On May 22, 2014, Louisiana Governor Bobby Jindal signed into law the "Personal Online Account Privacy Protection Act." The measure, effective immediately, bans employers, including state and local governments, from requesting usernames, passwords or other authentication information that allows them to access personal online accounts of either employment applicants or current employees. The act equally prohibits public educational institutions, including colleges, from requesting the same information from prospective or current students. Even if an employer inadvertently receives an employee's or applicant's personal online account information, the employer is prohibited from using the information to access the personal online account. The act also prohibits an employer from firing or disciplining an employee or applicant for refusing to provide his personal online account information. However, as currently written, the law does not provide for a penalty in case of a violation of the act.
Notably, the act only covers "personal online accounts" created and used exclusively for personal communications, unrelated to business purposes. Therefore, employers can still require an employee to disclose information, including usernames and passwords, to gain access to electronic devices, accounts or services paid for or provided by the employer or used for the employer's business purposes.
In addition, employers are not prohibited from viewing, accessing or utilizing information from an employee's personal online account when a username or password is not required to access the information. For example, an employer cannot request an employee's username or password to view his or her personal Facebook account, but is free to view whatever aspects of the account are available to the public, such as the Facebook profile.
With the signing of this act, Louisiana joins several other states that have already instituted similar password protection laws, including Arkansas, California, Colorado, Illinois, Maryland, Michigan, Nevada, New Mexico, Oregon, Utah and Washington. More than 20 other states have legislation introduced or pending.
The Personal Online Account Privacy Protection act is codified at La. Rev. Stat. § 51:1951, et seq.