S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   2479
 
                        2019-2020 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 22, 2019
                                ___________
 
 Introduced  by M. of A. DINOWITZ, L. ROSENTHAL, MOSLEY, GALEF, ABINANTI,
   JAFFEE, FAHY, COLTON, CRESPO, ORTIZ, WEPRIN, LAVINE, ARROYO --  Multi-
   Sponsored  by  --  M.  of A. COOK, GOTTFRIED, HYNDMAN -- read once and
   referred to the Committee on Labor
 
 AN ACT to amend the labor law and the  education  law,  in  relation  to
   prohibiting  an employer or educational institution from requesting or
   requiring that an employee, applicant or  student  disclose  any  user
   name,  password,  or  other  means  for  accessing  a personal account
   through specified electronic communications devices
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  The labor law is amended by adding a new section 201-h to
 read as follows:
   § 201-H. REQUEST FOR ACCESS TO PERSONAL ACCOUNTS  PROHIBITED.  1.  FOR
 PURPOSES  OF  THIS SECTION, THE FOLLOWING WORDS SHALL HAVE THE FOLLOWING
 MEANINGS:
   (A) "APPLICANT" MEANS AN APPLICANT FOR EMPLOYMENT.
   (B) "ELECTRONIC COMMUNICATIONS DEVICE"  MEANS  ANY  DEVICE  THAT  USES
 ELECTRONIC SIGNALS TO CREATE, TRANSMIT, AND RECEIVE INFORMATION, INCLUD-
 ING,  BUT NOT LIMITED TO COMPUTERS, TELEPHONES, PERSONAL DIGITAL ASSIST-
 ANTS AND OTHER SIMILAR DEVICES.
   (C) "EMPLOYER" MEANS (I) A PERSON OR ENTITY  ENGAGED  IN  A  BUSINESS,
 INDUSTRY,  PROFESSION, TRADE OR OTHER ENTERPRISE IN THE STATE; OR (II) A
 UNIT OF STATE OR LOCAL GOVERNMENT; AND (III)  SHALL  INCLUDE  AN  AGENT,
 REPRESENTATIVE OR DESIGNEE OF THE EMPLOYER.
   (D)  "PERSONAL  ACCOUNT"  MEANS AN ACCOUNT OR PROFILE ON AN ELECTRONIC
 MEDIUM WHERE USERS MAY CREATE, SHARE, AND VIEW  USER-GENERATED  CONTENT,
 INCLUDING  UPLOADING  OR DOWNLOADING VIDEOS OR STILL PHOTOGRAPHS, BLOGS,
 VIDEO BLOGS, PODCASTS, INSTANT MESSAGES, OR INTERNET WEB  SITE  PROFILES
 OR LOCATIONS THAT IS USED BY AN EMPLOYEE OR AN APPLICANT EXCLUSIVELY FOR
 PERSONAL PURPOSES.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD01244-01-9

