Internet Privacy Protection Act, employers and personal internet accounts

The Internet Privacy Protection Act bars an employer from requesting an employee or an applicant for employment to grant access to, allow observation of, or disclose information that allows access to or observation of the employee's or applicant's personal internet account (MCL 37.273(a)).

The Act bars an employer from discharging, disciplining, failing to hire or otherwise penalizing an employee or an applicant for employment for failing to grant that access or to allow or disclose it (MCL 37.273(b)). Employer means a person, including a unit of state or local government, engaged in a business, industry, profession, trade or other enterprise in Michigan, and includes an agent, representative or designee of the employer (MCL 37.272(c)).

Access information means user name, password, login information or other security information that protects access to a personal internet account (MCL 37.272(a)). A personal internet account is an account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, utilize or edit the user's account information, profile, display, communications or stored data (MCL 37.272(d)).

The Act does not prohibit an employer from requesting or requiring an employee to disclose access information to gain access to or operate an electronic communications device the employer paid for in whole or in part, or an account or service the employer provided that the employee obtained through the employment relationship or uses for the employer's business purposes (MCL 37.275(1)(a)).

The Act does not prohibit an employer from disciplining or discharging an employee for transferring the employer's proprietary or confidential information or financial data to an employee's personal internet account without the employer's authorization (MCL 37.275(1)(b)).

The Act does not prohibit an employer from conducting an investigation, or requiring an employee to cooperate in one, where there is specific information about activity on the employee's personal internet account relating to legal compliance or work-related employee misconduct, or where the employer has specific information about an unauthorized transfer of its proprietary information, confidential information or financial data to that account (MCL 37.275(1)(c)).

The Act does not prohibit an employer from restricting an employee's access to certain websites while the employee uses an electronic communications device the employer paid for in whole or in part or the employer's network or resources, in accordance with state and federal law (MCL 37.275(1)(d)).

The Act does not prohibit an employer from monitoring, reviewing or accessing electronic data stored on an electronic communications device the employer paid for in whole or in part, or traveling through or stored on the employer's network, in accordance with state and federal law (MCL 37.275(1)(e)).

The Act does not prohibit or restrict an employer from complying with a duty to screen employees or applicants before hiring, or to monitor or retain employee communications, that is established under federal law or by a self-regulatory organization (MCL 37.275(2)).

The Act does not prohibit or restrict an employer from viewing, accessing or using information about an employee or applicant that can be obtained without any required access information or that is available in the public domain (MCL 37.275(3)). The Act does not create a duty for an employer to search or monitor the activity of a personal internet account (MCL 37.277(1)).

An employer is not liable under the Act for failing to request or require that an employee or an applicant for employment grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account (MCL 37.277(2)). A person who violates section 3 or 4 of the Act is guilty of a misdemeanor punishable by a fine of not more than $1,000.00 (MCL 37.278(1)).

An individual who is the subject of a violation of the Act may bring a civil action to enjoin a violation of section 3 or 4 and may recover not more than $1,000.00 in damages plus reasonable attorney fees and court costs (MCL 37.278(2)). The individual must make a written demand of the alleged violator for not more than $1,000.00, with reasonable documentation of the violation, not later than 60 days before filing a civil action for damages (MCL 37.278(2)).

It is an affirmative defense to an action under the Act that the employer acted to comply with requirements of a federal law or a law of this state (MCL 37.278(3)). The Act took effect immediately on December 28, 2012.