Site Unseen: Schools, Bosses Barred from Eyeing Students', Workers' Social Media
Illustration by Viktor Koen.
See if this sounds familiar: School officials learn that a student may have inappropriate material on a social media site. The officials—ostensibly concerned about bullying and other possible ramifications at school—call the student into the office, force him or her to reveal the password, log on to the site and show the pupil the questionable online content.
Nor are public schools alone. Many universities require students to let officials access their social media, and in some cases impel students to install spying software. Some colleges force their student-athletes to consent to the monitoring of their Facebook, Myspace and Twitter accounts by signing a social media policy.
“There are multiple incidents around the country where schools are invading the social media privacy rights of K-12 students,” says Bethesda, Md., attorney Bradley Shear, who has written extensively on social media and students.
“But,” Shear continues, “it is an epidemic in the colleges. When did it become legal for public universities to be able to require their students to download spying software onto their personal iPhones or social media accounts to monitor pass-word-protected digital content?”
Workplaces, too, are leaning on employees to reveal online info. In 2010, Maryland prison guard Robert Collins said that his employer forced him to reveal his Facebook data to screen for gang ties. The Department of Public Safety and Correctional Services suspended the practice after the American Civil Liberties Union of Maryland filed a complaint on Collins’ behalf, claiming the practice violated his personal privacy.
But this year several states have sought to block personal passwords from inquiring principals and bosses.
LEGISLATORS RESPOND
In Delaware in July, Gov. Jack Markell signed into law the Higher Education Privacy Act, which prohibits university officials from forcing students to disclose digitally protected information. According to the statute: “An academic institution shall not request or require that a student or applicant disclose any password or other related account information in order to gain access to the student’s or applicant’s social networking site profile or account by way of an electronic communication device.”
The law also prohibits public and private universities from requiring or requesting “that a student or applicant log on to a social networking site, email account, or any other Internet site or application … in the presence of an agent of the institution so as to provide the institution access.”
For good measure, the law further prohibits university officials from monitoring or tracking a student or applicant’s personal electronic communication device.
“I introduced the legislation to protect our students’ First and Fourth Amendment rights,” says Delaware state Rep. Darryl M. Scott. “If a student is required to disclose their postings, as part of the college application process, would they write and share their thoughts freely? My concern was that they would not.”
Scott adds that “as the legislation was under consideration, I spoke with several students who agreed that the intent of the legislation was good and needed. I also spoke with five of the six higher-education institutions, both private and public, and they … also agreed.”
“The Delaware measure is a piece of legislation that protects both schools and students,” says Shear, who has worked with several state legislatures to craft the legislation. “Students need to be protected along with the schools.”
“Do schools really want to be the social media police?” Shear asks. “Can you imagine if schools have a duty to monitor all of their students’ online postings? They could be sued for negligent monitoring or failing to act.”
The Delaware legislation also provides for a health and safety exception that gives school public safety officials the ability to monitor student social media when they have a “reasonable, articulable suspicion of criminal activity,” or conduct an “investigation, inquiry or determination conducted pursuant to an academic institution’s threat assessment policy or protocol.”
Scott wanted the Delaware law to protect K-12 students as well, but colleagues were concerned that the bill would protect bullies. That provision was removed and will be reintroduced next session.
REINING IN EMPLOYERS
Minneapolis attorney Wallace G. Hilke, who represents a secondary school student claiming school officials violated her First Amendment rights by demanding her digital password, says the law will prohibit school officials from being able to avoid liability by claiming qualified immunity, a defense against civil rights suits available to government officials when they do not violate clearly established constitutional or statutory law.
“Legislation prohibiting school officials from forcing students to disclose passwords is a good idea because it would completely eliminate the qualified immunity defense, as there would be clearly established statutory authority,” Hilke says.
California is following suit. In August, the state Senate approved legislation that would prohibit colleges and universities from formally requesting or demanding that students provide their social media user names and passwords.
“California is set to end this unacceptable invasion of personal privacy,” said state Sen. Leland Yee, author of the bill, in a statement. “The practice of employers or colleges demanding social media passwords is entirely unnecessary and completely unrelated to someone’s performance or abilities.
“These social media outlets are often for the purpose of individuals to share private information—including age, marital status, religion, sexual orientation and personal photos—with their friends and family,” Yee added. “This information is illegal for employers and colleges to use in making employment and admission decisions and has absolutely no bearing on a person’s ability to do their job or be successful in the classroom.”
The California Assembly also passed a similar bill that would designate anything marked as private on social media accounts as being beyond employers’ limits.
Meanwhile, Maryland and Illinois passed similar legislation this year protecting employees from bosses’ demands to see personal digital sites. Maryland Gov. Martin O’Malley signed the User Name and Password Privacy Protection and Exclusions Act in May. The Illinois Right to Privacy in the Workplace Act was signed by Gov. Pat Quinn in August.
The Maryland Chamber of Commerce opposed the bill, telling the Washington Post’s Capital Business blog that employers “have a myriad of legitimate interests in knowing what their employees or applicants have posted about themselves,” such as making sure employees are not posting trade secrets or negative comments about customers, using illegal drugs or engaging in other inappropriate behavior.
But a representative for the business group said the chamber will move forward helping employers comply with the new law.
“The law is the law,” spokesman Will Burns told Capital Business. “At this point, our goal is to ensure that all businesses know about it so they can adjust any policies that may be contrary to it.”
Meanwhile, two U.S. senators—Charles Schumer of New York and Richard Blumenthal of Connecticut—have asked the Department of Justice and the Equal Employment Opportunity Commission to investigate whether such password requirements violate federal law.
“Ultimately, both free speech and privacy interests are at stake when public school officials demand that students reveal their passwords for their social media networks,” says free-speech expert Clay Calvert, director of the Marion B. Brechner First Amendment Project at the University of Florida. “It’s an Orwellian overreach by school officials—an effort to stretch their jurisdiction and authority over student expression far beyond the confines of campus and into the private homes where social media speech is created.”
“I believe such legislation will eventually become the norm, because public policy and case law has indicated that requiring access to password-protected digital content may be against the law,” Shear says. “However, since there isn’t a federal law or on-point Supreme Court decision, new laws are needed to clarify the legal landscape.”
