1Providing for social media protection in employment and relating
2to certain educational institutions; establishing a cause of
3action; and prescribing penalties.

4The General Assembly of the Commonwealth of Pennsylvania
5hereby enacts as follows:

6Section 1. Short title.

7This act shall be known and may be cited as the Social Media
8Privacy Protection Act.

9Section 2. Definitions.

10The following words and phrases when used in this act shall
11have the meanings given to them in this section unless the
12context clearly indicates otherwise:

13"Educational institution." A public or private educational
14institution that offers students an organized course of study or
15training that is academic, technical, trade-oriented or
16preparatory for gainful employment in a recognized occupation.

17"Employer." A person, including a State or local government

1entity, engaged in a business, an industry, a profession, a
2trade or other enterprise in this Commonwealth or a unit of
3State or local government. The term includes an agent, a
4representative or a designee of such person.

5"Personal electronic account." An account created through an
6electronic medium or a service that allows users to create,
7edit, store, share or view user-generated content, including
8videos or photographs, blogs, video blogs, podcasts, messages,
9electronic mail, profiles, locations or any other information or
10data.

11"Social media." The term includes, but is not limited to,
12social networking Internet websites and any other forms of media
13or services that involve any means of creating, sharing and
14viewing user-generated information through a personal electronic
15account or Internet website.

16Section 3. Social media privacy protection in employment.

17(a) General rule.--An employer may not:

18(1) Request or require an employee or prospective
19employee to disclose any user name, password or other means
20for accessing private or personal social media.

21(2) Request or require an employee or prospective
22employee to access private or personal social media in the
23presence of the employer.

24(3) Request or require an employee or prospective
25employee to divulge information contained on private or
26personal social media, except as provided under subsection
27(b).

28(4) Discharge, discipline or otherwise penalize or
29threaten to discharge, discipline or otherwise penalize an
30employee for the employee's refusal to disclose any

1information specified under this subsection.

2(5) Fail or refuse to hire any prospective employee as a
3result of the individual's refusal to disclose any
4information specified under this subsection.

5(b) Exceptions.--Nothing in subsection (a) shall be
6construed to prohibit an employer from:

7(1) Promulgating and maintaining workplace policies
8governing the use of the employer's electronic communication
9devices. This includes policies regarding an employee's use
10of the Internet, social media accounts, services or Internet
11websites and e-mail use pertaining to the employer.

12(2) Monitoring the usage of the employer's electronic
13communication devices and nonpersonal accounts or services
14that provide access to the employer's internal computer or
15information systems so long as the employer is in compliance
16with subsection (a).

17(3) Obtaining or viewing any information concerning an
18employee or prospective employee that exists within the
19public domain.

20Section 4. Social media privacy protection in educational
21institutions.

22(a) General rule.--An educational institution may not:

23(1) Request or require a student or prospective student
24to disclose any user name, account name, password or other
25means for accessing private or personal social media.

26(2) Request or require a student or prospective student
27to access private or personal social media in the presence of
28an employee or agent of the educational institution.

29(3) Request or require a student or prospective student
30to divulge information contained in private or personal

1social media, except as provided under subsection (b).

2(4) Expel, discipline, fail to admit or otherwise
3penalize a student or prospective student for failure to
4grant access to, allow observation of or disclose information
5that allows access to or observation of the student's or
6prospective student's private and personal social media.

7(b) Exceptions.--Nothing in subsection (a) shall be
8construed to prohibit an educational institution from:

9(1) Requesting or requiring a student to disclose any
10user name, password or other means for accessing an
11electronic communications device provided and owned by the
12educational institution.

13(2) Monitoring an account or service provided and owned
14by the educational institution.

15(3) Viewing, accessing or utilizing information about a
16student or prospective student that can be obtained without
17any required access information or that is available in the
18public domain.

19Section 5. Cause of action.

20An individual who is the subject of a violation of this act
21may bring a civil action in a court of competent jurisdiction
22against an employer or educational institution within three
23years from the date upon which the violation occurs.

24Section 6. Penalties.

25An employer or educational institution found by a court of
26competent jurisdiction to have violated a provision of this act
27commits a misdemeanor and shall, upon conviction, be sentenced
28to pay a fine of not more than $5,000 per violation, reasonable
29attorney fees and court costs. The court may order an employer
30or educational institution to pay damages to the aggrieved

1individual in an amount not to exceed $1,000 per violation as
2well as to take reasonable corrective actions.

3Section 7. Protection of employees.

4(a) General rule.--It shall be unlawful for an employer to
5discharge, threaten or otherwise discriminate or retaliate
6against an employee regarding the employee's compensation,
7terms, conditions, location or privileges of employment because:

8(1) The employee or any person acting on behalf of the
9employee makes a good faith report, verbally or in writing,
10of an alleged violation of this act.

11(2) The employee is requested to participate in a legal
12action, investigation, hearing or inquiry relating to an
13alleged violation of this act.

14(b) Scope of protection.--Any person who in good faith
15alleges noncompliance with this act shall be afforded the rights
16provided by this act, notwithstanding the person's failure to
17prevail on the merits.

18(c) Rebuttable presumption.--Taking adverse action against
19an employee within 180 days of the person's exercise of rights
20protected under this act shall raise a rebuttable presumption of
21having done so in retaliation for the exercise of those rights.

22Section 8. Effective date.

23This act shall take effect in 60 days.