 A. 2479                             2
 
   2.  (A)  EXCEPT  AS  PROVIDED IN PARAGRAPH (B) OF THIS SUBDIVISION, IT
 SHALL BE UNLAWFUL FOR ANY EMPLOYER TO REQUEST,  REQUIRE  OR  COERCE  ANY
 EMPLOYEE OR APPLICANT FOR EMPLOYMENT:
   (I)  DISCLOSE ANY USER NAME AND PASSWORD, PASSWORD, OR OTHER AUTHENTI-
 CATION INFORMATION FOR ACCESSING A PERSONAL ACCOUNT THROUGH AN ELECTRON-
 IC COMMUNICATIONS DEVICE;
   (II) ACCESS THE EMPLOYEE'S OR  APPLICANT'S  PERSONAL  ACCOUNT  IN  THE
 PRESENCE OF THE EMPLOYER;
   (III) REPRODUCE IN ANY MANNER PHOTOGRAPHS, VIDEO, OR OTHER INFORMATION
 CONTAINED WITHIN A PERSONAL ACCOUNT.
   (B)  AN  EMPLOYER  MAY  REQUIRE AN EMPLOYEE TO DISCLOSE ANY USER NAME,
 PASSWORD OR OTHER MEANS FOR ACCESSING NONPERSONAL ACCOUNTS THAT  PROVIDE
 ACCESS TO THE EMPLOYER'S INTERNAL COMPUTER OR INFORMATION SYSTEMS.
   (C)  FOR  THE  PURPOSES OF THIS SECTION, "ACCESS" SHALL NOT INCLUDE AN
 EMPLOYEE OR APPLICANT VOLUNTARILY ADDING AN EMPLOYER OR EMPLOYMENT AGEN-
 CY TO THEIR  LIST  OF  CONTACTS  ASSOCIATED  WITH  A  PERSONAL  INTERNET
 ACCOUNT.
   3. AN EMPLOYER MAY NOT:
   (A)  DISCHARGE,  DISCIPLINE,  OR  OTHERWISE  PENALIZE  OR  THREATEN TO
 DISCHARGE, DISCIPLINE, OR OTHERWISE PENALIZE AN EMPLOYEE FOR AN  EMPLOY-
 EE'S  REFUSAL  TO DISCLOSE ANY INFORMATION SPECIFIED IN PARAGRAPH (A) OF
 SUBDIVISION TWO OF THIS SECTION; OR
   (B) FAIL OR REFUSE TO HIRE ANY APPLICANT AS A  RESULT  OF  THE  APPLI-
 CANT'S REFUSAL TO DISCLOSE ANY INFORMATION SPECIFIED IN PARAGRAPH (A) OF
 SUBDIVISION TWO OF THIS SECTION.
   4.  IT SHALL BE AN AFFIRMATIVE DEFENSE TO AN ACTION UNDER THIS SECTION
 THAT THE EMPLOYER ACTED TO COMPLY WITH REQUIREMENTS OF A FEDERAL,  STATE
 OR LOCAL LAW.
   5. (A) NOTHING IN THIS SECTION SHALL PROHIBIT AN EMPLOYER FROM:
   (I) REQUESTING OR REQUIRING AN EMPLOYEE TO DISCLOSE ACCESS INFORMATION
 TO  AN  ACCOUNT  PROVIDED BY THE EMPLOYER WHERE SUCH ACCOUNT IS USED FOR
 BUSINESS PURPOSES AND THE EMPLOYEE WAS  PROVIDED  PRIOR  NOTICE  OF  THE
 EMPLOYER'S RIGHT TO REQUEST OR REQUIRE SUCH ACCESS INFORMATION;
   (II)  REQUESTING  OR REQUIRING AN EMPLOYEE TO DISCLOSE ACCESS INFORMA-
 TION TO AN ACCOUNT  KNOWN  TO  AN  EMPLOYER  TO  BE  USED  FOR  BUSINESS
 PURPOSES;
   (III)  ACCESSING AN ELECTRONIC COMMUNICATIONS DEVICE PAID FOR IN WHOLE
 OR IN PART BY THE EMPLOYER WHERE THE PROVISION OF OR  PAYMENT  FOR  SUCH
 ELECTRONIC COMMUNICATIONS DEVICE WAS CONDITIONED ON THE EMPLOYER'S RIGHT
 TO  ACCESS SUCH DEVICE AND THE EMPLOYEE WAS PROVIDED PRIOR NOTICE OF AND
 EXPLICITLY AGREED TO SUCH CONDITIONS. HOWEVER, NOTHING IN THIS  SUBPARA-
 GRAPH  SHALL  PERMIT AN EMPLOYER TO ACCESS ANY PERSONAL ACCOUNTS ON SUCH
 DEVICE;
   (IV) COMPLYING WITH A COURT ORDER IN OBTAINING OR  PROVIDING  INFORMA-
 TION  FROM, OR ACCESS TO, AN EMPLOYEE'S ACCOUNTS AS SUCH COURT ORDER MAY
 REQUIRE;
   (V)  RESTRICTING  OR  PROHIBITING  AN  EMPLOYEE'S  ACCESS  TO  CERTAIN
 WEBSITES  WHILE USING AN EMPLOYER'S NETWORK OR WHILE USING AN ELECTRONIC
 COMMUNICATIONS DEVICE PAID FOR IN WHOLE OR PART BY  THE  EMPLOYER  WHERE
 THE  PROVISION  OF OR PAYMENT FOR SUCH ELECTRONIC COMMUNICATIONS  DEVICE
 WAS CONDITIONED ON THE EMPLOYER'S RIGHT TO RESTRICT SUCH ACCESS AND  THE
 EMPLOYEE  WAS  PROVIDED  PRIOR  NOTICE  OF AND EXPLICITLY AGREED TO SUCH
 CONDITIONS.
   (B) THIS SECTION DOES  NOT  PROHIBIT  OR  RESTRICT  AN  EMPLOYER  FROM
 COMPLYING  WITH A DUTY TO SCREEN EMPLOYEES OR APPLICANTS PRIOR TO HIRING
 OR TO MONITOR OR RETAIN  EMPLOYEE  COMMUNICATIONS  THAT  IS  ESTABLISHED

