Maine's Employee Social Media Privacy Subchapter: 26 MRSA 615 to 619

Part B of a Domestic Violence Leave Bill

Maine's rule on employer access to personal social media did not pass as a bill of its own. It was attached as Part B of Public Law 2015, chapter 343, "An Act To Strengthen the Right of a Victim of Sexual Assault or Domestic Violence To Take Necessary Leave from Employment and To Promote Employee Social Media Privacy." Part A of that law rewrote the penalties for denying leave under 26 MRSA 850. Part B enacted a new subchapter 1-C, headed "Employee Social Media Privacy," in chapter 7 of Title 26, Employment Practices. Part C appropriated money for a half-time Labor and Safety Inspector position, described as covering "the additional enforcement requirements associated with the disclosure of personal social media account information" and the leave rules.

The legislative history record for LD 921 shows that the bill began with only the leave provisions. Its title changed through Senate Amendment S-323 to Committee Amendment H-240, and it was "Enacted, Unsigned 07/12/15" as chapter 343. The committee's digest of bill summaries states that Part B "incorporates the substance of LD 686, as amended by Committee Amendment 'A' to that bill." LD 686, "An Act To Promote Privacy in Social Media," went to the Judiciary Committee and, according to its own history record, "Died On Adjournment 07/16/15." The chapter law states that it took effect 90 days after adjournment of the First Regular Session of the 127th Legislature.

The chapter 7 table of contents lists the subchapter's five sections today: Definitions (615), Prohibitions (616), Exceptions (617), Workplace policies (618) and Penalties for violation (619). Each section's history note reads "PL 2015, c. 343, Pt. B, §1 (NEW)" and shows no later amendment.

What 26 MRSA 616 Prohibits

The definitions in section 615 decide who is bound and what is protected. An "employer" is "a person in this State who employs individuals," including the State and its political subdivisions and "a person acting in the interest of an employer directly or indirectly." The text sets no minimum number of employees. A "social media account" is an account with an electronic medium or service "through which users create, share and view user-generated content," followed by a list that names videos, photographs, blogs, podcasts, "instant and text messages, e-mail, online service accounts and Internet website profiles and locations." Excluded is any account "opened at an employer's behest or provided by an employer or intended to be used primarily on behalf of an employer."

Section 616 then lists what "an employer may not" do. Five subsections concern demands made of a worker or job seeker:

1. Subsection 1, Passwords: require, coerce or request disclosure of "the password or any other means for accessing a personal social media account"
2. Subsection 2, Access in presence: require, coerce or request that the person access a personal account "in the presence of the employer or an agent of the employer"
3. Subsection 3, Information: require or coerce disclosure of "any personal social media account information"
4. Subsection 4, Contacts: require or cause the person to add anyone, the employer or its agent included, to the contact list of a personal account
5. Subsection 5, Settings: require, cause or request a change to "settings that affect a 3rd party's ability to view the contents" of a personal account

The verbs are not uniform. Subsections 1, 2 and 5 reach a mere request. Subsections 3 and 4 do not: the information rule uses "require or coerce," and the contacts rule "require or cause." Subsection 2 reaches an employer that never receives a password but asks to watch while the account is opened.

Applicants as Well as Employees

Every one of the five demand rules names "an employee or applicant," and section 615 defines an applicant simply as "an applicant for employment." The two consequence rules then split by status. Subsection 6 bars an employer from acting to "discharge, discipline or otherwise penalize" an employee, or threatening to, for refusing to disclose or provide access under subsections 1 to 3, refusing to add a contact under subsection 4, or refusing to alter settings under subsection 5. Subsection 7 covers the earlier stage: an employer may not "fail or refuse to hire an applicant" as a result of the same refusals.

Subsection 7 is written around causation, "as a result of the applicant's refusal." Subsection 6 includes threats as well as completed discipline. The text does not add a separate rule about opposing a practice or filing a complaint, which is where section 620 of the chapter, discussed below, comes in.

The Exceptions

Section 617 contains three. First, the subchapter "does not apply to information about an applicant or employee that is publicly available." Second, it does not restrict compliance with a screening or monitoring duty set by a self-regulatory organization under 15 U.S.C. 78c(a)(26), or by state or federal law, "to the extent necessary to supervise communications of regulated financial institutions or insurance or securities licensees" for banking, insurance or securities business purposes.

Third, an employer may require "an employee" to disclose personal social media account information that it "reasonably believes to be relevant to an investigation of allegations of employee misconduct or a workplace-related violation of applicable laws, rules or regulations," if the disclosure is not otherwise prohibited by law and the information is accessed and used "solely to the extent necessary" for that investigation or a related proceeding. Two textual points limit it. It names employees only, not applicants. It reaches "account information," the subject of section 616(3), and does not mention passwords, in-person access, contacts or settings.

In the introduced text of LD 686, the investigation carve-out sat inside the information prohibition itself, as an "except when" clause. The enacted version moved it into the exceptions section.

Section 618 preserves the employer's own systems. The subchapter "does not limit an employer's right to promulgate and maintain lawful workplace policies governing the use of the employer's electronic equipment," including a requirement to disclose the user name, password or other information needed to access "employer-issued electronic devices," such as phones and computers, or "employer-provided software or e-mail accounts."

Department of Labor Fines Under Section 619

Section 619 reads in full: "An employer who violates this subchapter is subject to a fine imposed by the Department of Labor of not less than $100 for the first violation, not less than $250 for the 2nd violation and not less than $500 for each subsequent violation." The figures are floors. The section states no maximum, no hearing procedure and no appeal route, and it does not use the phrase civil forfeiture.

The enacted remedy differs from the one first proposed. Section 618 of LD 686 as introduced, headed "Penalties for violations," would have let a court in "any civil action" award a prevailing applicant or employee "declaratory relief, damages and reasonable attorney's fees and costs," plus injunctive relief. That text did not survive into chapter 343. Subchapter 1-C as codified contains no private right of action.

A later, chapter-wide provision may also bear on retaliation. Section 620, enacted by PL 2023, c. 282 as subchapter 1-D, General Provisions, states that an employer taking "action intended to prevent or penalize a person from exercising rights protected under this chapter" commits a civil violation carrying a fine "of not less than $500 nor more than $1,000 for each violation," and that "The Department of Labor and the Attorney General may file a civil action to enforce this section." It adds that it does not limit an individual's other remedies in a separate action. Subchapter 1-C sits in the same chapter 7, though section 620 does not name it, and no decision applying section 620 to a social media claim was located.

The next subchapter in the chapter, 1-E, is different ground. Section 620-A, added by PL 2025, c. 524, governs notice of electronic employer surveillance and has its own fine of $100 to $500 per violation. It addresses monitoring by the employer, not requests for a worker's personal account.

On enforcement history, nothing is reported here. The Maine Department of Labor's website refused automated requests for this post, so its announcements and any published guidance could not be read, and searches of the web for the subchapter returned no court decision applying sections 615 to 619. That describes what could be retrieved, not a finding that no fine has been imposed.

Frequently Asked Questions