Personal Online Account Privacy Protection Act: employers may not require an employee's or applicant's account credentials

Under Revised Statutes 51:1953(A)(1), an employer may not request or require an employee or applicant for employment to disclose any username, password or other authentication information that allows access to the employee's or applicant's personal online account. Under Revised Statutes 51:1953(A)(2), an employer may not discharge, discipline, fail to hire, or otherwise penalize or threaten to penalize an employee or applicant for failure to disclose that information.

Under Revised Statutes 51:1952(3), an employer includes a unit of state or local government engaged in a business, industry, profession, trade or other enterprise in this state, and an agent, representative or designee of the employer. A personal online account is an online account that the employee, applicant for employment, student or prospective student uses exclusively for personal communications unrelated to any business purpose of the employer or educational institution.

Under Revised Statutes 51:1953(B)(1), an employer may still request or require authentication information to gain access to or operate a device it paid for or supplied in whole or in part, or an account or service it provides or that is used for its business purposes.

Under Revised Statutes 51:1953(B)(3) and (4), an employer may conduct an investigation, and require an employee or applicant to cooperate, where it has specific information about activity on the personal online account bearing on compliance with law or work-related misconduct, or about an unauthorized transfer of its proprietary information, but without obtaining the username and password.

Under Revised Statutes 51:1953(C), an employer that inadvertently receives an employee's or applicant's authentication information through a program that monitors its network or an employer-provided device is not liable for having it but may not use it to access the personal online account.

Under Revised Statutes 51:1955, the chapter creates no duty for an employer or educational institution to search or monitor the activity of a personal online account, and neither is liable under the chapter for failing to request or require disclosure of the information that gives access to one. The chapter took effect on August 1, 2014.