Ride the Lightning

Virginia: Law Now Protects Employees' Social Media Accounts

May 20, 2015

Virginia Lawyers Weekly (sub.req.) recently reported that, as of July 1st, a Virginia employer cannot require an employee to turn over usernames or passwords for personal social media accounts.

The new statute, Virginia Code § 40.1-28.7:5, applies to social media accounts of current and prospective employees, and adds state and local governments to the broad definition of private employers under Code § 40.1-2. The law does not prohibit an employer from viewing information about a current or prospective employee that is “publicly available.”

An employer may maintain access to job-related online content, as the statute excludes from the definition of “social medial accounts” accounts opened by an employee at the employer’s request; accounts provided to an employee by an employer, such as the employee’s e-mail account or a proprietary software account; and accounts set up by an employee on behalf of an employer.

The statute also protects an employer’s right to access an account set up by an employee to impersonate an employer through the use of the employer’s name, logos or trademarks.

Some employers provide smartphones, laptops, or other electronic devices for their employees’ use. If an employer inadvertently receives an employee’s username and password to, or other log-in information for, an employee’s account, through a device provided by the employer or a network monitoring program used by the employer, the employer won’t be liable for having that information, but “shall not use the information to gain access to an employee’s social media account.”

The new law explicitly says that nothing in the statute “affects an employer’s existing rights” to request an employee to share a username or password for a social media account that is “reasonably believed to be relevant to a formal investigation or related proceedings” involving allegations of an employee’s violation of federal, state or local laws or of the employer’s written policies. A username or password provided in this context is to be used only for the purpose of the formal investigation or related proceeding.

I must say that this statute seems to balance the rights of the parties rather nicely. Well done!

E-mail:    Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
http://www.senseient.com
http://twitter.com/sharonnelsonesq
www.linkedin.com/in/sharondnelson