What's happening
This bill prohibits employers and educational institutions from requesting or requiring access to employees' or students' personal online accounts, with limited exceptions.
Why it matters
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Protect Online Account Privacy
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to labor
- Referred to labor
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect Online Account Privacy
In Assembly Committee · Labor · Sponsor David Buchwald
Full text
5 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
2728
2019-2020 Regular Sessions
IN SENATE
January 29, 2019
Introduced by Sen. KRUEGER -- read twice and ordered printed, and when printed to be committed to the Committee on Labor
AN ACT to amend the labor law, in relation to the "uniform employee and student online privacy protection act"
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. This act shall be known and may be cited as the "uniform employee and student online privacy protection act".
§ 2. The labor law is amended by adding a new article 33 to read as follows:
ARTICLE 33
UNIFORM EMPLOYEE AND STUDENT
ONLINE PRIVACY PROTECTION ACT Section 950. Definitions.
951. Protection of employee online accounts.
952. Protection of student online accounts.
953. Civil action.
954. Uniformity of application and construction.
955. Relation to electronic signatures in global and national
commerce act.
§ 950. Definitions. As used in this article:
1. "content" means information, other than login information, that is contained in a protected personal online account, accessible to the account holder, and not publicly available.
2. "educational institution" means a person that provides students at the postsecondary level an organized program of study or training which is academic, technical, trade-oriented, or preparatory for gaining employment and for which the person gives academic credit. The term includes both a public or private institution and also applies to any agent or designee of the educational institution.
3. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD06196-01-9
S. 2728 2
4. "employee" means an individual who provides services or labor to an employer in exchange for salary, wages, or the equivalent or, for an unpaid intern, academic credit or occupational experience including independent contractors. The term includes a prospective employee who:
(a) has expressed to the employer an interest in being an employee; or
(b) has applied to or is applying for employment by, or is being recruited for employment by, the employer.
5. "employer" means a person that provides salary, wages, or the equivalent to an employee in exchange for services or labor or engages the services or labor of an unpaid intern. The term includes an agent or designee of the employer.
6. "login information" means a user name and password, password, or other means or credentials of authentication required to access or control of a protected personal online account or an electronic device, which the employee's employer or the student's educational institution has not supplied or paid for in full, that itself provides access to or control over the account.
7. "login requirement" means a requirement that login information be provided before an online account or electronic device can be accessed or controlled.
8. "online" means accessible by means of a computer network or the internet.
9. "person" means an individual, estate, business or nonprofit entity, public corporation, government or governmental subdivision, agency, or instrumentality, or other legal entity.
10. "protected personal online account" means an employee's or student's online account that is protected by a login requirement. The term does not include an online account or the part of an online account that is publicly available. The term also does not include an online account or the part of an online account that the employer or educational institution has notified the employee or student might be subject to a request for login information or content, and which:
(a) the employer or educational institution supplies or pays for in full; or
(b) the employee or student creates, maintains, or uses primarily on behalf of or under the direction of the employer or educational institution in connection with the employee's employment or the student's education.
11. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form.
12. "student" means an individual who participates in an educational institution's organized program of study or training. The term includes:
(a) a prospective student who expresses to the institution an interest in being admitted to, applies for admission to, or is being recruited for admission by, the educational institution; and
(b) a parent or legal guardian of a student under the age of eighteen.
§ 951. Protection of employee online accounts. 1. Subject to the exceptions in subdivision two of this section, an employer may not:
(a) require, coerce, or request an employee to:
(i) disclose the login information for a protected personal online account;
(ii) disclose the content of the account, except that an employer may request an employee to add the employer to, or not remove the employer from, the set of persons to which the employee grants access to the content;
S. 2728 3
(iii) alter the settings of the online account in a manner that makes the login information for, or content of, the account more accessible to others; or
(iv) access the account in the presence of the employer in a manner that enables the employer to observe the login information for or content of the account; or
(b) take, or threaten to take, adverse action against an employee for failure to comply with:
(i) an employer requirement, coercive action, or request that violates paragraph (a) of this subdivision; or
(ii) an employer request under subparagraph (ii) of paragraph (a) of this subdivision to add the employer to, or not remove the employer from, the set of persons to which the employee grants access to the content of a protected personal online account.
