On July 1, 2015, a new law, Virginia Code Section 40.1-28.7:5 went into effect that prohibits Virginia employers from requiring current or prospective employees: (1) to disclose their social media account usernames and/or passwords or (2) to add an employee, supervisor or administrator to their list of contacts.  Although the law provides a safe harbor for employers that inadvertently acquire employee usernames and passwords through an employee’s use of employer-owned electronic devices or through network monitoring software, the law prohibits an employer from using an employee’s inadvertently acquired username and password to access the employee’s social media accounts.

The law also prohibits employers from retaliating against employees who exercise their rights under the law.  Specifically, employers must not take action against “or threaten to discharge, discipline, or otherwise penalize a current employee” or “fail or refuse to hire a prospective employee” for not divulging the employee’s social media account information or for not adding an employee, supervisor or administrator to their list of contacts.

The law expressly permits employers to view information the employee or prospective employee makes publicly available.  Thus, employers may still research employees’ and prospective employees’ public statements on social media.

Employers will want to take affirmative steps to make sure that they do not run afoul of this new law.  Employers should review their employee handbooks, policies and practices to make sure they are not engaging in any prohibited activity.