When in doubt, employers should proceed with caution and consult with their lawyers if they want to avoid being slapped with a suit for violating Rhode Island’s tough new social media privacy law.

That’s the advice of employment and social media attorneys who have tracked the legislative path of the Employee Social Media Privacy Act, which Gov. Lincoln D. Chafee recently signed into law.

The statute prohibits employers from forcing employees and job applicants to disclose passwords, user names and content from their accounts with online services such as Facebook and Twitter.

What should grab every employer’s attention is that the law specifically allows employees and job applicants to sue for damages for violations of their social media privacy rights.

“Trying to micromanage social media connections is risky in Rhode Island now,” warned Brian J. Lamoureux, an employment and social media lawyer with Pannone Lopes, Devereaux & West in Providence, Rhode Island.

Password protection

The Employee Social Media Privacy Act was part of a bill passed by the Rhode Island General Assembly in June that included two other new digital privacy laws.

The Student Social Media Privacy Act provides students social media protections similar to those enjoyed by workers under the employment law. In addition, the Student Data-Cloud Computing Act bars cloud-computing providers used by educational institutions in the state from using student data for advertising or any other any commercial purpose.

State lawmakers patterned the laws on a California statute, considered one of the strongest such laws in the nation.

The employment privacy law, R.I.G.L. §28-56, governs an employer’s access to a “social media account,” which is broadly defined to include electronic services, accounts and content, including Internet website profiles, email, blogs, podcasts, and instant and text messages.

Under the law, social media password requests by an employer are prohibited. Specifically, §28-56-2(1) states that no employer shall “[r]equire, coerce or request an employee or [job] applicant to disclose the password or any other means for accessing a personal social media account.”

There is no ambiguity in that section of the new law, said Providence attorney Linn Foster Freedman, who leads the privacy and data protection group for Nixon Peabody in Providence.

“It’s pretty straightforward,” Freedman said. “If someone’s an applicant or someone is an employee, you can’t ask them for their password to get access to their Facebook account, their LinkedIn account, Twitter or any other social media account.”

Lamoureux said compliance with the password protection language of the measure should be the least troublesome aspect of the new law for most Rhode Island employers given the negative publicity over password requests in recent years.

“That’s about as common sense of a legislative fix as there is,” Lamoureux said. “Anyone who asks a job candidate for a password these days is just asking for trouble and maybe signaling that it’s not a great place to work.”

But Freedman said employers need to know that the law also prohibits them from obtaining an employee’s password by less direct means.

“Employers need to be aware that they can’t ask a co-employee, a friend or someone else for that password [either],” Freedman said. “Basically, asking employees, employees’ friends, family or job applicants for social media passwords is a no-no.”

The statute further forbids an employer from requesting or requiring an employee to access a personal social media account in the presence of the employer or a supervisor. Likewise, employers cannot force an employee to divulge any personal social media account information.

The law also closes the door to demands for social media access by the employer.

Section 28-56-3 states that an employer cannot compel an employee or job applicant to “add anyone, including the employer or their agent, to their list of contacts associated with a personal social media account.”

Moreover, employers cannot force an employee or job applicant to alter their account settings to allow third parties to view the contents of a social media site.

“Employers need to be careful about how people are forcing or otherwise coercing social media connections from co-workers,” Lamoureux said. “You can’t require, request or coerce someone into ‘friending’ another employee on Facebook.”

Under the law, employers are prohibited from discharging or disciplining an employee for refusing to divulge social media information. Similarly, an employer violates the law by refusing to hire someone because they refused to divulge social media information.

Important exceptions

The social media privacy law contains some important exceptions benefiting employers, noted Matthew R. Plain, an employment lawyer with Barton Gilman in Providence.

“The law doesn’t take away the tool whereby the employer can view ‘publicly available’ information about an employee or job applicant,” Plain said. “That’s specifically excepted under the act.”

The fact that you have a Facebook account is public, Freedman explained.

“If you Google someone’s name and they have a LinkedIn or Facebook account, it will come up,” she said. “That doesn’t mean that you have access to the account to see the pictures or the content without actually being a ‘friend.’”

In addition, the law specifically excludes from its coverage social media accounts opened primarily for the employer’s benefit.

Section 28-56-2(3) provides a key exception that allows an employer to compel an employee to reveal personal social media account information “when reasonably believed to be relevant to an investigation of allegations of employee misconduct or workplace-related violation of applicable laws and regulations.”

Freedman warned that employers should be cautious about exploiting that exception to investigate something like an allegation of sexual harassment, particularly without first seeking the advice of counsel.

“That’s a risky area that should be looked at very carefully before going that route,” Freedman said. “I would be very, very careful about that exception.”

Plain agreed that employers should tread carefully and call their lawyers when in doubt.

“What’s unclear is how broad is an employer’s ability to request information regarding a personal social media account when there’s an investigation of allegations of employee misconduct,” Plain said.

“Allegations or investigations of employee misconduct can mean a lot of things. Does that give the employer the ability to go to John and say, ‘Show me your Facebook account so I can see if you were giving your co-worker a hard time?’ Those will be things that, at some point, will need to be decided by a judge.”

On the other hand, Plain said, there would be more justification for an employer to compel disclosure in cases of imminent injury or death.

He also pointed out that an employer that does obtain access to social media content may find itself assuming duties it did not want.

“When you don’t have this private information, there’s no burden on you as the employer to take any particular action,” Plain said. “Once you learn that information, it may affect your obligations down the road depending on what you find. So I would say to the employer, ‘Be careful what you wish for.’”

Civil remedies

Section 28-56-6 authorizes courts to award “declaratory relief, damages and reasonable attorneys’ fees and costs” to employees and job applicants suing for violations of their statutory social media privacy rights. The law also allows plaintiffs to seek injunctive relief.

Both Lamoureux and Plain said that the “damages” allowed under the statute likely would include punitive damages.

But Lamoureux predicted that the issue of damages will be problematic for those claiming an employer violated their privacy rights under the statute.

“Let’s say I supervise you and I harass you every Monday morning by saying, ‘I need you to accept my ‘friend’ request so I can see the pictures that you post,’” Lamoureux said. “That is violative of the statute, but how do you prove damages? You can file a lawsuit to get an injunction to stop me from doing that, and you can make me pay your attorney fees, but I don’t know how that puts money in your pocket.”

Given the problem of proving actual damages in cases in which there may not be a distinct adverse employment action like a demotion, Lamoureux speculated that the first lawsuits under the new law will be brought by unions or groups of employees seeking injunctive relief to stop a workplace practice.