2. Nothing in subdivision one shall prevent an employer from:
(a) accessing information about an employee which is publicly available;
(b) complying with a federal or state law, court order, or rule of a self-regulatory organization established by federal or state statute, including a self-regulatory organization defined in section 3(a)(26) of the securities and exchange act of 1934, 15 U.S.C. § 78c(a)(26); or
(c) requiring or requesting, based on specific facts about the employee's protected personal online account, access to the content of, but not the login information for, the account in order to:
(i) ensure compliance, or investigate non-compliance, with federal or state law or an employer prohibition against work-related employee misconduct of which the employee has reasonable notice, which is in a record, and which was not created primarily to gain access to a protected personal online account; or
(ii) protect against a threat to safety, a threat to employer information technology or communications technology systems or to employer property, or disclosure of information in which the employer has a proprietary interest or information the employer has a legal obligation to keep confidential.
3. An employer that accesses employee content for a purpose specified in paragraph (c) of subdivision two of this section:
(a) shall attempt reasonably to limit its access to content that is relevant to the specified purpose;
(b) shall use the content only for the specified purpose; and
(c) may not alter the content unless necessary to achieve the specified purpose.
4. An employer that acquires the login information for an employee's protected personal online account by means of otherwise lawful technology that monitors the employer's network, or employer-provided devices, for a network security, data confidentiality, or system maintenance purpose:
(a) may not use the login information to access or enable another person to access the account;
(b) shall make a reasonable effort to keep the login information secure;
(c) unless otherwise provided in paragraph (d) of this subdivision, shall dispose of the login information as soon as, as securely as, and to the extent reasonably practicable; and
(d) shall, if the employer retains the login information for use in an ongoing investigation of an actual or suspected breach of computer, network, or data security, make a reasonable effort to keep the login
S. 2728 4
information secure and dispose of it as soon as, as securely as, and to the extent reasonably practicable after completing the investigation.
§ 952. Protection of student online accounts. 1. Subject to the exceptions in subdivision two of this section, an educational institution may not:
(a) require, coerce, or request a student to:
(i) disclose the login information for a protected personal online account;
(ii) disclose the content of the account, except that an educational institution may request a student to add the educational institution to, or not remove the educational institution from, the set of persons to which the student grants access to the content;
(iii) alter the settings of the account in a manner that makes the login information for or content of the account more accessible to others; or
(iv) access the account in the presence of the educational institution in a manner that enables the educational institution to observe the login information for or content of the account; or
(b) take, or threaten to take, adverse action against a student for failure to comply with:
(i) an educational institution requirement, coercive action, or request, that violates paragraph (a) of this subdivision; or
(ii) an educational institution request under subparagraph (ii) of paragraph (a) of this subdivision to add the educational institution to, or not remove the educational institution from, the set of persons to which the student grants access to the content of a protected personal online account.
2. nothing in subdivision one of this section shall prevent an educational institution from:
(a) accessing information about a student that is publicly available;
(b) complying with a federal or state law, court order, or rule of a self-regulatory organization established by federal or state statute; or
(c) requiring or requesting, based on specific facts about the student's protected personal online account, access to the content of, but not the login information for, the account in order to:
(i) ensure compliance, or investigate non-compliance, with federal or state law or an educational institution prohibition against educationrelated student misconduct of which the student has reasonable notice, which is in a record, and which was not created primarily to gain access to a protected personal online account; or
(ii) protect against a threat to safety, a threat to educational institution information technology or communications technology systems or to educational institution property, or disclosure of information in which the educational institution has a proprietary interest or information the educational institution has a legal obligation to keep confidential.
3. An educational institution that accesses student content for a purpose specified in paragraph (c) of subdivision two of this section:
(a) shall attempt reasonably to limit its access to content that is relevant to the specified purpose;
(b) shall use the content only for the specified purpose; and
(c) may not alter the content unless necessary to achieve the specified purpose.
4. An educational institution that acquires the login information for a student's protected personal online account by means of otherwise lawful technology that monitors the educational institution's network,
S. 2728 5
or educational institution-provided devices, for a network security, data confidentiality, or system maintenance purpose:
(a) may not use the login information to access or enable another person to access the account;
(b) shall make a reasonable effort to keep the login information secure;
(c) unless otherwise provided in paragraph (d) of this subdivision, shall dispose of the login information as soon as, as securely as, and to the extent reasonably practicable; and
(d) shall, if the educational institution retains the login information for use in an ongoing investigation of an actual or suspected breach of computer, network, or data security, make a reasonable effort to keep the login information secure and dispose of it as soon as, as securely as, and to the extent reasonably practicable after completing the investigation.
