OAR 839-005-0400: Employer Access to Employee or Applicant Social Media Accounts: Unlawful Employment Practice

(1) It is an unlawful employment practice for an employer to: (a) Require or request an employee or an applicant for employment to establish or maintain a personal social media account, or to disclose or to provide access through the employee's or applicant's user name and password, password or other means of authentication that provides access to a personal social media account; (b) Require an employee or an applicant for employment to authorize the employer to advertise on the personal social media account of the employee or applicant; (c) Compel an employee or applicant for employment to add the employer or an employment agency to the employee's or applicant's list of contacts associated with a social media website; (d) Except as provided in subsection (4)(b) of this section, compel an employee or applicant for employment to access a personal social media account in the presence of the employer and in a manner that enables the employer to view the contents of the personal social media account that are visible only when the personal social media account is accessed by the account holder's user name and password, password or other means of authentication; (e) Take, or threaten to take, any action to discharge, discipline or otherwise penalize an employee for the employee's refusal to disclose, or to provide access through, the employee's user name and password, password or other means of authentication that is associated with a personal social media account, to add the employer to the employee's list of contacts associated with a social media website or to access a personal social media account as described in subsection (7); or (f) Fail or refuse to hire an applicant for employment because the applicant refused to disclose, or to provide access through, the applicant's user name and password, password or other means of authentication that is associated with a personal social media account, to add the employer to the applicant's list of contacts associated with a social media website or to access a personal social media account as described in subsection (7). (2) An employer may require an employee to disclose any username and password, password or other means for accessing an account provided by, or on behalf of, the employer or to be used on behalf of the employer. (3) An employer may not be held liable for the failure to request or require an employee or applicant to disclose the information specified in subsection (1)(a) of this section. (4) Nothing in this section prevents an employer from: (a) Conducting an investigation, without requiring an employee to provide a user name and password, password or other means of authentication that provides access to a personal social media account of the employee, for the purpose of ensuring compliance with applicable laws, regulatory requirements or prohibitions against work-related employee misconduct based on receipt by the employer of specific information about activity of the employee on a personal online account or service. (b) Conducting an investigation permitted under this subsection that requires an employee, without providing a user name and password, password or other means of authentication that provides access to a personal social media account of the employee, to share content that has been reported to the employer that is necessary for the employer to make a factual determination about the matter. (c) Complying with state and federal laws, rules and regulations and the rules of self-regulatory organizations. (5) Nothing in this section prohibits an employer from accessing information available to the public about the employee or applicant that is accessible through an online account. (6) If an employer inadvertently receives the user name and password, password or other means of authentication that provides access to a personal social media account of an employee through the use of an electronic device or program that monitors usage of the employer's network or employer-provided devices, the employer is not liable for having the information but may not use the information to access the personal social media account of the employee. (7) As used in this section, “social media” means an electronic medium that allows users to create, share and view user-generated content, including, but not limited to, uploading or downloading videos, still photographs, blogs, video blogs, podcasts, instant messages, electronic mail or Internet website profiles or locations.