New Connecticut Law Passed to Protect Employee Online Privacy

Effective October 1, 2015, employers in the State of Connecticut are restricted from requiring or requesting employees and job applicants to provide access to “personal online accounts,” which include email, social media and retail-based Internet web sites used exclusively for personal reasons. Specifically, the new law (Public Act No. 15-6) (“the Act”), prohibits employers from requesting or requiring employees or job applicants to:

1. provide the username and password, password, or other means of authentication to access an individual’s personal online account;
2. authenticate or access a personal online account for the employer to view; or
3. invite an employer to accept an invitation or be compelled to accept an invitation from an employer to join a group related to a personal online account.

Also, an employer may not discharge, discipline, discriminate against, retaliate against, or otherwise penalize an employee or applicant who refuses one of the above requirements or requests or who files a written or oral complaint with a public or private body or court to complain about a violation of the Act. Arguably, any retribution for an internal complaint by the employee or applicant with the employer also will be considered unlawful retaliation. Moreover, a refusal to hire an applicant who declines an employer’s request or requirement to participate in activity prohibited by this Act is unlawful.

As exceptions to the Act’s prohibitions, an employer may request or require a username and password, password, or other authentication for:

1. an account provided by an employer, for the employee’s employment relationship with the employer, or that the employee uses for business purposes; or
2. an electronic communications device supplied or paid for (all or partially) by the employer.

The Act does not affect an employer’s ability to discipline or discharge an employee for unauthorized misappropriation of the employer’s proprietary information, confidential information, or financial data to or from a personal online account. Also, the Act does not affect an employer’s ability to conduct a lawful workplace investigation including one for suspected misappropriation of the employer’s intellectual property. However, an employer –  in conducting such investigation – may not force the employee or applicant to provide the username and password, password, or other authentication means to access the individual’s personal online account. Finally, an employer is not limited by the Act from conducting otherwise lawful monitoring of an electronic communications device that it provided to an employee or paid for (fully or partially).

The Act provides an employee or applicant a right to file a complaint with the Connecticut Labor Commissioner (but not a private right of action). It also provides for an award of attorneys fees and costs as well as civil penalties for a violation. An individual also may seek reinstatement, back wages, benefits, and other appropriate relief under the Act.

New Jersey passed a similar law, which went into effect December 1, 2013, covered in a Gibbons Employment Law blog. Employers should be familiar with the privacy laws, such as the Connecticut Act, in those jurisdictions where they operate and hire applicants.

For answers to any questions regarding this blog or with regard to social media in the employment context generally, please feel free to contact an attorney in the Gibbons Employment & Labor Law Department.