New Jersey has enacted restrictions on the ability of employers to access employees’ social media accounts, becoming the twelfth state to enact such legislation. More than 30 state legislatures have considered bills on the topic in 2013, according to the National Conference of State Legislatures.

New Restrictions in New Jersey

New Jersey’s new law, signed by Governor Chris Christie on August 29 and effective December 1, generally prohibits employers from requiring or requesting that employees or prospective employees “provide or disclose any user name or password, or in any way provide the employer access to, a personal account through an electronic communications device.” Employers also may not require individuals to waive the law’s protections or retaliate against individuals who refuse prohibited requests or file complaints with the Commissioner of Labor and Workforce Development about violations of the law. An earlier version of the law, passed by the legislature but vetoed by Gov. Christie, also would have allowed aggrieved individuals to file civil suits for injunctions, damages, and reasonable attorneys’ fees and court costs.

As enacted, the law defines a “personal account” as a social-networking account, service, or profile used “exclusively for personal communications unrelated to any business purposes of the employer,” and the definition specifically excludes accounts “maintained, used or accessed by a current or prospective employee for business purposes of the employer or to engage in business related communications.” The law also contains exceptions allowing employers to conduct investigations based on the receipt of specific information about legal violations or other work-related misconduct, and the law specifically notes that employers are free to view, access, and use any information “that can be obtained in the public domain.”

Late last year, New Jersey enacted similar restrictions on the ability of college and university officials to demand access to — or even inquire about — student’s personal online accounts.

Continued State Interest

Since the issue first drew legislative attention in 2012, 12 states have passed laws restricting to varying degrees employers’ access to employees’ personal social media accounts. Maryland, Illinois, California, and Michigan enacted such laws in 2012. So far in 2013, in addition to New Jersey’s law, similar laws have been passed in Utah, New Mexico, Arkansas, Colorado, Nevada, Oregon, and Washington state. A number of states — including California, Delaware, Utah, Arkansas, and Oregon, among others — have enacted similar provisions protecting the personal online accounts of college and university students.

Although the basic goals of these laws are similar, the laws’ particular provisions contain potentially important distinctions. For instance, California’s employer-focused law does not contain an explicit definition or other provisions addressing the extent to which “personal social media” accounts are protected if they are used to any extent for business-related purposes, though the law does allow employers to require employees to disclose login information for “employer-issued electronic device[s].” In contrast, New Jersey’s law limits “personal” accounts to those used “exclusively for personal communications unrelated to any business purposes,” while Oregon’s law specifically allows employers to require employees to provide access to any “account provided by, or on behalf of, the employer or to be used on behalf of the employer.” Similarly, Illinois recently amended its employer-focused law, originally enacted in 2012, to give employers greater access to “professional,” as opposed to “personal,” social-media accounts.

In addition, some of the laws not only protect employees from employer demands to disclose login information but also prohibit employers from requiring employees to change their privacy settings, add employers to their contact lists, or access their personal social media accounts in an employer’s presence.