Oregon Says No to Employers Accessing Applicant and Employee Personal Social Media Accounts

by Proskauer Rose LLP

On May 22, 2013, Oregon's governor signed HB 2654, which amends the state's existing antidiscrimination statute to restrict employer access to applicants' and employees' personal password-protected social media[1] accounts. Oregon joins nine other states with similar laws: Maryland, Illinois, California, Michigan, Utah, New Mexico (which ostensibly applies to prospective employees only), Arkansas, Colorado, and Washington. The U.S. Congress and other state legislatures have proposed comparable legislation.

To understand the new Oregon law, which takes effect January 1, 2014, this alert discusses its coverage, prohibitions, exceptions, and remedies.[2]


The new Oregon law appears to incorporate the general "definitions" provision of the state's existing antidiscrimination statute. That provision expansively defines "employer" as any person in the state who, directly or through an agent, engages or uses the personal service of one or more employees, reserving the right to control the means by which such service is or will be performed. "Employee" – a term also expansive in scope – is defined by exclusion; that is, it does not include any individual employed by the individual's parents, spouse or child, or in the domestic service of any person.


Under the new Oregon law, it is an "unlawful employment practice" for an employer to:

  • Request or require that an employee or applicant disclose the "username and password, password, or other means of authentication" (hereinafter, "authentication information") used to access his or her personal social media account;

  • Compel an employee or applicant to add the employer or an employment agency to the list of contacts associated with his or her social media Web site; or

  • Compel an employee or applicant to access a personal social media account in the presence of the employer so as to enable the employer to view contents of the account that cannot be accessed without the account holder's authentication information.

An employer also may not take, or threaten to take, any action to discharge, discipline or otherwise penalize an employee (or fail or refuse to hire an applicant for employment) for engaging in any conduct protected under the new Oregon law. Moreover, as discussed in the "Remedies" section below, separate provisions of the state's existing antidiscrimination statute provide additional remedies and protections to employee whistleblowers and to employees and applicants who, for pursuing administrative remedies, are subject to alleged retaliation by an employer.


Notwithstanding the general ban on requesting disclosure of social media passwords, the new Oregon law permits an employer to require an employee to disclose authentication information used for accessing an account provided by the employer (or an account used on the employer's behalf).

In addition, nothing in the new law prevents an employer from:

  • Conducting an investigation, without requiring an employee to provide authentication information for his or her personal social media account, for the purpose of ensuring compliance with applicable laws, regulatory requirements or prohibitions against work-related employee misconduct based on the employer's receipt of specific information about the employee's activity on a personal online account or service;

  • In the course of a "permitted" investigation, requiring an employee, without providing authentication information used to access his or her personal social media account, to share content that has been reported to the employer that is necessary for the employer to make a factual determination on the matter;

  • Complying with state and federal laws, regulations and rules (including the rules of self-regulatory organizations); or

  • Accessing publicly available information about the employee or applicant through an online account.

Moreover, if an employer inadvertently receives authentication information for an employee's personal social media account through the use of an electronic device or program monitoring the use of the employer's network or employer-provided devices, the employer is not liable for possessing that information. Nevertheless, the employer may not use that information to access the employee's personal social media account.


The new Oregon law does not include a separate provision for remedies and, we assume, will incorporate the remedies available under the state's existing antidiscrimination statute. That statute permits aggrieved individuals to file a verified written complaint with the Commissioner ("Commissioner") of Oregon's Bureau of Labor and Industries ("Bureau") within a specified time frame – generally one year – of the alleged unlawful employment practice to obtain various forms of injunctive relief. An employer also may file a complaint with the Bureau if an employee fails to comply with the new Oregon law. In addition, the Commissioner or the Oregon Attorney General may, of his or her own accord, pursue a complaint with the Bureau against an employer believed to have committed an unlawful practice.

In general, the Bureau is tasked with taking all steps necessary to eliminate and prevent the practices prohibited in the state's existing antidiscrimination statute, including promoting voluntary affirmative action by employers. The Commissioner has the authority to perform investigations, encourage settlement, bring formal charges, provide injunctive relief and, in some cases (although not necessarily here), impose civil penalties.

It does not appear at this time that violations of the new Oregon law will give rise to a right of private action by aggrieved employees and applicants, with two possible exceptions. First, if an aggrieved person files a complaint with the Commissioner alleging an unlawful practice, the state's existing antidiscrimination statute protects that employee or applicant from retaliation. Second, the state's existing antidiscrimination statute also includes a whistleblower provision protecting an employee from discrimination and retaliation for reporting, in good faith, information that the employee believes is evidence of a violation of state law. Accordingly, it appears that, by amending the state's existing antidiscrimination statute, the new Oregon law may allow a whistleblower employee, as well as an employee or applicant alleging retaliation for pursuing a complaint with the Commissioner, to bring a civil action for remedies that include injunctive and equitable relief, compensatory damages, punitive damages, costs, and reasonable attorneys' fees.


The new Oregon law's coverage, prohibitions, exceptions, and remedies are similar to the social media laws adopted in other states, as well as the legislation pending in the U.S. Congress and numerous state legislatures. Given the breadth and ambiguity of some of these new laws, employers should consider whether to restrict managers working in such jurisdictions from sending Facebook friend requests, requests to connect through LinkedIn, or similar requests to subordinates or other employees. Indeed, the new Oregon law's prohibition of compelling an employee or applicant to add the employer to his or her list of contacts – a prohibition also found in the social media laws of Colorado, Washington, and Arkansas – seems to suggest that such a rule might be prudent. Ironically, the overbreadth of these laws may have negative repercussions for employees who wish to utilize social media for professional purposes and desire to have connections with work colleagues, including managers, who now may be hampered in their use of these sites.

*   *   *

1] The new Oregon law defines "social media" as an electronic medium that allows users to create, share, and view user-generated content including, but not limited to, uploading or downloading videos, still photographs, blogs, video blogs, podcasts, instant messages, electronic mail or Internet Web site profiles or locations.

[2] Although the new Oregon law ostensibly amends the state's existing antidiscrimination statute, it does not specify which section(s) that it, in fact, amends. Given this ambiguity, there are certain aspects of the new Oregon law – such as the scope of its coverage, protections, and remedies – that are not entirely clear and could be subject to varying interpretations. As such, certain assumptions made in this alert may change should more information become available when the new Oregon law is codified into the state's existing antidiscrimination statute. In such case, we will issue an update to this alert to account for any changes.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Proskauer Rose LLP | Attorney Advertising

Written by:

Proskauer Rose LLP

Proskauer Rose LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.