<-1Providing for social media protection in employment and relating
2to certain educational institutions; establishing a cause of
3action; and prescribing penalties.

<-4Relating to, in labor and employment settings, the protection of
5user names, passwords or other means necessary to access a
6private or personal social media account, service or Internet
7website.

8The General Assembly of the Commonwealth of Pennsylvania
9hereby enacts as follows:

<-10Section 1. Short title.

11This act shall be known and may be cited as the Social Media
12Privacy Protection Act.

13Section 2. Definitions.

14The following words and phrases when used in this act shall
15have the meanings given to them in this section unless the
16context clearly indicates otherwise:

17"Educational institution." A public or private educational
18institution that offers students an organized course of study or

1training that is academic, technical, trade-oriented or
2preparatory for gainful employment in a recognized occupation.

3"Employer." A person, including a State or local government
4entity, engaged in a business, an industry, a profession, a
5trade or other enterprise in this Commonwealth or a unit of
6State or local government. The term includes an agent, a
7representative or a designee of such person.

8"Personal electronic account." An account created through an
9electronic medium or a service that allows users to create,
10edit, store, share or view user-generated content, including
11videos or photographs, blogs, video blogs, podcasts, messages,
12electronic mail, profiles, locations or any other information or
13data.

14"Social media." The term includes, but is not limited to,
15social networking Internet websites and any other forms of media
16or services that involve any means of creating, sharing and
17viewing user-generated information through a personal electronic
18account or Internet website.

19Section 3. Social media privacy protection in employment.

20(a) General rule.--An employer may not:

21(1) Request or require an employee or prospective
22employee to disclose any user name, password or other means
23for accessing private or personal social media.

24(2) Request or require an employee or prospective
25employee to access private or personal social media in the
26presence of the employer.

27(3) Request or require an employee or prospective
28employee to divulge information contained on private or
29personal social media, except as provided under subsection
30(b).

1(4) Discharge, discipline or otherwise penalize or
2threaten to discharge, discipline or otherwise penalize an
3employee for the employee's refusal to disclose any
4information specified under this subsection.

5(5) Fail or refuse to hire any prospective employee as a
6result of the individual's refusal to disclose any
7information specified under this subsection.

8(b) Exceptions.--Nothing in subsection (a) shall be
9construed to prohibit an employer from:

10(1) Promulgating and maintaining workplace policies
11governing the use of the employer's electronic communication
12devices. This includes policies regarding an employee's use
13of the Internet, social media accounts, services or Internet
14websites and e-mail use pertaining to the employer.

15(2) Monitoring the usage of the employer's electronic
16communication devices and nonpersonal accounts or services
17that provide access to the employer's internal computer or
18information systems so long as the employer is in compliance
19with subsection (a).

20(3) Obtaining or viewing any information concerning an
21employee or prospective employee that exists within the
22public domain.

23Section 4. Social media privacy protection in educational
24institutions.

25(a) General rule.--An educational institution may not:

26(1) Request or require a student or prospective student
27to disclose any user name, account name, password or other
28means for accessing private or personal social media.

29(2) Request or require a student or prospective student
30to access private or personal social media in the presence of

1an employee or agent of the educational institution.

2(3) Request or require a student or prospective student
3to divulge information contained in private or personal
4social media, except as provided under subsection (b).

5(4) Expel, discipline, fail to admit or otherwise
6penalize a student or prospective student for failure to
7grant access to, allow observation of or disclose information
8that allows access to or observation of the student's or
9prospective student's private and personal social media.

10(b) Exceptions.--Nothing in subsection (a) shall be
11construed to prohibit an educational institution from:

12(1) Requesting or requiring a student to disclose any
13user name, password or other means for accessing an
14electronic communications device provided and owned by the
15educational institution.

16(2) Monitoring an account or service provided and owned
17by the educational institution.

18(3) Viewing, accessing or utilizing information about a
19student or prospective student that can be obtained without
20any required access information or that is available in the
21public domain.

22Section 5. Cause of action.

23An individual who is the subject of a violation of this act
24may bring a civil action in a court of competent jurisdiction
25against an employer or educational institution within three
26years from the date upon which the violation occurs.

27Section 6. Penalties.

28An employer or educational institution found by a court of
29competent jurisdiction to have violated a provision of this act
30commits a misdemeanor and shall, upon conviction, be sentenced

1to pay a fine of not more than $5,000 per violation, reasonable
2attorney fees and court costs. The court may order an employer
3or educational institution to pay damages to the aggrieved
4individual in an amount not to exceed $1,000 per violation as
5well as to take reasonable corrective actions.

6Section 7. Protection of employees.

7(a) General rule.--It shall be unlawful for an employer to
8discharge, threaten or otherwise discriminate or retaliate
9against an employee regarding the employee's compensation,
10terms, conditions, location or privileges of employment because:

11(1) The employee or any person acting on behalf of the
12employee makes a good faith report, verbally or in writing,
13of an alleged violation of this act.

14(2) The employee is requested to participate in a legal
15action, investigation, hearing or inquiry relating to an
16alleged violation of this act.

17(b) Scope of protection.--Any person who in good faith
18alleges noncompliance with this act shall be afforded the rights
19provided by this act, notwithstanding the person's failure to
20prevail on the merits.

21(c) Rebuttable presumption.--Taking adverse action against
22an employee within 180 days of the person's exercise of rights
23protected under this act shall raise a rebuttable presumption of
24having done so in retaliation for the exercise of those rights.

25Section 8. Effective date.

26This act shall take effect in 60 days.

<-27Section 1. Short title.

28This act shall be known and may be cited as the Social Media
29Privacy Protection Act.

30Section 2. Definitions.

1The following words and phrases when used in this act shall
2have the meanings given to them in this section unless the
3context clearly indicates otherwise:

4"Employer." A person engaged in a business, an industry, a
5profession, a trade or other enterprise in this Commonwealth or
6a unit of State or local government. The term includes an agent,
7a representative or a designee of the employer.

8"Social media." Includes, but is not limited to, social
9networking Internet websites and any other forms of media that
10involve any means of creating, sharing and viewing user-
11generated information through an account, service or Internet
12website.

13Section 3. Privacy protection.

14(a) General rule.--An employer may not request or require
15that an employee or prospective employee disclose any user name,
16password or other means for accessing a private or personal
17social media account, service or Internet website.

18(b) Refusal.--An employer may not do any of the following:

19(1) Discharge, discipline or otherwise penalize or
20threaten to discharge, discipline or otherwise penalize an
21employee for an employee's refusal to disclose any
22information specified under subsection (a).

23(2) Fail or refuse to hire any prospective employee as a
24result of the prospective employee's refusal to disclose any
25information specified under subsection (a).

26(c) Employer's privacy protection.--An employer shall not be
27restricted or limited from any of the following:

28(1) The employer's right to promulgate and maintain
29workplace policies governing the use of an employer's
30electronic communication devices. This includes policies

1regarding the employee's use of the Internet, social media
2accounts, services or Internet websites and e-mail use
3pertaining to the employer.

4(2) The employer's right to monitor the usage of the
5employer's electronic communication devices so long as the
6employer is in compliance with subsections (a) and (b).

7(3) The employer's right to obtain or view any
8information concerning an employee or prospective employee
9that exists within the public domain.

10(d) Penalty.--Any employer who violates subsection (a) or
11(b) shall be subject to a civil penalty of up to $5,000 in
12addition to reimbursement for reasonable attorney fees.

13Section 4. Effective date.

14This act shall take effect in 60 days.