Effective July 1, 2015, a new law takes effect in Virginia that restricts employers’ ability to access their employees’ social media accounts. The law – Virginia Code § 40.1-28.7:5 – primarily forbids an employer from forcing either a current or prospective employee to:

• disclose log-in information – i.e. username and password – attached to a social media account; or
• “add” an employee, supervisor, or administrator to the employee’s contact list on such an account.

Additionally, an employer may not “inadvertently” access an employee’s account through an employer-provided device or a monitoring program (although obtaining log-in information this way does not itself trigger liability under the law). Nor may an employer take adverse action against a prospective or current employee for exercising her legal rights in this arena.

Nevertheless, there are certain qualifications to recognize:

• This does not provide employees with a private right of action to sue their employers. If a violation occurs, they are to file a complaint with the Virginia Safety and Health Commission. The Commission will investigate and has the potential power to issue a citation or penalty against the employer. Single violations can trigger up to a $7,000 penalty, whereas willful or repeated violations may cost employers up to $70,000.
• Employers can still require employees to disclose log-in information to a social media account if the employer has a “reasonable belief” that the account is “relevant” to the employer’s “formal investigation or related proceeding” regarding the employee’s violation of federal, state, or local laws or regulations or the employer’s written policies.
• The law does not apply to any social media account that the employer sponsors or that the employee creates on the employer’s behalf.
• The law does not prevent employers from complying with other applicable laws or regulations or from viewing publically-available information concerning their current or prospective employees.

Virginia is now the nineteenth state to provide increased social media protections to prospective and current employees. It joins Arkansas, California, Colorado, Illinois, Louisiana, Maryland, Michigan, Nevada, New Hampshire, New Jersey, New Mexico, Oklahoma, Oregon, Rhode Island, Tennessee, Utah, Washington, and Wisconsin.

Given the new law, Virginia employers should review their employee handbooks and/or human resources policies to ensure that they conform to the social media guidelines outlined above.  And supervisors should be advised to direct any concerns about whether there exists a basis for asking for an employee’s social media log-in and password details.