HLS 13RS-234 REENGROSSED Page 1 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. Regular Session, 2013 HOUSE BILL NO. 314 BY REPRESENTATIVES JAMES, GREENE, HUNTER, KATRINA JACKSON, JEFFERSON, NANCY LANDRY, PIERRE, SMITH, AND THIERRY Prefiled pursuant to Article III, Section 2(A)(4)(b)(i) of the Constitution of Louisiana. PRIVACY/COMPUTERS: Creates the Personal Online Account Privacy Protection Act AN ACT1 To enact Chapter 28 of Title 51 of the Louisiana Revised Statutes of 1950, to be comprised2 of R.S. 51:1951 through 1955, relative to Internet privacy; to prohibit employers and3 public educational institutions from requesting or requiring certain individuals to4 disclose information that allows access to or observation of personal online accounts;5 to prohibit employers and public educational institutions from taking certain actions6 for failure to disclose information that allows access to personal online accounts; to7 provide for exceptions; to limit liability for failure to search or monitor the activity8 of an individual's personal online account; and to provide for related matters.9 Be it enacted by the Legislature of Louisiana:10 Section 1. Chapter 28 of Title 51 of the Louisiana Revised Statutes of 1950,11 comprised of R.S. 51:1951 through 1955, is hereby enacted to read as follows: 12 CHAPTER 28. PERSONAL ONLINE ACCOUNT PRIVACY PROTECTION ACT13 §1951. Title14 This Chapter shall be known and may be cited as the "Personal Online15 Account Privacy Protection Act".16 §1952. Definitions17 As used in this Chapter, the terms defined in this Section have the meanings18 herein given to them, except where the context expressly indicates otherwise:19 HLS 13RS-234 REENGROSSED HB NO. 314 Page 2 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. (1) "Educational institution" means a public educational institution or a1 separate school or department of a public educational institution and includes but is2 not limited to the following:3 (a) A university, college, or junior college.4 (b) An academy.5 (c) An elementary or secondary school.6 (d) An extension course.7 (e) A kindergarten.8 (f) A nursery school.9 (g) A school system, school district, or intermediate school district.10 (h) A business, nursing, professional, secretarial, technical, or vocational11 school.12 (i) A public or private educational testing service or administrator.13 (j) An agent of an educational institution.14 (2) "Employer" means a person, including a unit of state or local15 government, engaged in a business, industry, profession, trade, or other enterprise16 in this state and includes an agent, representative, or designee of the employer.17 (3) "Personal online account" means an online account that is used by an18 individual primarily or exclusively for personal communication.19 §1953. Employers; prohibited activities; exceptions20 A. An employer shall not do any of the following:21 (1) Request or require an employee or an applicant for employment to22 disclose any user name, password, or other authentication information that allows23 access to the employee's or applicant's personal online account.24 (2) Discharge, discipline, fail to hire, or otherwise penalize or threaten to25 penalize an employee or applicant for employment for failure to disclose any26 information specified in this Subsection.27 B. An employer shall not be prohibited from doing any of the following:28 HLS 13RS-234 REENGROSSED HB NO. 314 Page 3 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. (1) Requesting or requiring an employee to disclose any user name,1 password, or other authentication information to the employer to gain access to or2 operate any of the following:3 (a) An electronic communications device paid for or supplied in whole or in4 part by the employer.5 (b) An account or service provided by the employer, obtained by virtue of6 the employee's employment relationship with the employer, or used for the7 employer's business purposes.8 (2) Disciplining or discharging an employee for transferring the employer's9 proprietary or confidential information or financial data to an employee's personal10 online account without the employer's authorization.11 (3) Conducting an investigation or requiring an employee to cooperate in an12 investigation in any of the following circumstances:13 (a) If there is specific information about activity on the employee's personal14 online account, for the purpose of ensuring compliance with applicable laws,15 regulatory requirements, or prohibitions against work-related employee misconduct.16 (b) If the employer has specific information about an unauthorized transfer17 of the employer's proprietary information, confidential information, or financial data18 to an employee's personal online account.19 (4) Conducting an investigation or requiring an employee to cooperate in an20 investigation as specified in this Subsection, including requiring the employee to21 share the content that has been reported in order to make a factual determination,22 without obtaining the user name and password to the employee's personal online23 account.24 (5) Restricting or prohibiting an employee's access to certain websites while25 using an electronic communications device paid for or supplied in whole or in part26 by the employer or while using an employer's network or resources, in accordance27 with state and federal law.28 HLS 13RS-234 REENGROSSED HB NO. 314 Page 4 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. C. If through the use of an electronic device or program that monitors an1 employer's network or the use of an employer provided device, an employer2 inadvertently receives an employee's user name, password, or other authentication3 information, the employer shall not be liable for having the information, but may not4 use the information to access the employee's personal online account.5 D. An employer shall not be