New Law Restricts Access to Personal Internet Accounts by Employers, Educational Institutions and Landlords

By D&K’s School and Higher Education Law Team

Access to personal Internet accounts by Wisconsin employers, educational institutions and landlords has been severely limited by a new law. As a result of 2013 Wisconsin Act 208, it is now illegal for a Wisconsin employer to request or require that an employee or applicant provide the employer with access to his/her personal Internet account. Similar prohibitions apply to Wisconsin educational institutions, including institutions of higher education, public schools, charter schools, private schools and educational testing services, with regard to current and prospective students; and to landlords concerning current and prospective tenants. Furthermore, effective April 10, 2014, such entities may not terminate, expel, suspend, refuse to enroll, evict, refuse to rent, discriminate, or otherwise take adverse action against individuals for refusing to grant access to the individual’s personal Internet account.

The law does not prevent an employer, educational institution or landlord from investigating an individual’s activities on a personal Internet account. It also does not preclude an employer, educational institution or landlord from observing or acting upon information that is available to the public on an individual’s personal Internet account. Moreover, the law does not prohibit employers, educational institutions and landlords from connecting with employees, students and tenants on social media websites.

The law defines a personal Internet account as “an Internet-based account that is created and used by an individual exclusively for purposes of personal communications.” Wis. Stat. § 995.55(1)(d). It is understood that the term “personal Internet account” encompasses accounts on Twitter, Facebook, Instagram, Snapchat, and other social media platforms.

The law protects “access information,” which is defined as “a user name and password or any other security information that protects access to a personal Internet account.” Wis. Stat. § 995.55(1)(a). It is understood that the access information that is protected by this legislation, includes user names, passwords, log-in information, security codes, Personal Identification Numbers (PINs), answers to challenge questions, and other security features.

Employers. The law prohibits employers from taking any of the following actions concerning current or prospective employees:

1. 1. Requesting or requiring an employee or applicant for employment, as a condition of employment, to disclose access information for the personal Internet account of the employee or applicant or to otherwise grant access to or allow observation of that account.
   2. Discharging or otherwise discriminating against an employee for refusing to disclose access information for, grant access to, or allow observation of the employee’s personal Internet account, opposing a prohibited practice, filing a complaint or attempting to enforce any such right, or testifying or assisting in any action or proceeding to enforce any such right.
   3. Refusing to hire an applicant for employment because the applicant refused to disclose access information for, grant access to, or allow observation of the applicant’s personal Internet account.

The law does not prohibit an employer from taking any of the following actions concerning current or prospective employees:

1. 1. Requesting or requiring an employee to disclose access information to the employer in order for the employer to gain access to or operate an electronic communications device supplied or paid for in whole or in part by the employer or in order for the employer to gain access to an account or service provided by the employer, obtained by virtue of the employee’s employment relationship with the employer, or used for the employer’s business purposes.
   2. Discharging or disciplining an employee for transferring the employer’s proprietary or confidential information or financial data to the employee’s personal Internet account without the employer’s authorization.
   3. Conducting an investigation or requiring an employee to cooperate in an investigation of any alleged unauthorized transfer of the employer’s proprietary or confidential information or financial data to the employee’s personal Internet account, if the employer has reasonable cause to believe that such a transfer has occurred, or of any other alleged employment-related misconduct, violation of the law, or violation of the employer’s work rules as specified in an employee handbook, if the employer has reasonable cause to believe that activity on the employee’s personal Internet account relating to that misconduct or violation has occurred.
   4. Restricting or prohibiting an employee’s access to certain Internet sites while using an electronic communications device supplied or paid for in whole or in part by the employer or while using the employer’s network or other resources.
   5. Complying with a duty to screen applicants for employment prior to hiring or a duty to monitor or retain employee communications that is established under state or federal laws, rules, or regulations.
   6. Viewing, accessing, or using information about an employee or applicant for employment that can be obtained without access information or that is available in the public domain.
   7. Requesting or requiring an employee to disclose the employee’s personal electronic mail address.

The employer prohibitions do not apply to a personal Internet account or an electronic communications device of an employee engaged in providing financial services, who uses the account or device to conduct the business of an employer that is subject to the content, supervision, and retention requirements imposed by federal securities laws and regulations or by the rules of a self-regulatory organization. Wis. Stat. § 995.55(2)(c).

The law does not prohibit an employer from connecting with an employee on a social media website. Therefore, it is still permissible for employers and employees to be “friends” on Facebook or to follow one another on Twitter. Furthermore, an employer is able to rely upon and act upon information that is shared by the employee on his/her personal Internet account whether the employer is able to view the information by virtue of the employer’s direct connection with the employee or by virtue of a “friend” of the employee revealing the information to the employer.

Moreover, if an employer inadvertently obtains access information for an employee’s personal Internet account through the use of an electronic device or program that monitors the employer’s network or through an electronic communications device supplied or paid for in whole or in part by the employer, the employer will not be liable for possessing that access information so long as the employer does not use that information to access the employee’s personal Internet account. Wis. Stat. § 995.55(2)(d).

