Wisconsin has joined the ranks of other states who have limited the circumstances under which employees or applicants can be required to provide access to his or her personal Internet account. The Social Media Protection Act (2013 Wisconsin Act 208) became effective April 16, 2014. The new law makes it illegal for an employer to request or require an employee or applicant to disclose personal Internet account access information. A parallel prohibition within the Act applies to educational institutions and landlords.

A “personal Internet account” is defined as an Internet-based account that is created and used by an individual exclusively for purposes of personal communications. With the passage of the Act, employers are now prohibited from:

Requesting or requiring an employee or applicant, as a condition of employment, to disclose access information to the individual’s personal Internet account or to ask the individual to grant access to or allow observation of that account.
Discharging or otherwise discriminating against an employee for exercising his/her right to refuse to disclose personal Internet account access information.
Refusing to hire an applicant because the individual did not disclose personal Internet account access information.

While the law primarily protects the privacy of employees and applicants, it also offers employers a limited degree of protection. Specifically, employers can:

• Request or require an employee to disclose access information to the employer in order for the employer to gain access to or operate an employer-provided (or employer-paid) electronic communications device provided by virtue of the employee’s employment relationship or used for the employer’s business purposes.
• Discharge or discipline employees for transferring proprietary or confidential information or financial data to the employee’s personal Internet account without the employer’s authorization.
• If the employer has reasonable cause, conduct an investigation or require an employee to cooperate in an investigation of any alleged unauthorized transfer of the employer’s proprietary or confidential information or financial data to the employee’s personal Internet account or to conduct an investigation of any other alleged employment-related misconduct, violation of the law or violation of the employer’s work rules. During the investigation, the employer can require the employee to grant access to or allow observation of the employee’s personal Internet account, but may not require the employee to disclose access information for that account.
• Restrict or prohibit an employee’s access to certain Internet sites, while using an employer-provided (or paid for) electronic communications device, or while the employee is using the employer’s network or other resources.
• View, access or use information about an employee or applicant that can be obtained without access information or that is available in the public domain.
• Request or require an employee to disclose his or her personal electronic mail address.

A person who has been discharged, expelled, disciplined, or otherwise discriminated against for reasons provided under this law may file a complaint with Wisconsin’s Department of Workforce Development.

Employers should make sure that their employment policies and practices conform to the requirements of 2013 Wisconsin Act 208. In particular, employers should make sure that employees using employer-provided or paid for electronic communication devices for business purposes do not have any expectation of privacy in such devices or the communications that flow from them.

In addition, employees should be informed that they are prohibited from disclosing proprietary or confidential information or financial data to anyone using personal Internet accounts and only for legitimate business reasons if using an employer-provided account. Lastly, employers should make sure that their employment policies are clear in reserving the right to conduct, and in expecting employees to cooperate in, investigations concerning the unauthorized transfer of proprietary, confidential or financial information.