275:74 Use of Social Media and Electronic Mail. –
I. No employer shall request or require that an employee or prospective employee disclose login information for accessing any personal account or service through an electronic communication device.
II. No employer shall compel an employee or applicant to add anyone, including the employer or the employer's agent, to a list of contacts associated with an electronic mail account or personal account or require an employee or applicant to reduce the privacy settings associated with any electronic mail or personal account that would affect a third party's ability to view the contents of the account.
III. No employer shall take or threaten to take disciplinary action against any employee for such employee's refusal to comply with a request or demand by the employer that violates this subdivision.
IV. Nothing in this subdivision shall limit an employer's right to:
(a) Adopt and enforce lawful workplace policies governing the use of the employer's electronic equipment, including policies regarding Internet use, social networking site use, and electronic mail use.
(b) Monitor usage of the employer's electronic equipment and electronic mail.
(c) Request or require an employee to disclose login information for access to:
(1) An account or service provided by virtue of the employee's employment relationship with the employer; or
(2) An electronic communications device or online account paid for or supplied by the employer.
V. If, through the use of an electronic device or program that monitors an employer's network or the use of employer provided devices, an employer inadvertently receives an employee's password, or other authentication information, the employer is not liable for having this information, but shall not use this information to access an employee's personal accounts.
VI. Nothing in this section shall prohibit an employer from:
(a) Obtaining information about an employee or prospective employee that is in the public domain;
(b) Conducting an investigation:
(1) To ensure compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct based on information about activity on an employee's personal account or service received from an employee or other source.
(2) Of an employee's actions based on the receipt of specific information about the unauthorized transfer of an employer's proprietary information, confidential information, or financial data to a personal online account or service by an employee or other source.
VII. In any investigation conducted under paragraph VI, the employer may require the employee's cooperation to share only the content that has been received by the employer, in order to make a factual determination.
VIII. Nothing in this section shall be construed to prevent an employer from complying with the requirements of state or federal statutes, rules or regulations, case law, or rules of self-regulatory organizations.