Shoulder Surfing - One More Reason for Buying EPLI
For those not familiar with the term, "shoulder surfing" in the workplace is the rough equivalent of "parent over shoulder" in the home. It happens when an employer asks the employee or applicant to log-in to their private social media account(s) - and then watches. And it is just one of the actions that can get an employer in trouble under new laws.
The emergence of social media laws governing the workplace is one of the hottest issues in 2013. How hot is it? Since 2012, at least 14 states have added a law to their codes. Maryland was the first, followed by Arkansas, California, Colorado, Delaware, Illinois, Michigan, Nevada, New Jersey, New Mexico, Oregon, Utah, Vermont and Washington.
No two laws are exactly alike, but there is a common theme. Employers may not require or request applicants or employees to provide access to or views of private social media accounts, nor may they retaliate or discriminate against those who refuse. Just a few of the state variations are:
- Applicants and Employees - New Mexico law protects only applicants.
- Investigations - Several states expressly permit employer access for investigations.
- Remedies - Fines and penalties, costs and attorneys’ fees are available to some degree, but Colorado, Nevada, Oregon and Washington permit an action to recover “actual damages” in some cases.
One positive change was that a private right of action to recover unlimited damages (including punitive damages) was removed from the New Jersey bill, thanks to the Governor’s conditional veto.
As to shoulder surfing? Most of the state laws prohibit the employer practice.
Employment Practices Liability Insurance (EPLI) generally protects employers from violation of privacy claims by applicants and employees, but the best first step for employers is to comply with these new laws. For an excellent resource, check out the Littler Mendelson website for an article titled, "Social Media Password Protection and Privacy - The Patchwork of State Laws and How It Affects Employers."
When it comes to private social media accounts, "don't ask" may be a best practice. So is buying an EPLI policy.