On April 8, 2014, Gov. Scott Walker added Wisconsin to the short but growing list of states to enact social media privacy legislation since 2012. The Wisconsin Social Media Protection Act (the Act)1 protects individuals from invasive searches for private social media content by employers, educational institutions, and landlords. This article explores the history leading up to passage of the Act, the restrictions and exceptions contained in Wisconsin’s law, and strategies for all affected individuals and entities in light of the new law.
‘Trending’ Legislation
In early 2012, news reports began to surface describing employment applicants who were asked by employers to disclose social media account information as part of the application process.2 These requests reportedly sought not only the applicants’ login identification but also their passwords. Other reports described individuals who were asked to access their profiles and to display to an interviewer everything the account contained. Individuals describing such incidents explained that they felt compelled to comply or otherwise risk losing any chance to obtain the position.
Public response was swift. States quickly began passing laws to prohibit this practice. In 2012, California, Illinois, Maryland, and Michigan passed legislation prohibiting employers from asking for an applicant’s or employee’s social media login and password information.3 In the same year, several states addressed similar conduct by schools and universities. California, Delaware, Michigan, and New Jersey passed laws prohibiting educational institutions from asking students and prospective students for their social media login and password information.4
The trend of state-based social media legislation continued through 2013 and into 2014. In 2013, Arkansas, Colorado, Nevada, New Mexico, Oregon, Utah, Vermont, and Washington passed employer legislation.5 In the same year, Arkansas, New Mexico, Oregon, and Utah passed laws placing similar restrictions on educational institutions. In 2014, state legislators continue to act, with social media-related legislation introduced or pending in at least 28 states and passed in three states, including Wisconsin.6
The Wisconsin Act
Readers might be surprised to learn that the term “social media” does not appear anywhere in the language of the Act. Rather, the Act protects an individual’s “personal Internet account.” The Act defines a personal Internet account as “an Internet-based account that is created and used by an individual exclusively for purposes of personal communication.”7 This broad definition may also implicate other common Internet services, such as Google’s Gmail or Yahoo! Mail.
Another key term under the Act is “access information.” The Act places restrictions on the ability to obtain information necessary to access a personal Internet account. The Act defines access information as “a user name and password or any other security information that protects access to a personal Internet account.”8 Thus, information such as “your mother’s maiden name” and “the street you grew up on” that may be relevant to retrieving a password also is protected.
Jesse R. Dill, Marquette 2010, practices employment law with Walcheske & Luzi LLC, Brookfield and Appleton, and is cochair of the Milwaukee Bar Association Labor and Employment Law Section. He assists clients with all aspects of employment law, including compliance counseling and litigation.
Although the Act generally follows the form of social media laws passed by other states, Wisconsin is unique in one significant respect. While several other states’ laws restrict only employers and educational institutions, Wisconsin’s law places limits on landlords as well.9
General Restrictions
The Act generally creates two basic restrictions for employers, educational institutions, and landlords: 1) it prohibits directly or indirectly accessing an individual’s private social media content; and 2) it prohibits retaliating against an individual for asserting rights under the Act.10 For employers, these protections apply to applicants and current employees. Likewise, students and prospective students are protected from access by educational institutions, and tenants and prospective tenants are protected from access by landlords.11
Widely Applied Exceptions
Although the Act prohibits access to an individual’s private social media content, some exceptions allow access to protected information in certain circumstances. A limited number of these exceptions apply broadly to employers, educational institutions, and landlords, while the majority of exceptions are specific to employers.
There are no restrictions on viewing or accessing information about an individual that can be obtained in the public domain.12 Thus, the Act only protects information that an individual takes steps to keep private.
Employers and educational institutions may require an individual to disclose information to access a device, account, or service they provide to the individual.13 Although this exception allows access to a tablet, laptop, or smartphone that the employer or educational institution provides to an individual, a personal social media account accessed through the device is still protected.
“The Act only protects information that an individual takes steps to keep private.”
