N.Y. Labor Law § 201-i: Request for access to personal accounts prohibited

§ 201-i. Request for access to personal accounts prohibited. 1. For

purposes of this section, the following words shall have the following

meanings:

(a) "Applicant" means an applicant for employment.

(b) "Electronic communications device" means any device that uses

electronic signals to create, transmit, and receive information,

including, but not limited to computers, telephones, personal digital

assistants and other similar devices.

(c) "Employer" means (i) a person or entity engaged in a business,

industry, profession, trade or other enterprise in the state; (ii) the

state of New York; (iii) a county, city, town, village or any other

political subdivision or civil division of the state; (iv) a school

district or any government entity operating a public school, college, or

university; (v) a public improvement or special district; (vi) a public

authority, commission or public benefit corporation; or (vii) any other

public corporation, agency, instrumentality or unit of government which

exercises governmental power under the laws of the state; and (viii)

shall include an agent, representative or designee of the employer.

(d) "Personal account" means an account or profile on an electronic

medium where users may create, share, and view user-generated content,

including uploading or downloading videos or still photographs, blogs,

video blogs, podcasts, instant messages, or internet website profiles or

locations that is used by an employee or an applicant exclusively for

personal purposes.

2. (a) Except as provided in paragraph (b) of this subdivision, it

shall be unlawful for any employer to request, require or coerce any

employee or applicant for employment to:

(i) disclose any user name and password, password, or other

authentication information for accessing a personal account through an

electronic communications device;

(ii) access the employee's or applicant's personal account in the

presence of the employer; or

(iii) reproduce in any manner photographs, video, or other information

contained within a personal account obtained by the means prohibited in

this paragraph.

(b) An employer may require an employee to disclose any user name,

password or other means for accessing nonpersonal accounts that provide

access to the employer's internal computer or information systems.

(c) For the purposes of this section, "access" shall not include an

employee or applicant voluntarily adding an employer, agent of the

employer, or employment agency to their list of contacts associated with

a personal internet account.

3. An employer may not:

(a) Discharge, discipline, or otherwise penalize or threaten to

discharge, discipline, or otherwise penalize an employee for an

employee's refusal to disclose any information specified in paragraph

(a) of subdivision two of this section; or

(b) Fail or refuse to hire any applicant as a result of the

applicant's refusal to disclose any information specified in paragraph

(a) of subdivision two of this section.

4. It shall be an affirmative defense to an action under this section

that the employer acted to comply with requirements of a federal, state

or local law.

5. (a) Nothing in this section shall prohibit an employer from:

(i) requesting or requiring an employee to disclose access information

to an account provided by the employer where such account is used for

business purposes and the employee was provided prior notice of the

employer's right to request or require such access information;

(ii) requesting or requiring an employee to disclose access

information to an account known to an employer to be used for business

purposes;

(iii) accessing an electronic communications device paid for in whole

or in part by the employer where the provision of or payment for such

electronic communications device was conditioned on the employer's right

to access such device and the employee was provided prior notice of and

explicitly agreed to such conditions. However, nothing in this

subparagraph shall permit an employer to access any personal accounts on

such device;

(iv) complying with a court order in obtaining or providing

information from, or access to, an employee's accounts as such court

order may require;

(v) restricting or prohibiting an employee's access to certain

websites while using an employer's network or while using an electronic

communications device paid for in whole or part by the employer where

the provision of or payment for such electronic communications device

was conditioned on the employer's right to restrict such access and the

employee was provided prior notice of and explicitly agreed to such

conditions.

(b) This section does not prohibit or restrict an employer from

complying with a duty to screen employees or applicants prior to hiring

or to monitor or retain employee communications that is established

under federal law or by a self regulatory organization, as defined in

section 3(a)(26) of the securities and exchange act of 1934, 15 USC

§78c(a)(26).

(c) This section does not prohibit or restrict an employer from

viewing, accessing, or utilizing information about an employee or

applicant that can be obtained without any required access information,

that is available in the public domain, or for the purposes of obtaining

reports of misconduct or investigating misconduct, photographs, video,

messages, or other information that is voluntarily shared by an

employee, client, or other third party that the employee subject to such

report or investigation has voluntarily given access to contained within

such employee's personal account.

6. The provisions of this section shall not apply to any law

enforcement agency, a fire department or a department of corrections and

community supervision.