New Hampshire RSA 275:74: Employer Requests for Social Media Logins, Contact Lists and Privacy Settings

A Three-Section Subdivision in the Labor Code

New Hampshire placed its rule on employer access to personal online accounts inside RSA chapter 275, Protective Legislation, under a subdivision headed "Use of Social Media and Electronic Mail." It has three sections: a definition at RSA 275:73, the operative rules at RSA 275:74, and a penalty clause at RSA 275:75. Each carries the source note "2014, 305:1, eff. Sept. 30, 2014."

Chapter 305 of 2014 is House Bill 1407, "AN ACT relative to privacy in the workplace," sponsored by Rep. K. Rogers, Rep. P. Sullivan and Sen. Soucy. The final version shows approval on August 1, 2014 and an effective date of September 30, 2014. As enacted, the act inserted the subdivision as sections 275:71 through 275:73. Section 305:2 provided that if SB 390 of the same session became law, those sections would be renumbered 275:73 through 275:75 and the internal cross-reference updated. The codified numbering shows that renumbering took place.

The same three sponsors had carried an earlier bill. The Senate-amended text of HB 414 of 2013 paired the social media provisions with an unrelated rule on legislative approval of state collective bargaining agreements. Its version barred requests for "a user name and password," defined "social media" separately, and barred an employer to "require, request, suggest, or cause" any change to privacy settings. HB 1407 dropped the social media definition, replaced "user name and password" with "login information," and narrowed the privacy-settings clause, as described below.

What RSA 275:74 Prohibits

The definition in RSA 275:73 sets the scope. A "personal account" is "an account, service, or profile on a social networking website that is used by a current or prospective employee primarily for personal communications unrelated to any business purposes of the employer." The definition expressly does not reach an account, service or profile "created, maintained, used, or accessed" for the employer's business purposes or for business-related communications. The subdivision does not define "employer," "employee" or "login information."

RSA 275:74 then sets three prohibitions:

1. Paragraph I: no employer "shall request or require that an employee or prospective employee disclose login information for accessing any personal account or service through an electronic communication device"
2. Paragraph II: no employer shall compel an employee or applicant "to add anyone, including the employer or the employer's agent, to a list of contacts" associated with an email account or personal account, or require an employee or applicant "to reduce the privacy settings" of such an account "that would affect a third party's ability to view the contents of the account"
3. Paragraph III: no employer shall "take or threaten to take disciplinary action against any employee" for refusing a request or demand that violates the subdivision

The verbs differ by paragraph. Paragraph I reaches a mere request as well as a requirement. Paragraph II uses "compel" and "require," so its text does not reach a request to connect that the employee is free to decline. The 2013 draft's "request, suggest, or cause" language on privacy settings did not survive into the final act. The people protected also shift: paragraph I names an employee or prospective employee, paragraph II an employee or applicant, and the anti-retaliation rule in paragraph III names only an employee.

The Exceptions

Most of RSA 275:74 is carve-outs. Paragraph IV preserves an employer's right to adopt and enforce lawful policies on its own electronic equipment, including internet, social networking and email use; to monitor use of its equipment and email; and to request or require login information for "an account or service provided by virtue of the employee's employment relationship with the employer" or for "an electronic communications device or online account paid for or supplied by the employer."

Paragraph V addresses credentials captured by network monitoring. If an employer "inadvertently receives an employee's password, or other authentication information" through a program that monitors its network or employer-provided devices, it "is not liable for having this information, but shall not use this information to access an employee's personal accounts."

Paragraph VI states that the section does not prohibit an employer from obtaining information about an employee or prospective employee "that is in the public domain," or from conducting two kinds of investigation:

• To ensure compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct, based on information about activity on a personal account received from an employee or other source
• Of an employee's actions, based on specific information about the unauthorized transfer of the employer's proprietary information, confidential information or financial data to a personal online account

Paragraph VII limits what an investigation can extract: the employer "may require the employee's cooperation to share only the content that has been received by the employer, in order to make a factual determination." Paragraph VIII adds that nothing in the section prevents compliance with state or federal statutes, rules, case law, "or rules of self-regulatory organizations."

Where Email Accounts Appear in the Text

The subdivision's heading names electronic mail, and the bill's analysis describes it as barring required disclosure of "social media or electronic mail passwords." The operative text treats email unevenly. The defined term "personal account" is limited to a profile "on a social networking website." Paragraph II names "an electronic mail account or personal account" for both the contact-list and the privacy-settings rules, so it reaches personal email in terms. Paragraph I, the login rule, refers to "any personal account or service" and does not use the words electronic mail. Paragraphs IV(a) and IV(b) mention email only in connection with the employer's own systems.

No reported decision found for this post construes whether "personal account or service" in paragraph I reaches a personal email login. The text is reported here as written.

Enforcement Under the Labor Statutes

RSA 275:75 is the only enforcement clause. Any employer violating RSA 275:74 "shall be subject to a civil penalty, to be imposed by the labor commissioner in accordance with the procedures established in RSA 273:11-a," and an employer aggrieved by the assessment "may appeal in accordance with RSA 273:11-c." The subdivision names no amount and creates no private right of action.

RSA 273:11-a supplies the figures. Under paragraph I, the commissioner "may, after hearing, impose a civil penalty not to exceed $2,500, unless specifically authorized to do so by another provision of law," with collections deposited in the department of labor restricted fund. Paragraph II requires the commissioner to issue "one written warning" first, giving the employer 30 days from receipt to cure. Paragraph III removes the warning where the commissioner finds intent to cause harm or a threat to public safety, or where the violation is on a list of wage, child support, undocumented worker, workers' compensation and youth labor provisions. RSA 275:74 is not on that list.

Appeals run to a penalty appeal board created by RSA 273:11-b, with a management member, a labor member and an attorney chair. Under RSA 273:11-c, a notice of appeal is due within 15 business days of the commissioner's order, and the board hears the matter de novo. RSA 273:11-d allows a further appeal to the New Hampshire Supreme Court within 15 business days of the board's decision, confined to the record.

On enforcement history, this research found nothing to report. Searches of a national court opinion database and of the web for RSA 275:74 returned no court decision or published administrative ruling applying the subdivision since it took effect in 2014. That is a statement about what could be located, not a finding that no penalty has ever been assessed.

Frequently Asked Questions