Further, employers, educational institutions, and landlords may connect with individuals through social media without violating the Act. That is, a supervisor may accept a Facebook “friend” request from an employee. The Act was amended during the legislative process to clarify that inquiries or requests are prohibited only if employment, admission or enrollment, or tenancy is conditioned on the inquiry or request.14 The purpose of this amendment was to ensure that the Act allows for employers to “friend” employees on Facebook.15
Employer-Specific Exceptions
Several additional exceptions under the Act apply only to employers.16 The Act does not prohibit an employer from disciplining or terminating an employee for transferring proprietary, confidential, or financial information to an employee’s social media account;17 restricting employee access to certain Internet sites on an employer’s device or network;18 screening or monitoring that is required under state or federal law;19 and requesting or requiring an individual to disclose his or her personal email address.20
Perhaps most significantly, employers may review private content to investigate suspected misconduct that occurs through social media. However, an employer must establish that it has “reasonable cause” to believe employment-related misconduct occurred before gaining extended-review privileges.21 Although employers may investigate when there is reasonable cause to do so, the information they may seek from a protected social media account is limited. Investigating employers may only require an employee to grant access to or allow the employer to review or observe the individual’s social media account.22 Employers are still restricted from asking for the login and password information to the account.23
Enforcement
Individuals familiar with state discrimination-charge proceedings will recognize similarities in the Act’s enforcement provisions. Individuals who allege violations of the Act against employers or landlords will proceed with the same Wisconsin Department of Workforce Development (DWD) complaint, investigation, and hearing proceedings that are already in place for charges of discrimination under the Wisconsin Fair Employment Act (WFEA)24 and the Wisconsin Fair Housing Act (WFHA).25 Students, prospective students, and educational institutions will proceed down the same administrative path established by the WFEA.26 Individuals must file a complaint against an employer or educational institution within 300 days27 or against a landlord within one year, or their claims will be barred.28
“Wisconsin is unique in one significant respect. While several other states’ laws restrict only employers and educational institutions, Wisconsin’s law places limits on landlords as well.”
Complaint-processing mechanisms under the Act are identical to those already in place for processing employment discrimination claims (for social media-related complaints against employers or educational institutions) or housing discrimination claims (for social media-related complaints against landlords).29 Remedies against employers include back pay, front pay,30 and attorney fees and costs.31 The Act also makes the same remedies available to address violations by educational institutions. Remedies against landlords include injunctive relief, equitable relief, forfeiture up to $10,000 for first-time offenders, forfeiture up to $25,000 or $50,000 for repeat offenders, and attorney fees and costs.32 Additionally, the Act provides for personal liability up to $1,000.33
Interaction with Other State and Federal Laws
All entities and individuals subject to the Act should keep in mind that other laws might afford additional or supplemental protections for social media content.
Equal Opportunity Laws. Publicly available information on social media might relate to an individual’s protected-class status under many equal opportunity laws. Employers must consider laws such as the WFEA,34 Title VII of the Civil Rights Act of 1964,35 the Americans with Disabilities Act,36 and the Age Discrimination in Employment Act.37 Laws prohibiting unlawful discrimination in educational settings include the Wisconsin Pupil Nondiscrimination Law,38 Title IX of the Education Amendments of 1972,39 Title VI of the Civil Rights Act of 1964,40 and the Rehabilitation Act of 1973.41 Landlords should also be aware of protected-class categories under the WFHA42 and the federal Fair Housing Act.43
For example, an employee might publicly post pictures from his or her marriage to a same-sex partner. Sexual orientation is a protected-class category under the WFEA. If an employer made the decision not to hire that individual because of the individual’s sexual orientation, which an employer discovered through a review of information in the public domain, that decision would be unlawful discrimination under the WFEA. Although voluntary friending is permissible under the Act, the information a decision-maker might learn related to a protected-class status category may be cause to prohibit certain individuals from accepting or submitting friend requests with lower-level employees.
