Okla. Stat. tit. 40 § 173.2

Current through Laws 2024, c. 453.

Section 173.2 - Prohibited actions regarding personal social media accounts - Exemptions - Civil actions

A. No employer, as defined by paragraph 1 of Section 1301 of Title 25 of the Oklahoma Statutes, located in this state shall:

1. Require an employee or prospective employee to disclose a user name and password or other means of authentication for accessing a personal online social media account through an electronic communications device;

2. Require an employee or prospective employee to access the employee's or prospective employee's personal online social media account in the presence of the employer in a manner that enables the employer to observe the contents of such accounts if the account's contents are not available to the general public, except pursuant to an investigation as provided in subsection D of this act;

3. Take retaliatory personnel action that materially and negatively affects the terms and conditions of employment against an employee solely for refusal to give the employer the user name or password to the employee's personal online social media account; or

4. Refuse to hire a prospective employee solely as a result of the prospective employee's refusal to give the employer the user name and password to the prospective employee's personal online social media account.

B. An employer may request or require an employee to disclose any user name and password for accessing:

1. Any computer system, information technology network, or electronic communications device provided or subsidized by the employer; or

2. Any accounts or services provided by the employer or by virtue of the employee's employment relationship with the employer or that the employee uses for business purposes.

C. If, through the use of an electronic device or program that monitors an employer's network or the use of employer provided devices, an employer inadvertently receives an employee's user name and password or other authentication information, the employer is not liable for having such information, but may not use the information to access an employee's personal online social media account.

D. Nothing in this section shall prevent an employer from:

1. Conducting an investigation:

a. for the purpose of ensuring compliance with applicable laws, regulatory requirements or prohibitions against work-related employee misconduct based on the receipt of specific information about activity on a personal online social media account or personal online social media service by an employee or other source, or

b. of an employee's actions based on the receipt of specific information about the unauthorized transfer of an employer's proprietary information, confidential information or financial data to a personal online social media account or personal online social media service by an employee or other source;

2. Conducting an investigation as specified in subparagraphs a and b of paragraph 1 of this subsection includes requiring the employee's cooperation to share the content that has been reported in order to make a factual determination.

E. Nothing in this section shall be construed to prevent an employer from complying with the requirements of state or federal statutes, rules or regulations, case law, or rules of self-regulatory organizations.

F. Nothing in this section shall be construed to prohibit an employer from accessing its computer system or information technology network, including electronic communications devices owned by the employer. Neither this section nor any other Oklahoma law shall prohibit an employer from reviewing or accessing personal online social media accounts that an employee may choose to use while utilizing an employer's computer system, information technology network or an employer's electronic communication device.

G. An employee or prospective employee may bring a civil action against an employer who violates this section in a court located in the county in which the alleged violation occurred. Such action shall be brought within six (6) months after the alleged violation occurred. The employee or prospective employee may seek injunctive relief to restrain the employer from continuing to act in violation of this section, but must show by clear and convincing evidence that the employer violated this act. The only damages recoverable for a violation of this act are Five Hundred Dollars ($500.00) per violation. No punitive or emotional damages are recoverable, and this section may not be utilized for the basis of a public policy tort.

H. As used in this section:

1. "Electronic communications device" means a device that uses electronic signals to create, transmit or receive information, including computers, telephones, personal digital assistants and other similar devices; and

2. "Personal online social media account" means an online account that is used by an employee or prospective employee exclusively for personal communications that an individual establishes and uses through an electronic application, service or platform used to generate or store content, including, but not limited to, videos, still photographs, blogs, video blogs, instant messages, audio recordings or email that is not available to the general public.

Okla. Stat. tit. 40, § 173.2

Added by Laws 2014 , c. 315, s. 1, eff. 11/1/2014.