prohibited or restricted from complying with6 a duty to screen employees or applicants prior to hiring or to monitor or retain7 employee communications that are established pursuant to state or federal law, rules8 or regulations, case law, or rules of self-regulatory organizations.9 E. An employer shall not be prohibited or restricted from viewing, accessing,10 or utilizing information about an employee or applicant that can be obtained without11 the information specified in Paragraph (A)(1) of this Section or that is available in12 the public domain.13 §1954. Educational institutions; prohibited activities; exceptions14 A. An educational institution shall not do any of the following:15 (1) Request or require a student or prospective student to disclose any user16 name, password, or other authentication information that allows access to the17 student's or prospective student's personal online account.18 (2) Expel, discipline, fail to admit, or otherwise penalize or threaten to19 penalize a student or prospective student for failure to disclose any information20 specified in this Subsection.21 B. An educational institution shall not be prohibited from requesting or22 requiring a student to disclose any user name, password, or other authentication23 information to the educational institution to gain access to or operate any of the24 following:25 (1) An electronic communications device paid for or supplied in whole or26 in part by the educational institution, except where the device has been provided to27 the student with the intent to permanently transfer the ownership of the device to the28 student.29 HLS 13RS-234 REENGROSSED HB NO. 314 Page 5 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. (2) An account or service provided by the educational institution that is1 either obtained by virtue of the student's admission to the educational institution or2 used by the student for educational purposes.3 C. An educational institution shall not be prohibited or restricted from4 viewing, accessing, or utilizing information about a student or applicant that can be5 obtained without the information specified in Paragraph (A)(1) of this Section or that6 is available in the public domain.7 §1955. No duty to monitor; liability8 A. This Chapter shall not create a duty for an employer or educational9 institution to search or monitor the activity of an individual's personal online10 account.11 B. An employer or educational institution shall not be liable under this12 Chapter for failure to request or require that an employee, a student, an applicant for13 employment, or a prospective student to disclose information that allows access to14 the employee's, student's, applicants for employment, or prospective student's15 personal online account.16 Section 2. This Act shall become effective upon signature by the governor or, if not17 signed by the governor, upon expiration of the time for bills to become law without signature18 by the governor, as provided by Article III, Section 18 of the Constitution of Louisiana. If19 vetoed by the governor and subsequently approved by the legislature, this Act shall become20 effective on the day following such approval.21 DIGEST The digest printed below was prepared by House Legislative Services. It constitutes no part of the legislative instrument. The keyword, one-liner, abstract, and digest do not constitute part of the law or proof or indicia of legislative intent. [R.S. 1:13(B) and 24:177(E)] James HB No. 314 Abstract: Creates the Personal Online Account Privacy Protection Act. Proposed law shall be known and may be cited as the "Personal Online Account Privacy Protection Act". HLS 13RS-234 REENGROSSED HB NO. 314 Page 6 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. Proposed law defines "educational institution" as a public educational institution or a separate school or department of a public educational institution and includes but is not limited to the following: (1)A university, college, or junior college. (2)An academy. (3)An elementary or secondary school. (4)An extension course. (5)A kindergarten. (6)A nursery school. (7)A school system, school district, or intermediate school district. (8)A business, nursing, professional, secretarial, technical, or vocational school. (9)A public educational testing service or administrator. (10)An agent of an educational institution. Proposed law defines "employer" as a person, including a unit of state or local government, engaged in a business, industry, profession, trade, or other enterprise in this state and includes an agent, representative, or designee of the employer. Proposed law defines "personal online account" as an online account that is used by an individual primarily or exclusively for personal communication. Proposed law prohibits an employer from doing any of the following: (1)Requesting or requiring an employee or an applicant for employment to disclose information that allows access to the employee's or applicant's personal online account. (2)Discharging, disciplining, failing to hire, or otherwise penalizing or threatening to penalize an employee or applicant for employment for failure to disclose information that allows access to or observation of the employee's or applicant's personal online account. Proposed law provides that an employer shall not be prohibited from requesting or requiring an employee to disclose access information to the employer to gain access to or operate any of the following: (1)An electronic communications device paid for or supplied in whole or in part by the employer. (2)An account or service provided by the employer, obtained by virtue of the employee's employment relationship with the employer, or used for the employer's business purposes. Proposed law provides that an employer shall not be prohibited from disciplining or discharging an employee for transferring the employer's