Effective July 28, 2013, Washington joined several states in prohibiting employers from seeking access to their employees’ or prospective employees’ private social-media accounts.

Washington’s law, codified as RCW 49.44, specifically prohibits employers from requesting employees’ user names and passwords and substantially restricts when employers may ask employees to reveal the content of such sites.

Restrictions
As such, employers may not:

1. Request, require, or coerce an employee to disclose login information for a personal social-networking account;
2. Request, require, or coerce an employee to access his or her account in the employer’s presence so that the employer can observe its contents;
3. Compel or coerce an employee to add someone as a contact associated with such an account;
4. Request or require that an employee alter a third party’s ability to access an account; or
5. Take an adverse action against an employee or applicant for refusing such acts.

What’s Not Restricted
Employers’ access to employer-provided electronic devices (smartphones, laptops, and tablets, for example); online services provided by the employer (including the employer’s intranet, website, Facebook site, and Twitter feed); or social media accounts are not subject to the law’s restrictions. The law also does not prohibit employers from asking for login or content information associated with a network, intranet, or other platform intended primarily for work-related information exchange, collaboration, or communication.

Finally, employers may still demand access the content of their employees’ private social media accounts when conducting certain investigations (although they may never request login information). For example, employers investigating alleged employee violations of state or federal laws, regulations, or employee-conduct rules may access the content of social media accounts. Employers may also access the content of social media accounts to investigate allegations that an employee has improperly transferred the employer’s proprietary or confidential information, or the employer’s financial data.

Inadvertently Receiving Information
Employers are not liable if they inadvertently receive login information via an employer-provided electronic device, but the employer may not use the information to access the employee's account. Beyond restricting employers’ ability to request or coerce from workers access to their private accounts, the new law does not regulate employers’ independent access to content of publicly-available personal accounts.

Right to Sue
The law allows employees or applicants to bring a civil action in state court for alleged violations, and would have the right to seeking an injunction against the employer. Employers that violate the law could be liable for damages, a statutory penalty of up to $500, and the employee or applicant’s attorneys' fees and costs. However, a court may award an employer reasonable expenses and attorneys’ fees if the employer prevails in a frivolous action.

Similar laws in Other States
This kind of legislation may become commonplace. Similar legislation has been introduced in at least three dozen states; Washington is the eighth to state to enact such a law this year, joining Arkansas, Colorado, Nevada, New Mexico, Oregon, Utah and Vermont.

Best Practice
Employers should review their hiring and investigation practices to ensure that employees and applicants are not asked for usernames and passwords for their private social media accounts except in the narrow circumstances recognized under the law. Questions regarding permissible access to social media accounts should be referred to an experienced labor and employment attorney to ensure compliance.