1.1 	A bill for an act
1.2 	relating to data privacy; protecting applicant's and employee's personal usernames 
1.3 	and passwords from access by employers; providing for civil enforcement;
1.4 	proposing coding for new law in Minnesota Statutes, chapter 181.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [181.990] EMPLOYEE USERNAME AND PASSWORD PRIVACY 
1.7 	PROTECTION.
1.8 		Subdivision 1.Definitions. (a) For the purposes of this section, the following terms have 
1.9 	the meanings given them in this subdivision.
1.10 	(b) "Applicant" means an applicant for employment.
1.11 	(c) "Employee" means an individual who provides services or labor for an employer for 
1.12 	wages or other remuneration.
1.13 	(d) "Employer" means a person who is acting directly as an employer, or indirectly in 
1.14 	the interest of an employer, on behalf of a for-profit, nonprofit, charitable, governmental, 
1.15 	or other organized entity in relation to an employee.
1.16 	(e) "Personal social media account" means an account with an electronic medium or 
1.17 	service where users may create, share, and view user-generated content, including, but not 
1.18 	limited to, uploading or downloading videos or still photographs, blogs, video blogs, podcasts, 
1.19 	messages, e-mails, or Internet Web site profiles or locations. Personal social media account 
1.20 	does not include: (1) an account opened at an employer's behest, or provided by an employer, 
1.21 	and intended to be used solely on behalf of the employer, or (2) an account opened at a 
1.22 	school's behest, or provided by a school, and intended to be used solely on behalf of the 
1.23 	school.
2.1 	(f) "Specific content" means data or information on a personal social media account that 
2.2 	is identified with sufficient particularity to:
2.3 	(1) demonstrate prior knowledge of the content's details; and
2.4 	(2) distinguish the content from other data or information on the account with which it 
2.5 	may share similar characteristics.
2.6 		Subd. 2.Employer access prohibited. An employer shall not:
2.7 	(1) require, request, or coerce an employee or applicant to disclose the username, 
2.8 	password, or any other means of authentication, or to provide access through the username 
2.9 	or password, to a personal social media account;
2.10 	(2) require, request, or coerce an employee or applicant to access a personal social media 
2.11 	account in the presence of the employer in a manner that enables the employer to observe 
2.12 	the contents of the account; or
2.13 	(3) compel an employee or applicant to add any person, including the employer, to their 
2.14 	list of contacts associated with a personal social media account or require, request, or 
2.15 	otherwise coerce an employee or applicant to change the settings that affect a third party's 
2.16 	ability to view the contents of a personal social networking account.
2.17 		Subd. 3.Employer actions prohibited. An employer shall not:
2.18 	(1) take any action or threaten to take any action to discharge, discipline, or otherwise 
2.19 	penalize an employee for an employee's refusal to disclose any information specified in 
2.20 	subdivision 2, clause (1), for refusal to take any action specified in subdivision 2, clause 
2.21 	(2), or for refusal to add the employer to their list of contacts associated with a personal 
2.22 	social media account or to change the settings that affect a third party's ability to view the 
2.23 	contents of a personal social media account, as specified in subdivision 2, clause (3); or
2.24 	(2) fail or refuse to hire any applicant as a result of the applicant's refusal to disclose 
2.25 	any information specified in subdivision 2, clause (1), for refusal to take any action specified 
2.26 	in subdivision 2, clause (2), or for refusal to add the employer to their list of contacts 
2.27 	associated with a personal social media account or to change the settings that affect a third 
2.28 	party's ability to view the contents of a personal social media account, as specified in 
2.29 	subdivision 2, clause (3).
2.30 		Subd. 4.Employer actions permitted. Nothing in this section shall prevent an employer 
2.31 	from:
2.32 	(1) accessing information about an employee or applicant that is publicly available;
3.1 	(2) complying with state and federal laws, rules, and regulations and the rules of 
3.2 	self-regulatory organizations, where applicable;
3.3 	(3) requesting or requiring an employee or applicant to share specific content that has 
3.4 	been reported to the employer, without requesting or requiring an employee or applicant to 
3.5 	provide a username, password, or other means of authentication that provides access to a 
3.6 	personal social media account, for the purpose of:
3.7 	(i) ensuring compliance with applicable laws or regulatory requirements;
3.8 	(ii) investigating an allegation, based on receipt of specific information, of the 
3.9 	unauthorized transfer of an employer's proprietary or confidential information or financial 
3.10 	data to an employee or applicant's personal social media account; or
3.11 	(iii) investigating an allegation, based on receipt of specific information, of unlawful 
3.12 	harassment in the workplace;
3.13 	(4) prohibiting an employee or applicant from using a personal social media account for 
3.14 	business purposes; or
3.15 	(5) prohibiting an employee or applicant from accessing or operating a personal social 
3.16 	media account during business hours or while on business property.
3.17 		Subd. 5.Employer protected if access inadvertent; use prohibited. If an employer 
3.18 	inadvertently receives the username, password, or other means of authentication that provides 
3.19 	access to a personal social media account of an employee or applicant through the use of 
3.20 	an otherwise lawful virus scan or firewall that monitors the employer's network or 
3.21 	employer-provided devices, the employer is not liable for having the information, but may 
3.22 	not use the information to access the personal social media account of the employee or 
3.23 	applicant, may not share the information with anyone, and must delete the information 
3.24 	immediately or as soon as is reasonably practicable.
3.25 		Subd. 6.Enforcement. Any employer, including its employee or agents, that violates 
3.26 	this section shall be subject to legal action for damages or equitable relief, to be brought by 
3.27 	any other person claiming a violation of this section has injured the person or the person's 
3.28 	reputation. A person so injured is entitled to actual damages, including mental pain and 
3.29 	suffering endured on account of violation of the provisions of this section, and reasonable 
3.30 	attorney fees and other costs of litigation.
3.31 		Subd. 7.Severability. The provisions in this section are severable. If any part or provision 
3.32 	of this section, or the application of this section to any person, entity, or circumstance, is 
3.33 	held invalid, the remainder of this section, including the application of the part or provision 
4.1 	to other persons, entities, or circumstances, shall not be affected by the holding and shall 
4.2 	continue to have force and effect.

4.3 	EFFECTIVE DATE. This section is effective the day following final enactment.