1) employer access to, and observation of, the personal Internet accounts of employees and applicants for employment;
2) educational institution access to, and observation of, the personal Internet accounts of students and prospective students; and
3) landlord access to, and observation of, the personal Internet accounts of tenants and prospective tenants.
The bill created Wis. Stat. § 995.55 which prohibits employers, educational institutions, and landlords are prohibited from requesting or requiring disclosure of “access information” for your “personal Internet accounts.” By using the verb “request,” the statute prohibits these entities from even asking you for this information. In other words, unless you voluntarily walk up to your boss and say, “hey you should follow me on Twitter- my username is "Mngmnt_stinks,” your boss will have to resort to more intensive research if he or she wants to find out who you are in the online universe. The statute says that the employer, educational institution, or landlord may not request or require you to “otherwise grant access to or allow observation of that account.” Wis. Stat. §§ 995.55(2)(a)(1), 995.55(3)(a)(1), 995.55(4)(a)(1). So if your boss demands that you accept her friend request on Facebook, this statute now provides you with the perfect, plausible excuse to say no.
Another key term under the statute is “access information.” The statute places restrictions on the ability to obtain information necessary to access a personal Internet account. The statute defines access information as “a user name and password or any other security information that protects access to a personal Internet account.” Thus, information such as “your mother’s maiden name” and “the street you grew up on” that may be relevant to retrieving a password also is protected. So an employer can’t skirt the new law by asking for the employee’s security questions and then making some educated guesses. The statute says that the employer, educational institution, or landlord may not request or require you to “otherwise grant access to or allow observation of that account.” Wis. Stat. §§ 995.55(2)(a)(1), 995.55(3)(a)(1), 995.55(4)(a)(1). So if your boss demands that you accept her friend request on Facebook, this statute now provides you with the perfect, plausible excuse to say no.
However, an employer can still request or require you to disclosure your personal email address. Wis. Stat. § 995.55(2)(b)(7). Employers and educational institutions may require an individual to disclose information to access a device, account, or service they provide to the individual. Although this exception allows access to a tablet, laptop, or smartphone that the employer or educational institution provides to an individual, a personal social media account accessed through the device is still protected.
The statute also defines “employer” broadly. If you employ at least one individual, you may be an employer. The state and municipalities are employers, as are the legislature and the courts. Wis. Stat. § 995.55(1)(c). the statute also defines “educational institution” broadly to encompass both public and private schools and to span grade school through college level education. Wis. Stat. § 955.55(1)(b).
Individuals who allege violations of the Act against employers or landlords will proceed with the same Wisconsin Department of Workforce Development (DWD) complaint, investigation, and hearing proceedings that are already in place for charges of discrimination under the Wisconsin Fair Employment Act (WFEA), Wis. Stat. §§ 111.31-.395, and the Wisconsin Fair Housing Act (WFHA). Wis. Stat. § 106.50. Students, prospective students, and educational institutions will proceed down the same administrative path established by the WFEA. Wis. Stat. § 995.55 (6)(b). Individuals must file a complaint against an employer or educational institution within 300 days, Wis. Stat. § 111.39 (1), or against a landlord within one year, or their claims will be barred. WIs. Stat. § 106.50 (6)(a)1.
According to Wis. Stat. § 995.55(6), a violation will result in forfeiture of not more than $1,000. If the violation involves wrongful discharge, discipline, discrimination, etc., the person wronged may file a complaint with the department of workforce development and the complaint will be processed like an employment discrimination complaint.
Under the statutory scheme applicable to employment discrimination complaints, if wrongful discharge or discrimination occurred, the department examiner may award compensation of at least “500 times the hourly wage of the person discriminated against when the violation occurred” but not more than compensation of “1,000 times the hourly wage of the person discriminated against when the violation occurred.” Wis. Stat. § 111.39(4)(c). So for an employee making $10 an hour, a violation could cost $10,000 and perhaps back pay.
Employers investigating allegations of an existing employee’s workplace misconduct that involve social media accounts must establish “reasonable cause” to review private social media content. The Act does not provide any help to define reasonable cause. Employers may attempt to establish reasonable cause to investigate protected content through public social media content, statements or information volunteered by employees, or employee testimony received through interviews. An employer should document its basis for reasonable cause to support further inquiry by the DWD.
Once an employer establishes reasonable cause to review an employee’s private social media content, the permitted parameters of the employer’s investigation still are limited. The Act only allows an investigating employer to request the employee login to an individual’s account for the employer to review or for the employer to observe while an employee navigates the account. Wis. Stat. § 995.55 (2)(b)2. If review of profile content takes place on an employer’s devices, an employer might want to take additional steps to further limit the potential for liability based on information the employer could arguably retain as part of such review. These steps include disabling, explaining, and documenting any computer or network settings that could retain password information on the employer’s devices.