 A. 2479                             3
 
 UNDER  FEDERAL  LAW  OR BY A SELF REGULATORY ORGANIZATION, AS DEFINED IN
 SECTION 3(A)(26) OF THE SECURITIES AND EXCHANGE  ACT  OF  1934,  15  USC
 78C(A)(26).
   (C)  THIS SECTION DOES NOT PROHIBIT OR RESTRICT AN EMPLOYER FROM VIEW-
 ING, ACCESSING, OR UTILIZING INFORMATION ABOUT AN EMPLOYEE OR  APPLICANT
 THAT  CAN BE OBTAINED WITHOUT ANY REQUIRED ACCESS INFORMATION OR THAT IS
 AVAILABLE IN THE PUBLIC DOMAIN.
   6. THE PROVISIONS OF THIS SECTION SHALL NOT APPLY TO ANY LAW  ENFORCE-
 MENT AGENCY, A FIRE DEPARTMENT OR A DEPARTMENT OF CORRECTIONS AND COMMU-
 NITY SUPERVISION.
   §  2. The education law is amended by adding a new section 115 to read
 as follows:
   § 115. REQUEST FOR ACCESS TO  PERSONAL  ACCOUNTS  PROHIBITED.  1.  FOR
 PURPOSES  OF  THIS SECTION, THE FOLLOWING WORDS SHALL HAVE THE FOLLOWING
 MEANINGS:
   (A) "EDUCATIONAL INSTITUTION" MEANS A PUBLIC  OR  PRIVATE  EDUCATIONAL
 INSTITUTION  OR  SEPARATE  SCHOOL  OR  DEPARTMENT OF A PUBLIC OR PRIVATE
 EDUCATIONAL INSTITUTION, AND INCLUDES AN ACADEMY; ELEMENTARY OR  SECOND-
 ARY  SCHOOL;  EXTENSION  COURSE;  KINDERGARTEN;  NURSERY  SCHOOL; SCHOOL
 SYSTEM; SCHOOL DISTRICT; INTERMEDIATE SCHOOL DISTRICT;  BUSINESS,  NURS-
 ING,  PROFESSIONAL, SECRETARIAL, TECHNICAL, OR VOCATIONAL SCHOOL; PUBLIC
 OR PRIVATE EDUCATIONAL TESTING SERVICE OR ADMINISTRATOR; AND AN AGENT OF
 AN EDUCATIONAL INSTITUTION. EDUCATIONAL INSTITUTION SHALL  BE  CONSTRUED
 BROADLY  TO  INCLUDE PUBLIC AND PRIVATE INSTITUTIONS OF HIGHER EDUCATION
 TO THE GREATEST EXTENT CONSISTENT WITH CONSTITUTIONAL LIMITATIONS.
   (B) "ELECTRONIC COMMUNICATIONS DEVICE"  MEANS  ANY  DEVICE  THAT  USES
 ELECTRONIC SIGNALS TO CREATE, TRANSMIT, AND RECEIVE INFORMATION, INCLUD-
 ING,  BUT NOT LIMITED TO COMPUTERS, TELEPHONES, PERSONAL DIGITAL ASSIST-
 ANTS AND OTHER SIMILAR DEVICES.
   (C) "PERSONAL ACCOUNT" MEANS AN ACCOUNT OR PROFILE  ON  AN  ELECTRONIC
 MEDIUM  WHERE  USERS MAY CREATE, SHARE, AND VIEW USER-GENERATED CONTENT,
 INCLUDING UPLOADING OR DOWNLOADING VIDEOS OF STILL  PHOTOGRAPHS,  BLOGS,
 VIDEO BLOGS, PODCASTS, INSTANT MESSAGES, OR INTERNET WEBSITE PROFILES OR
 LOCATIONS  THAT  IS USED BY A STUDENT OR A PROSPECTIVE STUDENT PRIMARILY
 FOR PERSONAL PURPOSES.
   2. IT SHALL BE UNLAWFUL FOR ANY EDUCATIONAL INSTITUTION TO:
   (A) REQUEST, REQUIRE, OR COERCE ANY STUDENT OR PROSPECTIVE STUDENT  TO
 DISCLOSE  ANY  USER NAME AND PASSWORD, PASSWORD, OR OTHER AUTHENTICATION
 INFORMATION THAT ALLOWS ACCESS TO A PERSONAL ACCOUNT;
   (B) REQUEST, REQUIRE, OR COERCE A STUDENT OR  PERSPECTIVE  STUDENT  TO
 ACCESS  THE  STUDENT'S  OR PROSPECTIVE STUDENT'S PERSONAL ACCOUNT IN THE
 PRESENCE OF THE EDUCATIONAL INSTITUTION;
   (C) REQUEST, REQUIRE OR COERCE A STUDENT  OR  PERSPECTIVE  STUDENT  TO
 REPRODUCE  IN  ANY  MANNER  PHOTOGRAPHS,  VIDEOS,  OR  OTHER INFORMATION
 CONTAINED WITHIN A PERSONAL ACCOUNT; OR
   (D) SUSPEND, EXPEL, DISCIPLINE, FAIL TO ADMIT, OR OTHERWISE PENALIZE A
 STUDENT OR PROSPECTIVE STUDENT FOR FAILURE TO  GRANT  ACCESS  TO,  ALLOW
 OBSERVATION  OF, OR DISCLOSE INFORMATION THAT ALLOWS ACCESS TO OR OBSER-
 VATION OF THE STUDENT'S OR PROSPECTIVE STUDENT'S PERSONAL ACCOUNT.
   (E) FOR THE PURPOSES OF THIS SECTION, "ACCESS"  SHALL  NOT  INCLUDE  A
 STUDENT  OR  APPLICANT  VOLUNTARILY ADDING AN EDUCATIONAL INSTITUTION TO
 THEIR LIST OF CONTACTS ASSOCIATED WITH A PERSONAL ACCOUNT.
   3. NOTHING IN THIS SECTION PROHIBITS AN EDUCATIONAL INSTITUTION FROM:
   (A) ACCESSING AN ELECTRONIC COMMUNICATIONS DEVICE PAID FOR IN WHOLE OR
 IN PART BY THE EDUCATIONAL INSTITUTION WHERE THE PROVISION OF OR PAYMENT
 FOR SUCH ELECTRONIC COMMUNICATIONS DEVICE WAS CONDITIONED ON THE  EDUCA-