While the law is effective on April 10, 2014, if a collective bargaining agreement contains provisions that are inconsistent with Wis. Stat. § 995.55, the new law will apply to the employees covered by the collective bargaining agreement on the day when the collective bargaining agreement expires, or is extended, modified, or renewed.

Educational Institutions. The law prohibits an educational institution from taking any of the following actions concerning current or prospective students:

1. 1. Requesting or requiring a student or prospective student, as a condition of admission or enrollment, to disclose access information for the personal Internet account of the student or prospective student or to otherwise grant access to or allow observation of that account.
   2. Expelling, suspending, disciplining, or otherwise penalizing any student for refusing to disclose access information for, grant access to, or allow observation of the student’s personal Internet account, opposing a prohibited practice, filing a complaint or attempting to enforce any such right, or testifying or assisting in any action or proceeding to enforce any such right.
   3. Refusing to admit a prospective student because the prospective student refused to disclose access information for, grant access to, or allow observation of the prospective student’s personal Internet account.

The law does not prohibit an educational institution from taking any of the following actions concerning current or prospective students:

1. 1. Requesting or requiring a student to disclose access information to the educational institution in order for the institution to gain access to or operate an electronic communications device supplied or paid for in whole or in part by the institution or in order for the educational institution to gain access to an account or service provided by the institution, obtained by virtue of the student’s admission to the educational institution, or used for educational purposes.
   2. Viewing, accessing, or using information about a student or prospective student that can be obtained without access information or that is available in the public domain.

An educational institution may still rely upon and act upon information that is shared by the student on his/her personal Internet account whether the educational institution is able to view the information by virtue of a direct connection with the student or by virtue of a “friend” of the student revealing the information to the educational institution.

Interestingly, the law does not prohibit educators from connecting with students on social media platforms. However, while it is still legal for educators and students to be “friends” on Facebook or to follow one another on Twitter, there are many reasons why such a connection may be problematic and create other concerns. As such, even without a legal prohibition, we continue to caution educators against connecting with students via social media websites.

Landlords. The law prohibits a landlord from taking any of the following actions concerning current or prospective tenants:

1. 1. Requesting or requiring a tenant or prospective tenant, as a condition of tenancy, to disclose access information for the personal Internet account of the tenant or prospective tenant or to otherwise grant access to or allow observation of that account.
   2. Discriminating in a manner described in Wis. Stat. § 106.50 (2) against a tenant or prospective tenant for refusing to disclose access information for, grant access to, or allow observation of the personal Internet account of the tenant or prospective tenant, opposing a prohibited practice, filing a complaint or attempting to enforce any such right, or testifying or assisting in any action or proceeding to enforce any such right.

The law does not prohibit a landlord from viewing, accessing, or using information about a tenant or prospective tenant that can be obtained without access information or that is available in the public domain.

Penalties. The new law designates the Department of Workforce Development – Equal Rights Division (Department) as the enforcement agency. Furthermore, it provides that any person who violates the law may be required to forfeit no more than $1000. Wis. Stat. § 995.55(6)(a). Moreover, if an individual is penalized in the form of termination, expulsion, suspension, eviction, discrimination, or other adverse action in violation of the statute, the Department may award remedies consistent with the other anti-discrimination statutes that it enforces. Wis. Stat. § 995.55(6)(b) and (c).

Finally, the law explicitly states that there is no “duty for an employer, educational institution, or landlord to search or monitor the activity of any personal Internet account.” Wis. Stat. § 995.55(5)(a).

Conclusion. This new law is expected to hamper investigations conducted by educational institutions into the misconduct committed by its students. In the past, in some cases, school district officials have directed students to provide access to the student’s personal Internet accounts as part of an investigation. For example, a high school principal, who brings a student into his office and asks or directs the student to sign onto his Facebook account in order to reveal evidence that the student has been bullying and harassment another student on the social media website. In these cases, sometimes the school district official has relied upon the “reasonable suspicion” standard that applies to school district official searches of student property under the Fourth Amendment to the U.S. Constitution. However, now, because of Act 208, a school district official in this situation must find another way to discover this information. The school district official must find the harassing Facebook posts in the public domain, such as through another person (e.g., student, parent, staff member, etc.) who is connected with the offending student. Thus, because of the prohibitions in the new law, school district officials must proceed with caution as they investigate student misconduct via social media.

This new law will create similar obstacles with regard to investigations by employers into the misconduct committed by its staff. Employers should exercise caution as they proceed in such investigations. Employers must also be careful with regard to accessing the personal Internet accounts of applicants in the course of background checks for employees and, in some cases, volunteers.

The attorneys at Davis & Kuelthau, s.c. are prepared to assist employers, educational institutions and landlords with the obligations and prohibitions arising out of this new law. If you have any questions, please contact your Davis & Kuelthau, s.c. attorney.