Other Federal Laws. The Act complements protections afforded by federal law through the Stored Communications Act (SCA).44 The SCA prohibits accessing electronic communications without authorization or exceeding authorization to access electronic communications.45 The SCA applies to anyone accessing an individual’s social media or personal email account. Under the SCA, an individual may recover damages, including reasonable attorney fees, through civil litigation.46
The National Labor Relations Act (NLRA) also should be a prominent consideration when employers contemplate reviewing and responding to employee social media activity. Section 7 rights under the NLRA apply to all employees, whether unionized or not. These protections can extend to conduct such as employees’ discussion of working conditions on social media.47 In recent years, the general counsel of the National Labor Relations Board, the federal agency that administers the NLRA, has closely scrutinized how employer attempts to regulate social media might affect employee Section 7 rights.48
Strategies for Complying with the Act
Some best-practice tips and strategies will help authorities comply with the Act and attorneys investigate potential violations while navigating the Facebook era.
Strategies for Employers, Educational Institutions, and Landlords. Entities that currently evaluate applicant social media accounts as part of the hiring, admission, or application process should immediately analyze whether that policy complies with the Act. Similarly, entities should examine any policy or practice that calls for monitoring current employee, student, or tenant social media accounts to make sure it complies with the Act.
“Employers may review private content to investigate suspected misconduct that occurs through social media.”
Employers, educational institutions, and landlords that continue to lawfully review social media content should detail their policies in writing. A written policy can help ensure a consistent practice is followed. Although specific circumstances should always be considered, basic policy language might prohibit those participating in the decision-making process from reviewing social media information.
For example, an employer’s policy could state, “Employees who participate in the Company hiring process, such as candidate interviews, may not request access to or review an applicant’s social media profile while the individual remains in consideration for employment with the Company. This restriction includes accepting or submitting friend requests on Facebook. Any necessary review of social media information will be coordinated by Human Resources.” Similar language could be tailored for a leasing company, school, or university.
Moreover, entities should ensure that social media account information is reviewed only by individuals who will not make any final decisions. That individual should follow a directive of specific information that will be reported following such review. For example, a landlord may direct an employee to search for prospective tenants’ public social media content limited to evidence of damage caused to prior rental units. The employee should be directed to report to the final decision maker only about materials relevant to the specific issue.
Additional Strategies for Employers. Employers investigating allegations of an existing employee’s workplace misconduct that involve social media accounts must establish “reasonable cause” to review private social media content. The Act does not provide any help to define reasonable cause. Employers may attempt to establish reasonable cause to investigate protected content through public social media content, statements or information volunteered by employees, or employee testimony received through interviews. An employer should document its basis for reasonable cause to support further inquiry by the DWD.
Once an employer establishes reasonable cause to review an employee’s private social media content, the permitted parameters of the employer’s investigation still are limited. The Act only allows an investigating employer to request the employee login to an individual’s account for the employer to review or for the employer to observe while an employee navigates the account.49 If review of profile content takes place on an employer’s devices, an employer might want to take additional steps to further limit the potential for liability based on information the employer could arguably retain as part of such review. These steps include disabling, explaining, and documenting any computer or network settings that could retain password information on the employer’s devices.
Educational Institutions and Individual Misconduct
The Act does not contain an exception, similar to the exception for employers, for schools or universities seeking to investigate bullying complaints or other alleged misconduct to request or require access information from students. Instead, administrative staff should ensure that any request for access information or to allow observation of an account clearly includes that the request is not conditioned on enrollment in the institution. Social media services, such as Facebook, may also have reporting methods for those services to investigate and address inappropriate content.
