settings on the individual’s personal social media account to allow an employer to view otherwise private content. 

Under the Act, employers are prohibited from discharging, disciplining or otherwise penalizing or threatening to discharge, discipline or otherwise penalize an employee for refusing the employer’s request made in violation of these restrictions.  Employers are also prohibited from failing or refusing to hire a job applicant for refusing the employer’s request made in violation of these restrictions.  Notably, the Act does not appear to contain language that prohibits an employer from retaliating against an employee or applicant for making a written or verbal complaint concerning violations of the Act. 

The Act contains several exceptions to the foregoing restrictions.  First, the restrictions in the Act do not apply to information about an applicant or employee that is publicly available.  Second, certain employers may (1) screen employees and applicants before hiring and (2) monitor employee communications only for the purpose of complying with requirements of state or federal statutes, rules or regulations, case law or “rules of self-regulatory organizations,” such as FINRA.  Finally, the Act contains a broad exception for workplace investigations.  Specifically, the Act does not prohibit an employer from requiring an employee to disclose personal social media account information that the employer reasonably believes to be relevant to an investigation of allegations of employee misconduct or a workplace-related violation of applicable laws, rules or regulations if the information disclosed is used solely for that investigation.

Employers should note, however, that the Act in no way limits the employer’s right to maintain lawful workplace policies governing the use of the employer’s electronic equipment.  Employers may require that employees disclose to the employer the employee’s user name, password or other information needed to access employer issued electronic devices or networks. 

The Act does not appear to provide a private right of action for employees or applicants affected by violations of the Act, nor does it identify the means by which employees or applicants may report any such violations.  Unlike many states with similar statutes, the Act does not provide any monetary or injunctive relief to aggrieved employees or job applicants.  The Maine Department of Labor may impose a fine of at least $100 for the first violation, at least $250 for the second violation and at least $500 for each subsequent violation. 

Recommendations for Employers

Maine employers should not seek access to personal online content except where there is a strong business interest for doing so explicitly recognized in the Act.  Maine employers should also train employees whose job responsibilities intersect with the Act on the Act’s key requirements.  Training should emphasize that the law prohibits requesting access, in any manner, to an employee’s or applicant’s personal social media accounts unless subject to one of the narrow exceptions set forth above.  Employees responsible for conducting investigations should be trained on the circumstances under which and to what extent a request for access to an employee’s or applicant’s personal social media account is permissible.