Can an employer ask an applicant or employee for a Facebook password?

No—not if the employer is in Virginia. Virginia has joined other states in taking action to protect the personal online accounts of applicants and employees. On March 23, 2015, Governor McAuliffe signed H.B. 2081 into law and the law takes effect on July 1, 2015.

The new law prohibits an employer from requiring a current or prospective employee to disclose his or her user name and password to a social media account. The law also prohibits an employer from requiring an employee to add an employee, supervisor or administrator to the list of contacts associated with the employee’s social media account (so, for example, prevents a supervisor from requiring an employee to add him as a “friend” on Facebook). Employers are not prohibited under the law from viewing information that is publicly available and employers are also permitted to ask an employee to disclose his or her user name and password in the context of a formal investigation into potential violations of the law or of the employer’s written policies (but the employer must only use the user name and password for those purposes and nothing else).

The law defines social media account to include any “electronic medium or service where users may create, share, or view user-generated content, including, without limitation, videos, photographs, blogs, podcasts, messages, emails, or website profiles or locations.” There are also some important exclusions—including that the law does not apply to any accounts that were opened or set up by an employee for the employer, any accounts that were provided by the employer to the employee, or were set up by an employee to impersonate an employer.