§ 201-I — Request for access to personal accounts prohibited

§ 201-i. Request for access to personal accounts prohibited. 1. For\npurposes of this section, the following words shall have the following\nmeanings:\n (a) "Applicant" means an applicant for employment.\n (b) "Electronic communications device" means any device that uses\nelectronic signals to create, transmit, and receive information,\nincluding, but not limited to computers, telephones, personal digital\nassistants and other similar devices.\n (c) "Employer" means (i) a person or entity engaged in a business,\nindustry, profession, trade or other enterprise in the state; (ii) the\nstate of New York; (iii) a county, city, town, village or any other\npolitical subdivision or civil division of the state; (iv) a school\ndistrict or any government entity operating a public school, college, or\nuniversity; (v) a public improvement or special district; (vi) a public\nauthority, commission or public benefit corporation; or (vii) any other\npublic corporation, agency, instrumentality or unit of government which\nexercises governmental power under the laws of the state; and (viii)\nshall include an agent, representative or designee of the employer.\n (d) "Personal account" means an account or profile on an electronic\nmedium where users may create, share, and view user-generated content,\nincluding uploading or downloading videos or still photographs, blogs,\nvideo blogs, podcasts, instant messages, or internet website profiles or\nlocations that is used by an employee or an applicant exclusively for\npersonal purposes.\n 2. (a) Except as provided in paragraph (b) of this subdivision, it\nshall be unlawful for any employer to request, require or coerce any\nemployee or applicant for employment to:\n (i) disclose any user name and password, password, or other\nauthentication information for accessing a personal account through an\nelectronic communications device;\n (ii) access the employee's or applicant's personal account in the\npresence of the employer; or\n (iii) reproduce in any manner photographs, video, or other information\ncontained within a personal account obtained by the means prohibited in\nthis paragraph.\n (b) An employer may require an employee to disclose any user name,\npassword or other means for accessing nonpersonal accounts that provide\naccess to the employer's internal computer or information systems.\n (c) For the purposes of this section, "access" shall not include an\nemployee or applicant voluntarily adding an employer, agent of the\nemployer, or employment agency to their list of contacts associated with\na personal internet account.\n 3. An employer may not:\n (a) Discharge, discipline, or otherwise penalize or threaten to\ndischarge, discipline, or otherwise penalize an employee for an\nemployee's refusal to disclose any information specified in paragraph\n(a) of subdivision two of this section; or\n (b) Fail or refuse to hire any applicant as a result of the\napplicant's refusal to disclose any information specified in paragraph\n(a) of subdivision two of this section.\n 4. It shall be an affirmative defense to an action under this section\nthat the employer acted to comply with requirements of a federal, state\nor local law.\n 5. (a) Nothing in this section shall prohibit an employer from:\n (i) requesting or requiring an employee to disclose access information\nto an account provided by the employer where such account is used for\nbusiness purposes and the employee was provided prior notice of the\nemployer's right to request or require such access information;\n (ii) requesting or requiring an employee to disclose access\ninformation to an account known to an employer to be used for business\npurposes;\n (iii) accessing an electronic communications device paid for in whole\nor in part by the employer where the provision of or payment for such\nelectronic communications device was conditioned on the employer's right\nto access such device and the employee was provided prior notice of and\nexplicitly agreed to such conditions. However, nothing in this\nsubparagraph shall permit an employer to access any personal accounts on\nsuch device;\n (iv) complying with a court order in obtaining or providing\ninformation from, or access to, an employee's accounts as such court\norder may require;\n (v) restricting or prohibiting an employee's access to certain\nwebsites while using an employer's network or while using an electronic\ncommunications device paid for in whole or part by the employer where\nthe provision of or payment for such electronic communications device\nwas conditioned on the employer's right to restrict such access and the\nemployee was provided prior notice of and explicitly agreed to such\nconditions.\n (b) This section does not prohibit or restrict an employer from\ncomplying with a duty to screen employees or applicants prior to hiring\nor to monitor or retain employee communications that is established\nunder federal law or by a self regulatory organization, as defined in\nsection 3(a)(26) of the securities and exchange act of 1934, 15 USC\n§78c(a)(26).\n (c) This section does not prohibit or restrict an employer from\nviewing, accessing, or utilizing information about an employee or\napplicant that can be obtained without any required access information,\nthat is available in the public domain, or for the purposes of obtaining\nreports of misconduct or investigating misconduct, photographs, video,\nmessages, or other information that is voluntarily shared by an\nemployee, client, or other third party that the employee subject to such\nreport or investigation has voluntarily given access to contained within\nsuch employee's personal account.\n 6. The provisions of this section shall not apply to any law\nenforcement agency, a fire department or a department of corrections and\ncommunity supervision.\n