On April 22, 2013, Arkansas' governor signed H.B. 1901, continuing the national momentum to prohibit employers from requesting or requiring prospective and current employees to disclose their username and password to their personal social media accounts. Maryland, Illinois, California, Michigan, Utah, and New Mexico have similar laws – although New Mexico's ostensibly covers current employees only – with dozens more state legislatures considering similar legislation. To assist employers in understanding the new Arkansas law, this alert discusses its coverage, prohibitions, exceptions, and remedies.

Coverage

The coverage of the new Arkansas law is expansive. An "employer" is any person or entity engaged in a business, industry, profession, trade, or other enterprise in the state (or a unit of state or local government) including, without limitation, an agent, representative, or designee of the employer. An "employee" is an individual who provides services or labor for wages or other remuneration for an employer.

The new Arkansas law defines "social media account" as a personal account with an electronic medium or service where users may create, share, or view user-generated content, including without limitation: (i) videos; (ii) photographs; (iii) blogs; (iv) podcasts; (v) messages; (vi) emails; or (vii) website profiles or locations. The term also includes, without limitation, an account established with Facebook, Twitter, LinkedIn, MySpace, or Instagram.

Prohibitions

Pursuant to the new Arkansas law, an employer may not require, request, suggest, or cause a current or prospective employee to:

• disclose the username and password to his or her social media account;
  
  
• add an employee, supervisor, or administrator to the list or contacts associated with his or her social media account; or
  
  
• change the privacy settings associated with his or her social media account.

Moreover, an employer may not:

• take action against or threaten to discharge, discipline, or otherwise penalize a current employee for exercising his or her rights under the new law; or
  
  
• fail or refuse to hire a prospective employee for exercising his or her rights under the new law.

Exceptions

Not covered under the new Arkansas law are accounts:

• opened by an employee at the request of an employer;
  
  
• provided to an employee by an employer (such as a company email account or other software program owned or operated exclusively by an employer); or
  
  
• set up by an employee (1) on behalf of an employer, or (2) to impersonate an employer through the use of the employer's name, logos, or trademarks.

Moreover, the employer is not liable for having an employee's username, password, or other login information to his or her social media account if obtained inadvertently through the use of an employer-provided electronic device or a program monitoring an employer's network. The employer, however, still may not use that information to gain access to the employee's social media account.

In addition, the new Arkansas law does not prohibit an employer from viewing information about a current or prospective employee publicly available on the Internet, nor does it prevent an employer from complying with the requirements of federal, state, or local laws, rules, or regulations (or the rules or regulations of self-regulatory organizations).

The new Arkansas law also permits an employer to request that an employee disclose the username and password to his or her social media account if there is a reasonable belief that the employee's account activity is relevant to a formal employer investigation (or related proceeding) into an employee's possible violation of federal, state, or local laws or regulations, or the employer's written policies.

Remedies

By amending Title 11 of the Arkansas Code, the new Arkansas law provides for certain penalties to be enforced by the Director of the Arkansas Department of Labor ("Director"). An employer is guilty of a misdemeanor for violating, or failing or refusing to comply with, the new Arkansas law, a lawful order of the Director, or a court judgment or decree made in connection with the new Arkansas law for which no penalty has been otherwise provided. Upon conviction, the employer is to be fined for each offense no less than ten dollars ($10.00) but no more than one hundred dollars ($100), and/or imprisoned for a period not exceeding six (6) months. Pursuant to the new law, each day the violation, omission, failure, or refusal continues is a separate offense.

In lieu of these penalties, any penalty except imprisonment may be assessed in a civil action in the name of the State of Arkansas. Under the new law, the civil action is to afford an expeditious hearing and receive precedence over all other matters (except older matters of the same nature). Any sums recovered therefrom are to be deposited with the Treasurer of State in the same manner as provided by law for other moneys of the state.

Takeaway

The new Arkansas law is similar in its coverage, prohibitions and exceptions to many of the other laws in effect, as well as the proposals pending in the U.S. Congress and state legislatures across the country. With respect to penalties, however, employers should note that not only does the new Arkansas law provide for modest fines common to other laws and proposals, but it unconventionally allows for possible imprisonment. Although it is unlikely that a violation of the new law could rise to such a level of punishment, it is a warning to employers across the country that, as the patchwork of social media restrictions continues to grow, they must proceed with great caution when monitoring an applicant's or employee's use of social media.

* * *

If you have any questions or concerns regarding these new laws or related developments, please contact your Proskauer lawyer or any co-chair of the Employment Law Counseling & Training Group.

Employment Law Counseling Group Co-Chairs
Katharine H. Parker, Partner
Leslie E. Silverman, Partner
Allan H. Weitzman, Partner
Fredric C. Leffler, Senior Counsel
Marc A. Mandelman, Senior Counsel

Authors of this alert: Katharine H. Parker & Daniel L. Saperstein