Maryland becomes first state to ban employers from asking for social media passwords

Moving to the forefront of social media privacy law nationwide, the Maryland General Assembly has passed legislation prohibiting employers in the state from asking current and prospective employees for their user names and passwords to websites such as Facebook and Twitter.

If Gov. Martin O'Malley signs the bill — his office said it was one of hundreds of bills it has yet to review — the bill would make Maryland the first state in the nation to set such a restriction into law. Other states are considering similar legislation, including Illinois and California.


The bill, drafted in response to a state agency's scouring the personal Facebook posts of prison guard applicants, also could be a bellwether for federal action. Two U.S. senators — Chuck Schumer of New York and Richard Blumenthal of Connecticut, both Democrats — have asked the Department of Justice and the U.S. Equal Employment Opportunity Commission to investigate the issue.

"Right now we protect our physical homes, but it's my thought that we need to protect our digital homes," said Bradley Shear, a Bethesda social media attorney who advised state legislators on drafting of the bill. Shear said federal law is indeed needed to address the problem because "the Internet knows no bounds."


But while Facebook criticized the practice of employers viewing employees' personal accounts and civil libertarians hailed the state legislation, business groups including the Maryland Chamber of Commerce pointed out that there may be instances when an employer needs to access such accounts. Some employers say that what potential hires post on social media pages could provide useful information to weed out unwanted candidates.

The bill in Maryland passed unanimously in the Senate and by a wide margin in the House of Delegates last week, and lawmakers successfully reconciled the bills before the legislative session ended Monday at midnight.

Del. Shawn Tarrant, a Democrat from Baltimore City who was one of the bill's lead sponsors in the House, called the practice of employers asking for employees' passwords "ridiculous," and compared it to employers' eavesdropping on private phone conversations.

"No one has the right to know what they're talking about," Tarrant said.

"We just think this is a really positive development," said Melissa Goemann, the American Civil Liberties Union of Maryland's legislative director, "because the technology for social media is expanding every year, and we think this sets a really good precedent for limiting how much your privacy can be exposed when you use these mediums."

The state's ACLU chapter initially raised concerns about employers' demanding personal social media passwords when it took up the case of corrections officer Robert Collins, who contacted the chapter after being asked for his Facebook password in a re-certification interview with the Department of Public Safety and Correctional Services, Goemann said.

"Collins felt he had no choice but to provide his password, even though he knew it was not right, because he needed the job to support his family," the ACLU said in a statement. "Collins had to sit there while the [interviewer] logged on to his Facebook account and reviewed his messages, wall posts and photos."

The ACLU complained about the practice to Gary Maynard, secretary of the state corrections department, and the agency temporarily suspended and then revised its policy to allow applicants to "voluntarily participate" in a review of their social media accounts.


The department said the policy was effective, and had been a factor in the denial of employment to seven individuals out of 2,689 applicants over the course of a year, some of whom had "utilized social media applications which contained pictures of them showing verified gang signs."

The revised policy did not satisfy the ACLU and Sen. Ron Young, a Democrat from Frederick, drafted legislation to outlaw the practice entirely. Young introduced an unsuccessful bill in the Senate last year. This session, Young introduced the bill again, and Tarrant cross-filed it in the House.

In late March, Erin Egan, Facebook's chief privacy officer, wrote about the issue on Facebook, calling the practice of employers requesting potential hires' Facebook passwords "alarming" and "not the right thing to do."

Goemann said the ACLU of Maryland received another call from a state employee, also from the corrections department, complaining of being asked for social media passwords. Other instances of employers' requesting the private online information of potential hires began popping up around the country — Egan said Facebook had noticed "a distressing increase" in such incidents in recent months — and the issue became a priority for the ACLU's national network, Goemann said.

David Scher, principal of the Employment Law Group Law Firm in Washington, said while he supports what the state was trying to do with the legislation, he thinks it is overly broad and could be improved, whether at the state or federal level.

The legislation should have included an exception for employers with a "legitimate and compelling business reason" to review social media content, such as law enforcement agencies, Scher said.


"I think people are trying to draw a hard and fast line, and I don't think that's the appropriate answer," he said.

Anthony Guglielmi, Baltimore police spokesman, said his department looks at public social media content posted by applicants as part of its more in-depth background checks — which also include polygraph tests and interviews with applicants' friends and family — but doesn't ask for passwords and supports the legislation.

The Maryland Chamber of Commerce had opposed the legislation because it did not "address appropriate parameters and criteria to determine when an employer may access the account of an employee." The chamber noted that "circumstances involving potential severe misconduct or claims of discrimination or harassment may require such access."

The bill was amended to give employers more control over proprietary information being shared by employees online.

Another bill introduced this session by Tarrant would have given similar protections to students and student athletes — some of whose Twitter accounts have been monitored by college officials trying to prevent their players from posting scandalous things online — never made it out of committee. But Tarrant said he will reintroduce the legislation next year.