 A. 2479                             4
 
 TIONAL  INSTITUTION'S  RIGHT  TO  ACCESS SUCH DEVICE AND THE STUDENT WAS
 PROVIDED PRIOR NOTICE OF  AND  EXPLICITLY  AGREED  TO  SUCH  CONDITIONS.
 HOWEVER,  NOTHING IN THIS PARAGRAPH SHALL PERMIT AN EDUCATIONAL INSTITU-
 TION TO ACCESS ANY PERSONAL ACCOUNTS OR SERVICES ON SUCH DEVICE; OR
   (B)  REQUESTING  OR REQUIRING A STUDENT TO DISCLOSE ACCESS INFORMATION
 TO AN ACCOUNT PROVIDED BY THE EDUCATIONAL INSTITUTION WHERE SUCH ACCOUNT
 IS USED EXCLUSIVELY FOR EDUCATIONAL PURPOSES AND THE STUDENT  OR  PARENT
 OR  GUARDIAN  FOR  STUDENTS UNDER THE AGE OF EIGHTEEN WAS PROVIDED PRIOR
 NOTICE OF THE EDUCATIONAL INSTITUTION'S RIGHT TO REQUEST OR REQUIRE SUCH
 ACCESS INFORMATION.  HOWEVER, NOTHING IN THIS SUBDIVISION  SHALL  PERMIT
 AN EDUCATIONAL INSTITUTION TO ACCESS ANY PERSONAL ACCOUNTS ON A COMMUNI-
 CATIONS DEVICE.
   4. THIS SECTION SHALL NOT PROHIBIT OR RESTRICT AN EDUCATIONAL INSTITU-
 TION  FROM  VIEWING, ACCESSING, OR UTILIZING INFORMATION ABOUT A STUDENT
 OR APPLICANT THAT CAN BE OBTAINED WITHOUT ANY REQUIRED  ACCESS  INFORMA-
 TION OR THAT IS AVAILABLE IN THE PUBLIC DOMAIN.
   5.  IT  IS AN AFFIRMATIVE DEFENSE TO AN ACTION UNDER THIS SECTION THAT
 THE EDUCATIONAL INSTITUTION ACTED  TO  COMPLY  WITH  REQUIREMENTS  OF  A
 FEDERAL, STATE OR LOCAL LAW.
   § 3. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.