An Act To Protect Social Media Privacy in School and the Workplace
Be it enacted by the People of the State of Maine as follows:
Sec. 1. 20-A MRSA c. 804 is enacted to read:
CHAPTER 804
SOCIAL MEDIA PRIVACY IN EDUCATION
§ 19351. Definitions
As used in this chapter, unless the context otherwise indicates, the following terms have the following meanings.
1. Applicant. "Applicant" means an applicant for admission to an educational institution.
2. Educational institution. "Educational institution" means:
A. A public or private school;
B. A school administrative unit;
C. An accredited Maine community college, college or university as defined in section 12541, subsection 1; or
D. A career and technical education center, as described in section 8301-A, subsection 3.
3. Personal e-mail account. "Personal e-mail account" means an account with an electronic medium or service through which users may send or receive e-mail delivered by transmission over the Internet. "Personal e-mail account" does not include an account opened at an educational institution's behest, or provided by an educational institution, that is intended to be used solely on behalf of the educational institution.
4. Social media account. "Social media account" means an account with an electronic medium or service through which users create, share and view user-generated content, including, but not limited to, uploading or downloading videos or still photographs, blogs, video blogs, podcasts, messages, e-mails and website profiles or locations. "Social media account" does not include an account opened at an educational institution's behest, or provided by an educational institution, that is intended to be used solely on behalf of the educational institution.
5. Student. "Student" means a student, participant or trainee, whether full-time or part-time, in an organized course of study at an educational institution.
§ 19352. Prohibition on educational institution
An educational institution may not:
1. Disclosure for access. Require or cause a student or applicant to disclose, or request or suggest that a student or applicant disclose, the username, password or any other means for access, or provide access through the username, password or other means, to a social media account or personal e-mail account;
2. List of contacts. Compel a student or applicant, as a condition of acceptance or participation in curricular or extracurricular activities, to add anyone, including a coach, teacher, school administrator or other school employee or school volunteer, to that student's or applicant's list of contacts associated with a social media account or personal e-mail account or require or cause a student or applicant to change, or request or suggest that a student or applicant change, the privacy settings associated with a social media account or personal e-mail account;
3. Punitive action against student. Take action or threaten to take action to discharge, discipline, prohibit from participating in curricular or extracurricular activities or otherwise penalize a student for a student's refusal to disclose any information specified in subsection 1 or for refusal to add anyone, including a coach, teacher, school administrator or other school employee or school volunteer, to the student's list of contacts associated with a social media account or personal e-mail account or to change the privacy settings associated with a social media account or personal e-mail account; or
4. Punitive action against applicant. Fail or refuse to admit an applicant as a result of the applicant's refusal to disclose any information specified in subsection 1 or for refusal to add anyone, including a coach, teacher, school administrator or other school employee or school volunteer, to the applicant's list of contacts associated with a social media account or personal e-mail account or to change the privacy settings associated with a social media account or personal e-mail account.
§ 19353. Application to publicly available information
This chapter does not apply to information about an applicant or a student that is publicly available.
§ 19354. Penalty; harassment; enforcement; defense
The following provisions apply to a violation of this chapter.
1. Penalty. An educational institution that violates section 19352 is subject to a fine of not more than $1,000. A student or applicant may bring a civil action to enjoin a violation of section 19352 and may recover not more than $1,000 in damages plus reasonable attorney's fees and court costs. If the educational institution has discharged a student in violation of section 19352, the educational institution shall reinstate that student.
2. Harassment. In addition to the liability imposed under subsection 1, an educational institution that, in violation of section 19352, requires or repeatedly attempts to require an applicant or student to disclose the username, password or other means for access, or provide access through the username, password or other means, to a social media account or personal e-mail account:
A. Is subject to a civil penalty not to exceed $1,000, payable to the affected applicant or student, to be recovered in a civil action; and
B. For any subsequent offense against the same applicant or student, is subject to a civil penalty of $2,000, payable to the affected applicant or student, to be recovered in a civil action.
3. Enforcement by Attorney General. The Attorney General or an affected student or applicant may bring an action to enforce this chapter. The Attorney General may:
A. Collect the judgment on behalf of the student or applicant; or
B. Supervise the payment of the judgment and the reinstatement of the student.
4. Defense. It is an affirmative defense to an action brought under this section that the educational institution acted to comply with federal law or laws of this State.
