Social Media Accounts are Off Limits in Oregon

The new legislation defines “social media” as an electronic medium that allows users to create, share and view user-generated content, including uploading or downloading videos, still photographs, blogs, video blogs, podcasts, instant messages, electronic mail or internet website profiles or locations.

The law prohibits five practices as unlawful employment practice. Employers may not:

1. Require or request an employee or applicant to disclose or provide access to his or her personal social media account through username, password, or other authentication means.
2. Compel an employee or applicant to add the employer or employment agency to his or her list of contacts associated with the social media website.
3. Compel an employee or applicant to access a personal social media account in the employer’s presence and in a manner that enables the employer to view the contents of the account that are visible only when using the account holder’s username, password, or other authentication means.
4. Take, or threaten to take, any adverse action if an employee refuses to disclose, or provide access to a personal social media account.
5. Fail or refuse to hire an applicant because he or she refuses to disclose or provide access to a personal social media account, to add the employer to the list of contacts associated with the account, or view the contents of the account that are visible only when using the account holder’s username, password, or other authentication means.

Employers are not restricted from conducting investigations to ensure compliance with laws and work-related policies. But, when doing so, employees must not be compelled to provide access to personal social media accounts. The employee may be required to share content if it is necessary for the employer to make a factual determination about a matter being investigated. Also, employees are required to disclose user name, password, or other means to access an account provided by, or on behalf of, the employer or to be used on behalf of the employer.

An employer is not liable for having private account information if it is obtained unintentionally while monitoring its network or electronic device provided to an employee. Although, the employer may not use the information to access an employee’s personal social media account.

Nothing in the bill prohibits employers from accessing information available to the public about an employee or applicant through an online account.

The text of the bill is available here: http://www.leg.state.or.us/13reg/measpdf/hb2600.dir/hb2654.en.pdf