Law / United States / 
Hawaii
Uniform Employee and Student Online Privacy Protection Act: employers may not require an employee's online account login or content
2021 Haw. Sess. Laws Act 39 (H.B. 125) employee online accounts, sections -1, -2, -3 and -5, Uniform Employee and Student Online Privacy Protection Act
In force since .
A sensitive categories rule binding public and private bodies.
- Private right of action
- Yes
- Instrument type
- an act of a legislature
- Obligation class
- Prohibition, Security
What it requires
- If you are an employer, or its agent or designee, do not require, coerce or request an employee or prospective employee to disclose the login information for, or the content of, a protected personal online account, to alter its settings to make it more accessible to others, to access it in your presence, or to turn over an unlocked personal device to give access to it (section -3(a)(1)).
- Do not take, or threaten to take, adverse action against an employee for refusing such a requirement, coercion or request (section -3(a)(2)).
- When an employee shares specifically identified content for a permitted purpose, do not access or view unshared content, use the shared content only for that purpose, and do not alter it (section -3(c)).
- If you acquire an employee's login information through lawful network or device monitoring, do not use it to access the account or share it, make a reasonable effort to keep it secure, and dispose of it as soon as and as securely as reasonably practicable (section -3(d)).
These lines are LexLint's reading of the law's text.
What this law does
An employer, including its agent or designee, may not require, coerce or request an employee to disclose the login information for, or the content of, a protected personal online account, to alter the account's settings to make it more accessible to others, to access the account in the employer's presence, or to turn over an unlocked personal device to give access to the account.
An employee includes a prospective employee who has expressed interest in or applied for employment, an independent contractor, and an unpaid intern. An employer may not take, or threaten to take, adverse action against an employee for refusing such a requirement or request.
An employer that acquires an employee's login information through lawful monitoring of its network or employer-provided devices may not use it to access the account or share it, must make a reasonable effort to keep it secure, and must dispose of it as soon as, as securely as, and to the extent reasonably practicable.
The attorney general may bring a civil action for injunctive and other equitable relief and a civil penalty of up to $1,000 for each violation, not exceeding $100,000 for all violations caused by the same event. An employee may bring a civil action for injunctive and other equitable relief, actual and general damages, and costs and reasonable attorney's fees. Act 39 of 2021 took effect on its approval on .
Back to the example · Lint your app
Page updated .
us-hi-2021-haw-sess-laws-39-h-b-125-employee-onl