Tips for Individuals
Attorneys presented with a situation in which an individual claims a violation of the Act should familiarize themselves with the information the particular social media service provides. Facebook can provide a significant amount of information without the need of a subpoena or other court order. As quickly as possible after becoming aware that a violation of the Act potentially has occurred, an individual should download a copy of his or her Facebook account. The information provided by Facebook includes the internet protocol (IP) address of successful logins to the account. An IP address that varies from the individual’s normal-access IP addresses at the time of an interview might help support any claim. Other social media services may provide similar information if requested. An attorney who thoroughly understands these processes can easily and quickly find evidence relevant to the client’s claim.
Conclusion
The Wisconsin Social Media Protection Act added privacy protections to popular Internet services. Employers, educational institutions, and landlords must take care to ensure that information any entity seeks does not infringe on these protections.
Endnotes
1 The legislation was given this name by its sponsors. See Melissa Sargent & Garey Bies, Bipartisan Bill Protects Social Media Accounts, Milwaukee J. Sentinel (Aug. 31, 2013).
2 Doug Gross, ACLU: Facebook Password Isn’t Your Boss’ Business, (March 22, 2012).
3 National Conference of State Legislatures, Employer Access to Social Media Usernames and Passwords 2012 Legislation, (last update Jan. 17, 2013).
4 Id.
5 National Conference of State Legislatures, Employer Access to Social Media Usernames and Passwords, (as of June 9, 2014).
6 Id. Federal legislation on this topic has not passed. See H.R. 5050, 112th Congress (2011-2012), H.R. 537, 113th Congress (2013-2014).
7 Wis. Stat. § 995.55(1)(d).
8 Wis. Stat. § 995.55(1)(a).
9 See Wis. Stat. § 995.55(4).
10 Wis. Stat. § 995.55(2)(a), (3)(a), (4)(a).
11 Wis. Stat. § 995.55(2)(a), (3)(a), (4)(a).
12 Wis. Stat. § 995.55(2)(b)6., (3)(b)2., (4)(b).
13 Wis. Stat. § 995.55(2)(b), (3)(b).
14 Assembly Amendment 1 (Jan. 21, 2014).
15 Jason Stein, Wisconsin Assembly Backs Privacy Bill to Ban Facebook Snooping, Milwaukee J. Sentinel, Jan. 21, 2014.
16 Wis. Stat. § 995.55(2)(b).
17 Wis. Stat. § 995.55(2)(b)2.
18 Wis. Stat. § 995.55(2)(b)4.
19 Wis. Stat. § 995.55(2)(b)5.
20 Wis. Stat. § 995.55(2)(b)7.
21 Wis. Stat. § 995.55(2)(b)3.
22 Id.
23 Id.
24 Wis. Stat. §§ 111.31-.395.
25 Wis. Stat. § 106.50.
26 Wis. Stat. § 995.55(6)(b).
27 Wis. Stat. § 111.39(1).
28 WIs. Stat. § 106.50(6)(a)1.
29 WIs. Stat. § 995.55(6).
30 Wis. Stat. § 111.39(4)(c).
31 Watkins v. LIRC, 117 Wis. 2d 753, 345 N.W.2d 482 (1984).
32 Wis. Stat. § 106.50(6)(h).
33 Wis. Stat. § 995.55(6)(a).
34 Wis. Stat. §§ 111.31-.395.
35 42 U.S.C. §§ 2000e to 2000e-17.
36 42 U.S.C. §§ 12101-12213.
37 29 U.S.C. §§ 621-634.
38 Wis. Stat. § 118.13 (except as provided in section 120.13(37m)).
39 20 U.S.C. §§ 1681-1683.
40 42 U.S.C. §§ 2000d to 2000d-7.
41 29 U.S.C. §§ 701-796l.
42 Wis. Stat. § 106.50.
43 42 U.S.C. §§ 3601-3619.
44 18 U.S.C. §§ 2701-2712.
45 18 U.S.C. § 2701(a).
46 18 U.S.C. § 2707.
47 29 U.S.C. § 157.
48 National Labor Relations Board, The NLRB and Social Media, (last visited June 14, 2014).
49 Wis. Stat. § 995.55(2)(b)2.