§ 953. Civil action. 1. The attorney general may bring a civil action against an employer or educational institution for a violation of this article. A prevailing attorney general may obtain:
(a) injunctive and other equitable relief; and
(b) a civil penalty of up to one thousand dollars for each violation, but not exceeding one hundred thousand dollars for all violations caused by the same event.
2. An employee or student may bring a civil action against the individual's employer or educational institution for a violation of this article. A prevailing employee or student may obtain:
(a) injunctive and other equitable relief;
(b) actual damages; and
(c) costs and reasonable attorney's fees.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the labor law, in relation to the "uniform employee and student online privacy protection act"
Summary of specific provisions
Section 1 of the bill states that the act shall be known as the "Uniform Employee and Student Online Privacy Protection Act."
Section 2 states that the Labor Law is amended by adding a new article 33 entitled the "Uniform Employee and Student Online Privacy Protection Act."
Read the full memo (715 words)
Proposed new section 950 of the Labor Law establishes definitions used throughout the article.
Proposed new section 951 of the Labor Law delineates protections for employee protected personal online accounts and provides for necessary exceptions to these protections.
Proposed new section 952 of the Labor Law delineates protections for student protected personal online accounts and provides for necessary exceptions to these protections.
Proposed new section 953 of the Labor Law provides remedies for violations of the act, including a private right of action. Proposed new section 954 of the Labor Law states that in applying and construct- ing this law, consideration must be given to the need to promote uniformity of the law with respect to its subject matter among states that enact it.
Proposed new section 955 of the Labor Law states how this article relates to the Electronic Signatures in Global and National Commerce Act.
Section 3 provides a severability clause
Section 4 states that this act shall take effect immediately.
Justification
In today's day and age, most individuals possess an online account of some form. These include social media accounts, bank accounts, and email accounts among others. Generally, when someone asks for access to the login information for, or non-public content of, a personal online account, an individual is free to say "no." However, that is not always the case in the employment and educational contexts. Employers may have the power to coerce access to personal online accounts of individuals who are, or seek to become, their employees. Similarly, educational institutions may have coercive power over those who are, or seek to become, their students. When an employer or educational institution asks for the login information for, or non-public content of, an employee's or student's online account, that person may find it difficult to refuse. A growing number of reports in recent years show an increasing trend where employers and educational institutions have demanded and received access to personal online accounts. This legislation, imple- ments a proposal of the Uniform Law Commission, as such, it will serve as a guidepost for legislation pertaining to employees and students online privacy across the nation. Its uniformity will allow other states to enact similar privacy legislation, thereby creating a consistent and uniform set of protections and guidelines across the country, rather than each state passing singular pieces of legislation. The Uniform Law Commission ULC members must be lawyers, qualified to practice law. They are not only practicing lawyers but also judges, legislators and legis- lative staff and law professors, who have been appointed by state governments as well as the District of Columbia, Puerto Rico and the U.S. Virgin Islands to research, draft and promote enactment of uniform state laws in areas of state law where uniformity is desirable and prac- tical.
The state uniform law commissioners come together as the Uniform Law Commission for one purpose which is to study and review the law of the states to determine which areas of law should be uniform. The commis- sioners promote the principle of uniformity by drafting and proposing specific statutes in areas of the law where uniformity between the states is desirable.
Impact on regulation of business and individuals
Prevents employers and educational institutions from coercing access to employee's and student's personal online accounts.
Fiscal implications
Minimal.
Effect on fines, terms of imprisonment and other penal sanctions
The Attorney General may bring a civil action against an employer or educational institution for a violation of this article to obtain an injunction and a civil penalty of up to one thousand dollars for each violation, but not exceeding one hundred thousand dollars for all violations caused by the same event. A private right of action can obtain an injunction, actual damages, costs and reasonable attorney's fees.
Prior legislative history
2017-18: S.7808/A.5995 Buchwald - Labor
Effective date
Immediately
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.