Diserio Martin O'Connor & Castiglioni LLP

New Connecticut Employee Online Privacy Law

June 5, 2015

In May 2015, Connecticut Governor Dannel P. Malloy signed into law “An Act Concerning Employee Online Privacy.” This new law will take effect on October 1, 2015. Employers should provide notice to their legal, human resources and supervisory personnel in order to begin effectuating compliance with this new law. 

PROHIBITIONS

The new law prohibits employers from requesting or requiring employees or job applicants to (1) provide the employer with a user name, password, or other authorization means to access the employee’s or applicant’s personal online account; (2) authenticate or access a personal online account in the presence of the employer; or (3) invite, or accept an invitation from, the employer to join a group affiliated with any personal online account.

The new law also prohibits an employer from firing, disciplining, discriminating against, or otherwise retaliating against an employee who refuses to provide access to a personal online account or who files a complaint with a public or private body or court regarding the employer’s request for access or retaliation for refusing such access. Additionally, an employer cannot refuse to hire an applicant on the basis that the applicant would not provide access to his or her personal online account.

EXCEPTIONS

The law does not protect online accounts which are created by or are used by an employee or applicant for the employer’s business purposes. An employer may request or require an employee or applicant to provide access to such accounts or any electronic communications devices supplied or paid for, in whole or in part, by the employer. This includes computers, computer networks and cellular telephones.

Under limited circumstances, employers are permitted to conduct certain types of investigations relating to an employee’s or applicant’s personal online account. The investigation must be based on (1) the receipt of specific information regarding activity on an employee’s or applicant’s personal online account to ensure compliance with applicable state or federal laws, regulatory requirements, or prohibitions against work-related employee misconduct; or (2) the receipt of specific information regarding an employee’s or applicant’s unauthorized transfer of the employer’s proprietary information, confidential information, or financial data, to or from a personal online account operated by an employee, applicant, or other source. Nevertheless, when conducting a permitted investigation, the employer still cannot require disclosure of the user name, password or other authorization means; it may only access the account content.    

ENFORCEMENT

If employees or applicants believe that their employer or potential employer has violated sections of this law, they may file a complaint with the Connecticut Department of Labor. Upon receipt of the complaint, the Labor Commissioner will investigate such complaint and may hold a hearing. After the hearing, the Commissioner will issue a written decision to the parties.  

If the Commissioner finds an employer to be in violation of the law with respect to employees, it may award the employee all appropriate relief, including rehiring/reinstatement, back pay, reinstatement of wages, or any other relief it deems appropriate. It may also levy civil penalties against the employer of up to $500 for the first violation and $1,000 for each subsequent violation. With respect to applicants, civil penalties up to $25 for the first violation and $500 for each subsequent violation may be imposed on an employer.  ­­­­­­­­­­­­­­

Attorneys in our Employment Law Department can assist employers in effectuating compliance with this new law. 

For more information, please contact Scott S. Centrella, Chair of DMOC’s Employment Law Department, at 203-358-0800 or SCentrall@dmoc.com.