Sec. 2. 26 MRSA c. 7, sub-c. 11 is enacted to read:
SUBCHAPTER 11
SOCIAL MEDIA PRIVACY IN THE WORKPLACE
§ 876. Definitions
As used in this subchapter, unless the context otherwise indicates, the following terms have the following meanings.
1. Applicant. "Applicant" means an applicant for employment.
2. Employee. "Employee" means a person who is permitted, required or directed by an employer to engage in employment for consideration of direct or indirect gain or profit. "Employee" includes an independent contractor.
3. Employer. "Employer" means a person, partnership, corporation, association or other legal entity, public or private, including an agent, representative or designee of that person, partnership, corporation, association or other legal entity, that employs one or more employees.
4. Personal e-mail account. "Personal e-mail account" means an account with an electronic medium or service through which users may send or receive e-mail delivered by transmission over the Internet. "Personal e-mail account" does not include an account opened at an employer's behest, or provided by an employer, that is intended to be used solely on behalf of the employer.
5. Social media account. "Social media account" means an account with an electronic medium or service through which users create, share and view user-generated content, including, but not limited to, uploading or downloading videos or still photographs, blogs, video blogs, podcasts, messages, e-mails and website profiles or locations. "Social media account" does not include an account opened at an employer's behest, or provided by an employer, that is intended to be used solely on behalf of the employer.
§ 877. Prohibition on employer
An employer may not:
1. Disclosure. Require or cause an employee or applicant to disclose, or request or suggest that an employee or applicant disclose, the username, password or any other means for access, or provide access through the username, password or other means, to a social media account or personal e-mail account;
2. Contact list. Compel an employee or applicant to add anyone, including the employer or the employer's agent, to the employee's or applicant's list of contacts associated with a social media account or personal e-mail account or require or cause an employee or applicant to change, or request or suggest that an employee or applicant change, the privacy settings associated with a social media account or personal e-mail account;
3. Punitive action against employee. Take action or threaten to take action to discharge, discipline or otherwise penalize an employee for an employee's refusal to disclose any information specified in subsection 1 or for refusal to add anyone, including the employer or the employer's agent, to the employee's list of contacts associated with a social media account or personal e-mail account or to change the privacy settings associated with a social media account or personal e-mail account; or
4. Punitive action against applicant. Fail or refuse to hire an applicant as a result of the applicant's refusal to disclose any information specified in subsection 1 or for refusal to add anyone, including the employer or the employer's agent, to the applicant's list of contacts associated with a social media account or personal e-mail account or to change the privacy settings associated with a social media account or personal e-mail account.
§ 878. Application to publicly available information
This subchapter does not apply to information about an applicant or an employee that is publicly available.
§ 879. Remedies; harassment; enforcement; defense
The following provisions apply to a violation of this subchapter.
1. Remedies. An employer who violates section 877 is liable to an employee or applicant who is the subject of the violation for the following:
A. An amount equal to 3 times any lost wages;
B. Reinstatement, with full benefits, of the employee to the employee's position at the time of the violation or employment of the applicant in the position applied for by the applicant;
C. Civil damages of no more than $1,000;
D. Court costs; and
E. Reasonable attorney's fees.
2. Harassment. In addition to the liability imposed under subsection 1, an employer who requires or repeatedly attempts to require an employee or applicant to disclose the username, password or any other means for access, or provide access through the username, password or other means, to a social media account or personal e-mail account:
A. Is subject to a civil penalty not to exceed $1,000, payable to the affected employee or applicant, to be recovered in a civil action; and
B. For any subsequent offense against the same employee or applicant, is subject to a civil penalty of $2,000, payable to the affected employee or applicant to be recovered in a civil action.
3. Enforcement. The Attorney General or an affected employee or applicant may bring an action to enforce this subchapter. The Attorney General may:
A. Collect the judgment on behalf of the employee or applicant; or
B. Supervise the payment of the judgment and the reinstatement of the employee or the employment of the applicant.
4. Defense. It is an affirmative defense to an action brought under this section that the employer acted to comply with federal law or laws of this State.
SUMMARY
This bill prohibits an employer or educational institution, whether public or private, from requiring or requesting an employee or a student, or a prospective employee or student, to disclose the username or account password for a personal social media account or e-mail account or to otherwise provide the employer or institution with access to those accounts.