proprietary or confidential information or financial data to an employee's personal online account without the employer's authorization. HLS 13RS-234 REENGROSSED HB NO. 314 Page 7 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. Proposed law provides that an employer shall not be prohibited from conducting an investigation or requiring an employee to cooperate in an investigation in any of the following circumstances: (1)If there is specific information about activity on the employee's personal online account, for the purpose of ensuring compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct. (2)If the employer has specific information about an unauthorized transfer of the employer's proprietary information, confidential information, or financial data to an employee's personal online account. Proposed law provides that an employer shall not be prohibited from restricting or prohibiting an employee's access to certain websites while using an electronic communications device paid for or supplied in whole or in part by the employer or while using an employer's network or resources, in accordance with state and federal law. Proposed law provides that an employer shall not be prohibited or restricted from complying with a duty to screen employees or applicants prior to hiring or to monitor or retain employee communications that is established under state or federal law. Provides that an employer shall not be liable if inadvertent access information is received through the use of a program that monitors the employer's network, as long as the information is not used to access the employee's personal online account. Proposed law provides that an employer shall not be prohibited or restricted from viewing, accessing, or utilizing information about an employee or applicant that can be obtained without any required access information or that is available in the public domain. Proposed law prohibits an educational institution from doing any of the following: (1)Requesting or requiring a student or prospective student to disclose information that allows access to the student's or prospective student's personal online account. (2)Expelling, disciplining, failing to admit, or otherwise penalizing or threatening to penalize a student or prospective student for failure to disclose information that allows access to the student's or prospective student's personal online account. Proposed law provides that an educational institution shall not be prohibited from requesting or requiring a student to disclose access information to the educational institution to gain access to or operate any of the following: (1)An electronic communications device paid for or supplied in whole or in part by the educational institution, except where the device has been provided to the student with the intent to permanently transfer the ownership of the device to the student. (2)An account or service provided by the educational institution that is either obtained by virtue of the student's admission to the educational institution or used by the student for educational purposes. Proposed law provides that an educational institution shall not be prohibited or restricted from viewing, accessing, or utilizing information about a student or applicant that can be obtained without any required access information or that is available in the public domain. Proposed law shall not create a duty for an employer or educational institution to search or monitor the activity of an individual's personal online account. HLS 13RS-234 REENGROSSED HB NO. 314 Page 8 of 8 CODING: Words in struck through type are deletions from existing law; words underscored are additions. An employer or educational institution shall not be liable under proposed law for failure to request or require that an employee, a student, an applicant for employment, or a prospective student disclose information that allows access to the employee's, student's, applicant for employment's, or prospective student's personal online account. Effective upon signature of governor or lapse of time for gubernatorial action. (Adds R.S. 51:1951-1955) Summary of Amendments Adopted by House Committee Amendments Proposed by House Committee on Commerce to the original bill. 1. Changed "Social Medial Privacy Protection Act" to "Personal Online Account Privacy Protection Act" and changed personal social media to personal online account in all provisions of proposed law. 2. Specified that proposed law only applies to public educational institutions and not private. 3. Defined "personal online account" as an online account that is used by an individual primarily or exclusively for personal communication. 4. Specified that employers and public educational institutions cannot request or require employees or applicants or students or prospective students to disclose user names, passwords, or authenticating information that allows access to personal online accounts. 5. Included an exception which allows employers and educational institutions to require disclosure of access information to gain access to electronic communications devices that are supplied by the employer or institution, as well as those paid for by the employer or institution. 6. Removed the provision allowing an employer to monitor, review, and access electronic data stored on a device paid for by the employer or traveling through the employer's network in accordance with state and federal law. 7. Provided that an employer is not liable if inadvertent access information is received through the use of a program that monitors the employer's network, as long as the information is not used to access an employee's personal online account. 8. Removed all penalty provisions making violations a misdemeanor and subjecting violators to certain actions. 9. Made various technical changes. House Floor Amendments to the engrossed bill. 1. Makes technical changes.