January 1, 2018: Vermont’s New Social-Media Privacy Law Goes Into Effect

Under the new law, 21 V.S.A. § 4951, Vermont employers may not compel employees or job applicants to allow the employer to access the employee’s or applicant’s personal social media accounts, including videos, photographs, blogs, podcasts, instant or text messages, emails, online services or accounts, or internet website profiles or locations.  Specifically, employers may not require, request, or coerce an employee or applicant to do any of the following:

1. Disclose a username, password, or other means of authentication, or turn over an unlocked personal electronic device for the purpose of accessing the employee’s or applicant’s social media;
2. Access a social media account in the presence of the employer;
3. Divulge or present any content from the employee’s or applicant’s social media account;
4. Change the account or the privacy settings of the employee’s or applicant’s social media account to increase third-party access to its contents;
5. Add anyone, including the employer, to the employee’s or applicant’s list of contacts associated with a social media account.

Any agreement by an employee to waive his or her rights under this law will be invalid. However, the terms of the statute may allow for a job applicant to waive these rights.
The law does not preclude an employer from requesting an employee to share specifically-identified social media content (not including usernames, passwords or means of authentication), for the purpose of: (1) complying with the employer’s legal and regulatory obligations; (2) investigating an allegation of an unauthorized transfer or disclosure of an employer’s proprietary or confidential information or financial data through an employee’s or an applicant’s social media account; or (3) investigating an allegation of unlawful harassment, threats of violence in the workplace, or discriminatory or disparaging content concerning another employee.  However, the law does not expressly allow the employer to require an employee to share this information.  An employer may request or require an employee to provide a username or password that is necessary to access an employer-issued electronic device.  

The law also has separate rules for law enforcement agencies.

An employer may not discharge or otherwise retaliate against an employee who exercises or attempts to exercise his or her rights under this law.  

An employee who alleges that the employer violated this law may bring a civil action and could potentially be entitled to compensatory and punitive damages, or equitable relief, including restraint of prohibited acts, restitution of wages or other benefits, reinstatements, costs, reasonable attorney’s fees, and other appropriate relief. 

http://legislature.vermont.gov/statutes/section/21/005/00495l