New Wisconsin Law Restricts Employer Access to Employees' Personal Internet Accounts

In April, Wisconsin became one of a growing number of states to regulate employer access to employees' or applicants' personal Internet accounts. 2013 Wisconsin Act 208 (the "Act") prohibits employers from requesting or requiring an employee or applicant to disclose a username and/or password to any personal Internet account the employee maintains. Additionally, an employer may not require an employee or applicant to grant access to his or her account or allow the employer to observe that account. The Act broadly defines personal Internet account as any Internet account used for personal communication. This definition likely includes e-mail, blogs, Facebook®, Twitter®, and LinkedIn® accounts, among others.

Further, employers may not discharge, discriminate against or refuse to hire an employee or applicant based on either a refusal to provide such information or the filing of a complaint concerning these practices. Employees and applicants are also protected from retaliation if they choose to testify or assist in any action or proceeding to enforce a right under the Act.

While the Act broadly prohibits requesting or requiring access information for personal Internet accounts, there are several exceptions. Employers may continue to:

• Request or require access information for an electronic communication device, such as a laptop or cellphone, or an account provided by the employer.
• Discipline or terminate an employee for any unauthorized transfer of confidential or financial information to the employee's personal Internet account. If an employer has reasonable cause to believe that such a transfer has occurred, the employer may require the employee to grant access to or allow observation of the employee's personal Internet account. Similarly, if the employer has reasonable cause to believe that activity on the employee's personal Internet account concerns employment-related misconduct, violation of the law, or violation of the employer's work rules as specified in a handbook, the employer may require access to or observation of the employee's personal Internet account. Importantly, an employer may not, even in these circumstances, require the employee to disclose access information for the account.
• Restrict employee access to certain websites while using employer-provided electronic communication devices or other company resources.
• View and use information that can be gained without access information or that is available in the public domain.
• Require employees to disclose their personal e-mail address.

An employer would not be in violation of the Act if it inadvertently gained an employee's access information through a program responsible for monitoring employee online activity or communication. However, the employer would still not be allowed to use this information to access the employee's personal internet account. Nor does the Act prevent employers from complying with a duty established by federal or state law to screen applicants or monitor current employees.

The Act is enforced by the Department of Workforce Development. Employers found in violation will be subject to a fine of up to $1,000 as well as other remedies necessary to redress the violation, including back pay in the case of a discharge.

Employers should review their policies, including any internal procedures for handling reports of misconduct, to ensure such policies and procedures do not violate the Act. Additionally, employers should train all individuals responsible for employee discipline and hiring on the law's requirements.