New Law Restricts District Rights To Employee and Student Personal Internet Accounts

Steve Zach , Jennifer S. Mirus , Rick Verstegen | 04.25.14

New Law Restricts District Rights To Employee and Student Personal Internet Accounts

On April 10, 2014, ​“The Wisconsin Social Media Protection Act” took effect. The new social media law places restrictions on the activities of employers and educational institutions in accessing and observing the personal Internet accounts of employees, applicants for employment, students, and prospective students. The definitions of ​“employer” and ​“educational institution” both encompass public school districts; therefore, districts must comply with the new law with respect to its employees and its students.

The general aim of the new social media law is to protect individual privacy rights in ​“personal Internet accounts,” which is defined as Internet-based accounts that are created and used by an individual exclusively for the purpose of personal communications. Common Internet accounts are Facebook, Twitter, Instagram, Snapchat, and Internet blogs. Districts are often faced with issues regarding information posted and accessed on accounts from devices supplied by the district and from personal electronic devices. The new social media law establishes restrictions on a district’s ability to require an employee or student to provide access to these accounts. While the new law also puts restriction on landlords, this FYI addresses what districts may and may not do with respect to personal Internet accounts of district employees and students.

School District as Employer

As an employer, a district is prohibited under the new law from:

• Requesting or requiring an employee or applicant, as a condition of employment, to disclose access information to a personal Internet account or to otherwise grant access to or allow observation of the account.
• Terminating or otherwise discriminating against an employee because the employee: 
  • refused to provide the employer access to a personal Internet account; or
  • opposed the employer’s potential violation of the law, or filed a complaint or testified or assisted in an action against the employer for such a violation.
• Refusing to hire an applicant because the applicant refused to provide access to a personal Internet account.

Under the law, a district still retains these important rights as an employer:

• Districts may require access to personal Internet accounts in order to gain access to an electronic communications device (such as a computer or cell phone) supplied by or paid for by the district.
• Districts may require account access to an account or service provided by the district, obtained by the district due to the employee’s employment, or which is used for the district’s business.
• Districts may discipline or discharge an employee for transferring the district’s confidential or financial information to the employee’s personal Internet account without the district’s authorization.
• Districts may require an employee to grant access to or allow observation of the employee’s personal Internet account in certain instances: (1) if there is a reasonable belief that the employee has transferred confidential or financial information without authorization to the employee’s personal Internet account or (2) if there is a reasonable belief that activity on the employee’s personal Internet account relates to other work‑related misconduct or violation. Districts are not permitted to require the disclosure of personal Internet account access information in such cases.
• Districts may comply with a duty to screen applicants for employment prior to hiring and may comply with a duty to retain employee communications that is established under state or federal law, rules, or regulations.

In addition, nothing in the new social media law prohibits districts from (1) restricting employee access to Internet sites on district equipment or using the district’s network, (2) viewing information about applicants or employees that is publicly available without personal Internet account access information, or (3) requiring an employee to disclose a personal email address. Further, a district that inadvertently obtains access information, through the use of an electronic device or program that monitors the district’s network or through an electronic communications device supplied or paid for in whole or in part by the district, is not liable for possessing that access information, so long as the district does not use that access information to access the employee’s personal Internet account.

The new social media law applies to all district employees. However, if a district employee is affected by a collective bargaining agreement that contains provisions that are inconsistent with Act 208, the Act is effective when the collective bargaining agreement expires, or is extended, modified, or renewed.

School District as Educational Institution

As an educational institution, districts are prohibited under the law from:

• Requesting or requiring a student or prospective student, as a condition of admission or enrollment, to disclose access information for the personal Internet account of the student or prospective student or to otherwise grant access to or allow observation of that account.
• Expelling, suspending, disciplining, or otherwise penalizing any student for refusing to disclose access information for, grant access to, or allow observation of the student’s personal Internet account, opposing a prohibited practice with respect to personal Internet accounts, filing a complaint or attempting to enforce a right protected by the statute, or testifying or assisting in any action or proceeding to enforce such right.
• Refusing to admit a prospective student because the prospective student refused to disclose access information for, grant access to, or allow observation of the prospective student’s personal Internet account.

Educational institutions also retain certain important rights related to students and prospective students:

• Districts may request or require a student to disclose access information to the district in order for the district to gain access to or operate an electronic communications device supplied or paid for in whole or in part by the district, or in order for the district to gain access to an account or services provided by the district, obtained by virtue of the student’s admission to the district, or used for educational purposes.
• Districts may view, access, or use information about a student or prospective student that can be obtained without access information or that is available in the public domain.

No Duty to Monitor

The new social media law does not create any duty for a district as an employer or educational institution to search or monitor the activity of any personal Internet account. Further, a district is not liable under the statute for failing to request or require that an employee, applicant, student, or prospective student grant access to, allow observation of, or disclose information that allows access to or observation of a personal Internet account.

Violating the Law

A district that violates the new law’s provisions is subject to a $1,000 forfeiture. In addition, in the event a district does not hire an applicant or terminates an employee in violation of the statute, the applicant or employee can pursue a claim against the district under the Wisconsin Fair Employment Act. Further, a person who has been discharged, expelled, disciplined, or otherwise discriminated against in violation of the Act may file a complaint with Department of Workforce Development, which may take action to remedy the violation in the same manner as employment or housing discrimination complaints.

Conclusion

Districts should plan to review existing policies and procedures as they relate to social media, Internet use, and acceptable use with respect to both staff and students and revise if necessary to comport with this new law. In particular, districts should be mindful of employee and student rights with respect to account information on personal electronic devices, unless those devises are used in connection with an account or service provided by the district or the information is accessible under one of the narrow exceptions addressed above. In addition, districts should provide training to the school board and to staff regarding the privacy rights of employees and students in personal Internet accounts and delineate the circumstances in which those rights are limited.