Washington Social Media Law: New Regulations Your Business May Not “Like”
The Washington social media law landscape changed recently with the passage of a new bill aimed at protecting employees from social media overreach. The new Washington “Social Media Statute” (RCW 49.44.200) presents a few challenges for businesses and entrepreneurs, especially those that may want to gain access to an employee’s personal or a “contested” social media account. The statute adds new regulations that make it significantly more difficult to monitor an employee or applicant’s personal social media activity. Employers should understand their obligations under this new statute, and what it means for their social media policies.
The statute makes it unlawful for an employer to “request, require, or otherwise coerce an employee or applicant to disclose login information for the employee’s or applicant’s personal social networking account.” The statute focuses on personal accounts, rather than work-related or business accounts. The statute goes beyond just gathering login information; it also applies to the content of the account itself.
Additionally, employers are prohibited from compelling or coercing an employee or applicant to add the employer, or any person, “to the list of contacts associated with the employee’s or applicant’s personal social networking account.” In other words, an employer cannot force the employee or applicant to friend someone on Facebook, or force the employee to accept a follower on Twitter. Finally, an employer cannot force the employee or applicant to change the privacy settings that affect a third party’s ability to view his or her personal account.
Social Media Investigations:
An employer may request that an employee share his or her social media content in the context of investigating that employee’s behavior. A permissible request requires all of the following conditions:
- The request is to make “a factual determination in the course of conducting an investigation;”
- The investigation is “in response to receipt of information about the employee’s activity on his or her social networking account;”
- The purpose of the request is to ensure the employee is not violating the law, regulatory requirements, or prohibitions against work-related employee misconduct; or investigating unauthorized sharing of company information (e.g., trade secrets), confidential, or financial information; and
- The employer does not request social networking login information.
Failure to meet one requirement would result the request being prohibited.
Company Accounts, Equipment, and Policies:
The Social Media Statute does not apply to social media platform accounts held and used mainly for work. Employers can request information regarding either an account maintained or supplied by the employer to the employee by virtue of employment, or an electronic device owned by the employer (e.g. a computer, cell phone, tablet, etc.). This statute will not interfere with policies that do not conflict with this section related to employer-held accounts, and the statute will not interfere with a company complying with the law (e.g. responding to search warrants).
Employers may be protected in the event of accidentally receiving an employee’s private login information, granted that the information is not used to actually login to the employee’s personal account. Under the statue, if “an employer inadvertently receives an employee’s login information, the employer is not liable for possessing the information but may not use the login information to access the employee’s personal social networking account.” If an employer comes across login information “innocently,” he or she will not be liable as long as the information is not actually used to login to the account.
Avoiding Problems with an Account
This statute can be burdensome for employers because of its broad scope. The terms “request, require or otherwise coerce” and “compel or coerce” cover a wide array of behavior by employers. An employer can violate the statute simply by asking an employee for login information to their personal accounts. The use of “coerce” further limits an employer. Things like threatening discipline for the withholding of login information, or offering some kind of incentive or bonus for access to a personal account would likely constitute “coercion.” The legislature was vague in the wording of this section and so it may apply to any activity used by the employer to gain access to prohibited information. Keeping a few points in mind will help you comply with the statute:
Private vs. Company Account – Ensuring Accounts Do Not Overlap
Whether your request for information regarding an account is a lawful request depends on the type of the account. An account is not a company account, as opposed to a personal account, simply because the employee posts company-related material on the account. An employee may have an account that they use to promote or market a business that also serves as a personal account. Some people are even hired based on their personal social media influence.
It will be persistently difficult to determine where the line between private and work-related accounts falls, even as more case law and other guidance emerges. Therefore, it is very important to make efforts to maintain a distinction between the two. Keep any account used primarily for business distinct from any of your employee’s personal accounts. Keep control of logins and passwords, and promptly update credentials when employees’ move on or a relationship breaks down. Ensure that the password to the company account is available to the employer and consider making it available to other employees. An employee will be less inclined to maintain an account for personal use if his or her boss and co-workers have access to that account, and an account with multiple people accessing it is much more likely to be judged a company account.
Employers Beware Asking for Passwords
Be extremely cautious when requesting an employee’s password because it could violate multiple provisions of the statute. The statute sets a broad prohibition against requesting login information to a personal social media account. Consider other ways that you might be able to gain information if you think it is necessary. By gaining access as a friend, an employer can potentially monitor activity on social media sites without violating the statute. You are allowed to send a friend request, or a request to follow the employee in question. And if they are willing to add you, then there would be no foul under the social media statute. However, compelling an employee to accept a social media request would violate the statute, so be careful how you approach employees about their personal accounts.
Failure to comply with the statute gives employees the ability to sue for money damages, including attorneys’ fees, and a penalty of up to $500. This statute has made wrongfully requesting access to an employee’s personal social media account a potentially expensive endeavor.
Social Media Statute – Proceed with Caution
Think carefully and plan before reacting when your employees post something online that you do not like or when you otherwise want to gain access to an account. Planning ahead will help ensure that your investigations are completed and your decisions are made compliantly and correctly.
If your business deals regularly with the social media accounts of your employees, carefully review this statute and compare it to your current practices. Although this statute significantly restricts how your company may treat social media profiles, it is not a comprehensive ban on any interaction with or investigation of employees. Careful compliance and attention to detail will prevent costly violations. And understanding your company’s rights and responsibilities will help you ensure you carry out your social media strategy in a compliant manner.