SF 2703

as introduced - 89th Legislature (2015 - 2016) Posted on 03/15/2016 10:14am

A bill for an act
relating to data privacy; protecting applicant's and employee's personal
usernames and passwords from access by employers; providing for civil
enforcement; proposing coding for new law in Minnesota Statutes, chapter 181.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [181.990] EMPLOYEE USERNAME AND PASSWORD PRIVACY
PROTECTION.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin (a) For the purposes of this section, the following terms
have the meanings given them in this subdivision.
new text end

new text begin (b) "Applicant" means an applicant for employment.
new text end

new text begin (c) "Employee" means an individual who provides services or labor for an employer
for wages or other remuneration.
new text end

new text begin (d) "Employer" means a person who is acting directly as an employer, or indirectly in
the interest of an employer, on behalf of a for-profit, nonprofit, charitable, governmental,
or other organized entity in relation to an employee.
new text end

new text begin (e) "Personal social media account" means an account with an electronic medium
or service where users may create, share, and view user-generated content, including,
but not limited to, uploading or downloading videos or still photographs, blogs, video
blogs, podcasts, messages, e-mails, or Internet Web site profiles or locations. Personal
social media account does not include: (1) an account opened at an employer's behest,
or provided by an employer, and intended to be used solely on behalf of the employer,
or (2) an account opened at a school's behest, or provided by a school, and intended
to be used solely on behalf of the school.
new text end

new text begin (f) "Specific content" means data or information on a personal social media account
that is identified with sufficient particularity to:
new text end

new text begin (1) demonstrate prior knowledge of the content's details; and
new text end

new text begin (2) distinguish the content from other data or information on the account with which
it may share similar characteristics.
new text end

new text begin Subd. 2. new text end

new text begin Employer access prohibited. new text end

new text begin An employer shall not:
new text end

new text begin (1) require, request, or coerce an employee or applicant to disclose the username,
password, or any other means of authentication, or to provide access through the username
or password, to a personal social media account;
new text end

new text begin (2) require, request, or coerce an employee or applicant to access a personal social
media account in the presence of the employer in a manner that enables the employer
to observe the contents of the account; or
new text end

new text begin (3) compel an employee or applicant to add any person, including the employer, to
their list of contacts associated with a personal social media account or require, request, or
otherwise coerce an employee or applicant to change the settings that affect a third party's
ability to view the contents of a personal social networking account.
new text end

new text begin Subd. 3. new text end

new text begin Employer actions prohibited. new text end

new text begin An employer shall not:
new text end

new text begin (1) take any action or threaten to take any action to discharge, discipline, or otherwise
penalize an employee for an employee's refusal to disclose any information specified in
subdivision 2, clause (1), for refusal to take any action specified in subdivision 2, clause
(2), or for refusal to add the employer to their list of contacts associated with a personal
social media account or to change the settings that affect a third party's ability to view the
contents of a personal social media account, as specified in subdivision 2, clause (3); or
new text end

new text begin (2) fail or refuse to hire any applicant as a result of the applicant's refusal to disclose
any information specified in subdivision 2, clause (1), for refusal to take any action
specified in subdivision 2, clause (2), or for refusal to add the employer to their list of
contacts associated with a personal social media account or to change the settings that
affect a third party's ability to view the contents of a personal social media account, as
specified in subdivision 2, clause (3).
new text end

new text begin Subd. 4. new text end

new text begin Employer actions permitted. new text end

new text begin Nothing in this section shall prevent an
employer from:
new text end

new text begin (1) accessing information about an employee or applicant that is publicly available;
new text end

new text begin (2) complying with state and federal laws, rules, and regulations and the rules of
self-regulatory organizations, where applicable;
new text end

new text begin (3) requesting or requiring an employee or applicant to share specific content
that has been reported to the employer, without requesting or requiring an employee or
applicant to provide a username, password, or other means of authentication that provides
access to a personal social media account, for the purpose of:
new text end

new text begin (i) ensuring compliance with applicable laws or regulatory requirements;
new text end

new text begin (ii) investigating an allegation, based on receipt of specific information, of the
unauthorized transfer of an employer's proprietary or confidential information or financial
data to an employee or applicant's personal social media account; or
new text end

new text begin (iii) investigating an allegation, based on receipt of specific information, of unlawful
harassment in the workplace;
new text end

new text begin (4) prohibiting an employee or applicant from using a personal social media account
for business purposes; or
new text end

new text begin (5) prohibiting an employee or applicant from accessing or operating a personal
social media account during business hours or while on business property.
new text end

new text begin Subd. 5. new text end

new text begin Employer protected if access inadvertent; use prohibited. new text end

new text begin If an
employer inadvertently receives the username, password, or other means of authentication
that provides access to a personal social media account of an employee or applicant
through the use of an otherwise lawful virus scan or firewall that monitors the employer's
network or employer-provided devices, the employer is not liable for having the
information, but may not use the information to access the personal social media account
of the employee or applicant, may not share the information with anyone, and must delete
the information immediately or as soon as is reasonably practicable.
new text end

new text begin Subd. 6. new text end

new text begin Enforcement. new text end

new text begin Any employer or educational institution, including its
employee or agents, that violates this section shall be subject to legal action for damages
or equitable relief, to be brought by any other person claiming a violation of this section
has injured the person or the person's reputation. A person so injured shall be entitled to
actual damages, including mental pain and suffering endured on account of violation of
the provisions of this section, and reasonable attorney fees and other costs of litigation.
new text end

new text begin Subd. 7. new text end

new text begin Severability. new text end

new text begin The provisions in this section are severable. If any part
or provision of this section, or the application of this section to any person, entity, or
circumstance, is held invalid, the remainder of this section, including the application of
the part or provision to other persons, entities, or circumstances, shall not be affected by
the holding and shall continue to have force and effect.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end