Wisconsin Stat. 995.55: Personal Internet Accounts and Employers, Schools and Landlords

Three Kinds of Actor in Section 995.55

Wis. Stat. 995.55, headed "Internet privacy protection," sits in chapter 995, the statutes' miscellaneous chapter, immediately after the state's right of privacy statute. Its history note lists two acts: 2013 Wisconsin Act 208 and 2017 Wisconsin Act 59. The page for 2013 Wisconsin Act 208 identifies it as 2013 Senate Bill 223, with a date of enactment of April 8, 2014 and a date of publication of April 9, 2014. The page quotes the general rule of s. 991.11 that an act without its own effective date takes effect the day after publication.

The act's relating clause names three relationships: employers and employees or applicants, educational institutions and students or prospective students, and landlords and tenants or prospective tenants. The statute gives each its own subsection, (2), (3) and (4), built from the same template. Two of the actors carry definitions in subsection (1):

• An employer is "any person engaging in any activity, enterprise, or business employing at least one individual," expressly including the state, its political subdivisions, the legislature and the courts
• An educational institution includes institutions of higher education, technical colleges, public, charter and private schools, "or a private educational testing service or administrator"

The 2013 act defined a school by reference to s. 38.50 (11) (a) 2.; the codified definition now points to s. 440.52 (11) (a) 2., the only textual difference between the act as published and the current section. Landlord and tenant are not defined in the section. The protected object is a "personal Internet account," defined as "an Internet-based account that is created and used by an individual exclusively for purposes of personal communications." "Access information" means "a user name and password or any other security information that protects access" to such an account.

What Is Prohibited

Subsection (2)(a) sets three employer rules, each subject to the exceptions in paragraphs (b) to (d). An employer may not:

1. "Request or require an employee or applicant for employment, as a condition of employment, to disclose access information" for a personal Internet account, "or to otherwise grant access to or allow observation of that account"
2. Discharge or otherwise discriminate against an employee for refusing, for "opposing a practice prohibited under subd. 1.," for filing a complaint or attempting to enforce a right, or for testifying or assisting in a proceeding
3. Refuse to hire an applicant because the applicant refused to disclose access information, grant access or allow observation

Three features of the text set its scope. The first rule carries the qualifier "as a condition of employment." Its reach goes past credentials to "observation," so an employer that asks to watch an account being scrolled is within it. And the section contains no rule on adding the employer as a contact or changing privacy settings; its rules are about access and observation.

Subsections (3)(a) and (4)(a) repeat the pattern. An educational institution may not make disclosure, access or observation a condition "of admission or enrollment," may not "expel, suspend, discipline, or otherwise penalize" a student for refusing, and may not refuse to admit a prospective student for refusing. A landlord may not make it a condition "of tenancy" and may not discriminate, "in a manner described in s. 106.50 (2)," against a tenant or prospective tenant who refuses. The landlord subsection has no separate refusal-to-rent clause; refusal is addressed through the housing discrimination cross-reference.

What Remains Permitted

Paragraph (2)(b) lists seven things the employer rules do not prohibit:

1. Requiring access information for a device "supplied or paid for in whole or in part by the employer," or for an account or service the employer provides, that the employee obtained through the job, or that is used for the employer's business purposes
2. Discharging or disciplining an employee for transferring the employer's proprietary or confidential information or financial data to a personal account without authorization
3. Investigating such a transfer, or other alleged employment-related misconduct, violations of law or "violation of the employer's work rules as specified in an employee handbook," on reasonable cause to believe related account activity occurred
4. Restricting access to certain Internet sites on employer devices, networks or other resources
5. Complying with a screening or monitoring duty under state or federal law or the rules of a self-regulatory organization under 15 U.S.C. 78c(a)(26)
6. Viewing or using information "that can be obtained without access information or that is available in the public domain"
7. Requesting or requiring an employee's personal electronic mail address

The investigation clause has its own limit: the employer "may require an employee to grant access to or allow observation of the employee's personal Internet account, but may not require the employee to disclose access information for that account." Paragraph (2)(c) takes out of the employer rules any account or device used by an employee providing financial services to conduct business subject to federal securities content, supervision and retention requirements. Paragraph (2)(d) shields an employer that inadvertently obtains access information through network monitoring or an employer device, "so long as the employer does not use that access information" to get into the account.

Schools and landlords get shorter lists. An educational institution may require access information for its own devices and for accounts it provides or that are "used for educational purposes," and both may view public-domain information. Subsection (5) states that the section creates no duty for any of the three actors "to search or monitor the activity of any personal Internet account," and that none is liable for failing to request access.

Complaints to the Department of Workforce Development

Subsection (6) has two layers. Under paragraph (a), any person who violates (2)(a), (3)(a) or (4)(a) "may be required to forfeit not more than $1,000." The section does not name who brings a forfeiture action. Under paragraph (b), an employee discharged or discriminated against, an applicant not hired, a student penalized or a prospective student not admitted "may file a complaint with the department of workforce development," which processes it "in the same manner as employment discrimination complaints are processed under s. 111.39." Tenants file under paragraph (c), processed like housing discrimination complaints under s. 106.50. Act 208 also created s. 106.54 (10), directing the Equal Rights Division to receive both kinds of complaint.

The complaint route covers the retaliation and refusal rules. Paragraph (b) lists subds. (2)(a)2. and 3. and (3)(a)2. and 3.; it does not list the bare request or requirement in subd. 1. On a finding of violation, the department "may order the employer or educational institution to take such action authorized under s. 111.39 as will remedy the violation." Under s. 111.39 (4) (c), an examiner who finds a violation orders action "with or without back pay," and back pay may not accrue from more than two years before the complaint. Section 111.39 (1) sets the 300-day filing period, and the Department's Social Media Law page states that limit for employment and education complaints and one year for housing.

Act 208 also added s. 995.55 to the list of statutes in s. 111.322 (2m), so discharging someone for filing a complaint or testifying to enforce it is itself an act of employment discrimination. For state employees covered by collective bargaining, it created s. 111.91 (2) (im), which places among prohibited bargaining subjects employer access to an employee's social networking site "that provides fewer rights and remedies to employees than are provided under s. 995.55." A nonstatutory provision delayed the act's application to employees under an inconsistent collective bargaining agreement until it expired or was modified.

A 2025 Commission Decision

The Labor and Industry Review Commission applied the section in Uebelacker v. Rock Energy Cooperative, ERD Case No. CR202100138, dated April 22, 2025. It affirmed an administrative law judge's dismissal. The employer had viewed a Facebook Messenger conversation between the complainant and a coworker after the coworker left; the commission credited testimony that the application was still open on the departed coworker's work computer when an IT worker logged into her work user account.

Three holdings track the text. Logging into a work user account was not access to a "personal Internet account," and fell within the (2)(b)1. exception for employer-provided accounts. The discharge, for transferring about 2,100 work emails to a personal account and not explaining it, fell within the (2)(b)2. exception. A January 2019 demotion was outside the 300-day period, which the commission read into subsection (6)(b) from s. 111.39 (1). The commission also declined to read "otherwise require" broadly, stating that liberal construction "cannot be used to change the wording of a statute." The posted decision notes that the case "has been appealed to circuit court"; the outcome of that appeal was not located.

No other decision was found. The Legislative Reference Bureau's annotations under s. 995.55 list one bar journal article and no court opinion, and a national court opinion database refused automated requests for this post.

Frequently Asked Questions