As most of our clients already know, respecting employees' privacy regarding password-protected social media access is a best practice. However, for Oregon employers, doing so is now the law.  Last month, the Oregon legislature passed and Governor Kitzhaber signed into law House Bill ("HB") 2654, which provides social media privacy protections to employees and job applicants.  Specifically, HB 2654 makes it an unlawful practice for employers to require or request that employees and applicants disclose their user names and passwords or other means of authentication that provide access to their personal social media accounts. 

In addition, the law prohibits an employer from compelling employees and applicants from adding the employer to a contact list associated with a social media website (for example, by "friending" the employer on FaceBook). 

The law also prohibits Oregon employers from compelling an employee or applicant to access a personal media website in the presence of the employer and in a way that allows the employer to view the contents of the website that would otherwise be visible only with the individual's username and password.  Recognizing the need to balance privacy concerns with employers' ability to conduct investigations into work-related employee misconduct, the law provides a limited exception for investigations that require an employee, without providing a user name and password, to share content that has been reported to the employer that is necessary for the employer to make a factual determination about the matter under investigation.

Under the new law, Oregon employers still may access information available to the public about the employee or applicant that is accessible on an online account.  Nevertheless, doing so can be risky for other reasons not addressed here.

HB 2654 defines "social media" broadly to include any "electronic medium that allows users to create, share and view user-generated content, including, but not limited to, uploading or downloading videos, still photographs, blogs, video blogs, podcasts, instant messages, electronic mail or Internet website profiles or locations." 

Oregon employers should review their social media policies in light of the new law. 

Questions?  Contact Trish Walsh or Kelly Tilden. 

Back to Top