On September 14, 2023, New York’s Governor, Kathy Hochul, signed Assembly Bill 836 (“A836”) into law which prohibits employers from requesting or requiring access to personal accounts such as texts, emails, and mobile applications like WhatsApp from electronic devices. A836, which went into effect on March 12, 2024, also prohibits employers from discharging, disciplining, or failing to hire individuals who refuse to provide access to personal accounts and is subject to only a few exceptions.
Importantly, A836 only applies to personal accounts, which means employers can request or require access for accounts utilized for business purposes. For personal accounts, the law prohibits employers from requesting, requiring, or coercing any current employees or job applicants to disclose any username and password, or other authentication information for accessing a personal account from an electronic communications device. The law also prohibits requiring access to the personal account in the presence of the employer and reproducing information obtained through such prohibited access.
Notably, A836 contains a few exceptions whereby employers are allowed to request or require information from electronic devices. Specifically, employers are permitted to seek access to personal internet accounts if it is necessary to comply with the requirements of federal, state, or local law.
Employers may require employees to disclose their usernames, passwords, or other means of accessing “nonpersonal accounts” that provide access to the employer’s internal computer or information systems. A836 also allows employers to request or require employees to disclose their log-in information to accounts that were provided by employers and are used for business purposes. However, the employer must have provided the employee with prior notice of its right to request or require this information. Employers can also request or require employees to disclose their log-in information to an account the employer knows is used for business purposes. Additionally, the A836 permits employers to access “electronic communication” devices that the employer pays for – in whole or in part – when the employer’s payment for the device was conditioned on the employer retaining the right to access the device and the employee was given prior notice and “explicitly agreed” to such conditions. This agreement does not allow the employer to access any personal accounts on the device.
Finally, A836 allows employers to access, obtain, or provide information from an employee’s account to comply with a court order, and to restrict or prohibit employees from accessing certain websites while using the employer’s network or electronic communications devices.
For a printable PDF of this article, Click here.
