Governor Jerry Brown last week signed two new privacy laws that will go into effect January 1, 2013.  AB 1844 and SB 1349 prohibit employers, colleges and universities from requiring or asking prospective and current employees and students to disclose social media usernames and passwords.  It also prohibits requiring or requesting employees and students to log onto social media platforms in the presence of the employer or educational institution.  Governor Brown tweeted: “California pioneered the social media revolution.  These laws protect Californians from unwarranted invasions of their social media accounts.”

AB 1844

Public and private employers are now prohibited from requiring a job applicant or employee to provide usernames and passwords to their personal social media accounts such as Facebook or MySpace.  In addition, employers may not require an applicant or employee to access or log on to personal social media in the presence of the employer.  The law defines social media as including videos, still photographs, blogs, podcasts, instant and text messages, email, online services of accounts or website profiles or locations. 

Under AB 1844, employers can access usernames and passwords under two circumstances.  First, an employer can ask an employee to divulge personal social media if the employer reasonably believes it is relevant to an investigation of employee misconduct.  Second, an employer can ask an employee to disclose a username or  password for purposes of accessing an employer-issued electronic device. 

Finally, an employer may not discharge, discipline, threaten to discharge or discipline, or retaliate against an employee or applicant for refusing to provide their personal social media information. 

SB 1349

SB 1349 prohibits public and private colleges and universities from requiring current or prospective students or student groups to disclose their usernames and passwords for personal social media.  Like AB 1844, postsecondary educational institutions also may not require a student, prospective student or student group to access personal social media in the presence of the institution’s employee or representative.   

The new law does not affect an institution’s existing rights and obligations to protect against and investigate alleged student misconduct or violations of law.  The statute also does not preclude educational institutions from taking adverse action against a student, prospective student or student group for any lawful reason.

Finally, educational institutions may not suspend, expel, discipline, threaten to take any of those actions or penalize a student, prospective student or student group for refusing to comply with a demand to access personal social media or for usernames or passwords.

California employers, colleges and universities are encouraged to adopt or review existing social media policies to make sure they comply with these new privacy laws.  Our Los Angeles, San Francisco, Fresno, and San Diego offices are ready to assist and provide guidance on these issues if needed.