Louisiana's Personal Online Account Privacy Protection Act: Employers, Schools and La. R.S. 51:1951 to 51:1955

Act 165 and Chapter 28

Louisiana enacted its social media password statute as House Bill 340 of the 2014 Regular Session, signed as Act 165. The Legislature's bill record shows an effective date of August 1, 2014. The law sits at Chapter 28 of Title 51, the state's trade and commerce title, and R.S. 51:1951 gives it the name the Legislature chose: the "Personal Online Account Privacy Protection Act." Each of the five sections shows only "Acts 2014, No. 165, §1" as its history, with no later act.

Louisiana wrote two parallel provisions, one for workplaces and one for schools, and the differences between them are this post's subject.

Authentication Information, and Only That

R.S. 51:1953(A) states two employer prohibitions. An employer may not "Request or require an employee or applicant for employment to disclose any username, password, or other authentication information that allows access to the employee's or applicant's personal online account." Nor may it "Discharge, discipline, fail to hire, or otherwise penalize or threaten to penalize" someone for failing to disclose that information.

The object of the prohibition is the credential. The section does not separately forbid asking a worker to add a supervisor as a contact, or to open an account while someone watches; it speaks to disclosing "information that allows access." Subsection E confirms the boundary from the other side: an employer is not restricted from viewing, accessing or using information obtainable without those credentials "or that is available in the public domain." And subsection G leaves an employee free to self-disclose.

A Definition With a Narrow Door

Everything turns on R.S. 51:1952(4). A personal online account is "an online account that the employee, applicant for employment, student, or prospective student uses exclusively for personal communications unrelated to any business purpose of the employer or educational institution." The definition's second sentence takes out "any account or profile created, serviced, maintained, used, or accessed" by the worker or student for business purposes of the employer or institution "or to engage in business-related communications."

"Exclusively" is the word that matters, and the exclusion sentence reaches an account merely "used, or accessed" for those purposes. The Act does not define "business-related communications" or say whether one work message changes an account's status.

"Employer" under 51:1952(3) is "a person, including a unit of state or local government, engaged in a business, industry, profession, trade, or other enterprise in this state," and it includes an agent, representative or designee. No minimum headcount appears.

Employers and Educational Institutions Side by Side

The covered educational institutions in 51:1952(1) run from "A university, college, or junior college" through academies, elementary and secondary schools, extension courses, kindergartens and nursery schools, to "A public or private educational testing service or test administrator" and an agent of an institution. The operative section, R.S. 51:1954, mirrors the employer ban. A school may not request or require credentials from a student or prospective student, and may not "Expel, discipline, fail to admit, or otherwise penalize or threaten to penalize" for refusal.

The parallel stops at the exceptions.

The Employer Exceptions in Detail

Subsection B(3) of 51:1953 covers two kinds of investigation: one where "there is specific information about activity on the employee's personal online account," for compliance with laws, regulatory requirements or prohibitions on work-related misconduct, and one where the employer has specific information about an unauthorized transfer of proprietary, confidential or financial data. Subsection B(4) adds that the investigation may include "requiring the employee or applicant to share the content that has been reported in order to make a factual determination," so long as the employer does so without obtaining the username and password.

Two further clauses address specific situations. Subsection C addresses the monitoring accident: if network or device monitoring brings in a credential by inadvertence, the employer "shall not be liable for having the information, but shall not use the information to access" the account. Subsection F permits an employer to require a personal e-mail address so it can reach an employee "in the event the employer's e-mail system fails."

Subsection D preserves screening and monitoring duties grounded in "state or federal law, rules or regulations, case law, or rules of self-regulatory organizations," language that reaches beyond statutes to industry self-regulators. Comparable password statutes are discussed in our posts on Maine, New Hampshire and Wisconsin, and the wider picture is in the employee privacy guide.

What the Act Says About Liability

The chapter's final section is short and runs in one direction. R.S. 51:1955(A) states that the chapter "shall not create a duty for an employer or educational institution to search or monitor the activity of an individual's personal online account." Subsection B adds that neither may be held liable under the chapter "for failure to request or require" that a person disclose information that allows access to the account.

No section prescribes a fine, assigns enforcement to an agency, or creates a civil cause of action for a breach of 51:1953 or 51:1954. The Act's text is silent on what follows a violation, and the sections of Chapter 28 do not cross-reference any other enforcement statute. No court decision applying these sections was identified in the searches run for this post, so no enforcement history is recorded here.

Frequently Asked Questions