§ 21/495 l. Social media account privacy; prohibitions
(a) As used in this section:
(1) "Social media account" means an account with an electronic medium or service through which users create, share, and interact with content, including videos, still photographs, blogs, video blogs, podcasts, instant or text messages, e-mail, online services or accounts, or Internet website profiles or locations. "Social media account" does not include an account provided by an employer or intended to be used primarily on behalf of an employer.
(2) "Specifically identified content" means data, information, or other content stored in a social media account that is identified with sufficient particularity to distinguish the individual piece of content being sought from any other data, information, or content stored in the account. "Specifically identified content" shall not include a username, password, or other means of authentication for the purpose of accessing an employee's or applicant's social media account.
(b) An employer shall not require, request, or coerce an employee or applicant to do any of the following:
(1) disclose a username, password, or other means of authentication, or turn over an unlocked personal electronic device for the purpose of accessing the employee's or applicant's social media account;
(2) access a social media account in the presence of the employer;
(3) divulge or present any content from the employee's or applicant's social media account; or
(4) change the account or privacy settings of the employee's or applicant's social media account to increase third-party access to its contents.
(c) An employer shall not require or coerce an employee or applicant to add anyone, including the employer, to his or her list of contacts associated with a social media account.
(d) No agreement by an employee to waive his or her rights under this section shall be valid.
(e)(1) Nothing in this section shall preclude an employer from requesting an employee to share specifically identified content for the purpose of:
(A) complying with the employer's legal and regulatory obligations;
(B) investigating an allegation of the unauthorized transfer or disclosure of an employer's proprietary or confidential information or financial data through an employee's or an applicant's social media account; or
(C) investigating an allegation of unlawful harassment, threats of violence in the workplace, or discriminatory or disparaging content concerning another employee.
(2) Nothing in this section shall prohibit or restrict a law enforcement agency, as defined in 15 V.S.A. § 1151(5), from requesting or requiring:
(A) an applicant to provide access to the applicant's social media account as part of a screening or fitness determination during the hiring process; or
(B) an employee to provide access to the employee's social media account in relation to a continued fitness determination or an allegation or investigation of employee misconduct, a violation of policy, or a violation of law.
(3) Nothing in this section shall restrict or otherwise prohibit a law enforcement agency, as defined in 15 V.S.A. § 1151(5), from retaining any social media account information acquired pursuant to this subsection, provided that the information shall be protected in accordance with law and the law enforcement agency's policy.
(4) Nothing in this section shall be construed to prevent an employer from complying with the requirements of State or federal law.
(f) Nothing in this section shall preclude an employer from requesting or requiring an employee to provide a username or password that is necessary to access an employer-issued electronic device.
(g) An employer shall not discharge or in any other manner retaliate against an employee who exercises or attempts to exercise his or her rights under this section. The provisions against retaliation in subdivision 495(a)(8) of this title and the penalty and enforcement provisions of section 495b of this title shall apply to this section. (Added 2017, No. 37, § 1, eff. Jan. 1, 2018.)