Okla. Stat. tit. 40, § 40-173.2: Prohibited actions regarding personal social media

accounts – Exemptions – Civil actions.

A. No employer, as defined by paragraph 1 of Section 1301 of

Title 25 of the Oklahoma Statutes, located in this state shall:

1. Require an employee or prospective employee to disclose a

user name and password or other means of authentication for

accessing a personal online social media account through an

electronic communications device;

2. Require an employee or prospective employee to access the

employee's or prospective employee's personal online social media

account in the presence of the employer in a manner that enables the

employer to observe the contents of such accounts if the account's

contents are not available to the general public, except pursuant to

an investigation as provided in subsection D of this act;

3. Take retaliatory personnel action that materially and

negatively affects the terms and conditions of employment against an

employee solely for refusal to give the employer the user name or

password to the employee's personal online social media account; or

4. Refuse to hire a prospective employee solely as a result of

the prospective employee's refusal to give the employer the user

name and password to the prospective employee's personal online

social media account.

B. An employer may request or require an employee to disclose

any user name and password for accessing:

1. Any computer system, information technology network, or

electronic communications device provided or subsidized by the

employer; or

2. Any accounts or services provided by the employer or by

virtue of the employee's employment relationship with the employer

or that the employee uses for business purposes.

C. If, through the use of an electronic device or program that

monitors an employer's network or the use of employer provided

devices, an employer inadvertently receives an employee's user name

and password or other authentication information, the employer is

not liable for having such information, but may not use the

information to access an employee's personal online social media

account.

D. Nothing in this section shall prevent an employer from:

1. Conducting an investigation:

a. for the purpose of ensuring compliance with applicable

laws, regulatory requirements or prohibitions against

work-related employee misconduct based on the receipt

of specific information about activity on a personal

online social media account or personal online social

media service by an employee or other source, or

b. of an employee's actions based on the receipt of

specific information about the unauthorized transfer

of an employer's proprietary information, confidential

information or financial data to a personal online

social media account or personal online social media

service by an employee or other source;

2. Conducting an investigation as specified in subparagraphs a

and b of paragraph 1 of this subsection includes requiring the

employee's cooperation to share the content that has been reported

in order to make a factual determination.

E. Nothing in this section shall be construed to prevent an

employer from complying with the requirements of state or federal

statutes, rules or regulations, case law, or rules of self-

regulatory organizations.

F. Nothing in this section shall be construed to prohibit an

employer from accessing its computer system or information

technology network, including electronic communications devices

owned by the employer. Neither this section nor any other Oklahoma

law shall prohibit an employer from reviewing or accessing personal

online social media accounts that an employee may choose to use

while utilizing an employer's computer system, information

technology network or an employer's electronic communication device.

G. An employee or prospective employee may bring a civil action

against an employer who violates this section in a court located in

ma

law shall prohibit an employer from reviewing or accessing personal

online social media accounts that an employee may choose to use

while utilizing an employer's computer system, information

technology network or an employer's electronic communication device.

G. An employee or prospective employee may bring a civil action

against an employer who violates this section in a court located in

the county in which the alleged violation occurred. Such action

shall be brought within six (6) months after the alleged violation

occurred. The employee or prospective employee may seek injunctive

relief to restrain the employer from continuing to act in violation

of this section, but must show by clear and convincing evidence that

the employer violated this act. The only damages recoverable for a

violation of this act are Five Hundred Dollars ($500.00) per

violation. No punitive or emotional damages are recoverable, and

this section may not be utilized for the basis of a public policy

tort.

H. As used in this section:

1. "Electronic communications device" means a device that uses

electronic signals to create, transmit or receive information,

including computers, telephones, personal digital assistants and

other similar devices; and

2. "Personal online social media account" means an online

account that is used by an employee or prospective employee

exclusively for personal communications that an individual

establishes and uses through an electronic application, service or

platform used to generate or store content, including, but not

limited to, videos, still photographs, blogs, video blogs, instant

messages, audio recordings or email that is not available to the

general public.