The issue of third-party access to social media accounts is not “new.” The question has popped up in different locales and different contexts repeatedly in the last few years. The primary federal statute – the Electronic Communications Privacy Act (ECPA) – that applies to such activity is even older, dating back to 1986, an age of dial-up internet connections and primitive text-based bulletin boards.
In the absence of federal action to update that statute, states have rushed to fill the breach, with six states enacting so-called (by us) “bullet bills” in 2012 that focus exclusively on employer or educational institution access to social media accounts.
However, just last week several major U.S. companies, including Google and AT&T, urged Congress to update the ECPA. Those companies’ concerns do not focus on this narrow issue, but the momentum they can help to create may lead to perhaps the best opportunity in years for comprehensive revision of the statute.
The issue of access to social media accounts is only one element of the statute that requires attention, but it is among the most interesting. The first reported incident of attempted employer access arose back in 2009, when a municipality in Idaho asked all job applicants to provide their social networking passwords for purposes of background checks. (The municipality quickly dropped that request in the face of public opprobrium.) The issue then seemingly lay dormant until 2011, when correctional authorities in Maryland asked at least one prospective employee to provide the password to his Facebook account. And, at about that same time, reports surfaced that university athletic departments were using Facebook – and requiring student athletes to “friend” a monitor – in order to keep tabs on student athletes.
In each recent instance there was, ostensibly, a reasonable reason for the request: to look for signs of gang affiliation or other security concerns (a problem for prison guards) or to deter and detect potential NCAA violations.
But, not surprisingly, those reports stirred the pot of public concern about the scope of an individual’s privacy interest in information posted to social media websites, and state legislators have increasingly stepped in to pass narrowly tailored bills designed to prohibit the practice. By our count, six states passed measures in 2012, and, so far this year, legislators in at least seven more have introduced similar bills. (Bonus points if you can name the six states with laws in place – answer below.)
So, what’s wrong with states legislating on this specific issue? Aside from the patchwork nature of all state legislation and the difficulties that can create when dealing with electronic media, the bills at issue have side-stepped important questions that (hopefully) would have been fully explored as part of a more deliberative process.
- First, they fail to ask what makes different forms of social media communications worthy of privacy protection. For example, is a wall post or tweet intended for hundreds, or even thousands, of “friends” or “followers” truly “private”?
- Moreover, the bills enacted to date contain no exceptions for security, law-enforcement or other sensitive job categories – an omission that seems a bit at odds with the way those occupations are treated in other settings. For example, many of those jobs may require blood or urine tests or even polygraphs. Is access to a social media account more intrusive than those measures?
The answers to both of those questions well may be “yes,” but, in our view, that debate has not really taken place. Instead, states rush to pass bills designed as “silver bullets” to address the latest perceived outrage.
A far more meaningful way to approach this issue would be for Congress to include social media issues in a comprehensive revision of the Electronic Communications Privacy Act that would include (but not be limited to) the question of access to social media. Perhaps the latest efforts to win revision of the statute finally will bear fruit. The legislative debate certainly will be well worth watching in 2013.
(Answer to “Bonus Points” question: California, Delaware, Illinois, Maryland, Michigan and New Jersey.)