Democratic Texas State Representative Helen Giddings filed a bill prohibiting employers in Texas from asking for social media passwords from applicants and current employees.  Texas joins a long list of states that have either passed or proposed similar legislation. 

On December 21, 2012, HB 318 was pre-filed.  Democratic State Senator Chuy Hinojosa filed the exact bill with the Senate as SB 118.  The bills read: 

(b) An employer commits an unlawful employment practice if the employer requires or requests that an employee or applicant for employment disclose a user name, password, or other means for accessing a personal account of the employee or applicant, including a personal e-mail account or a social networking website account or profile, through an electronic communication device.

(c) This section does not prohibit an employer from:

(1) maintaining lawful workplace policies governing:

(A) employee usage of employer-provided electronic communication devices, including employee access to personal accounts on those devices; or

(B) employee usage of personal electronic communication devices during working hours;

(2) monitoring employee usage of employer-provided electronic communication devices or employer-provided e-mail accounts; or

(3) obtaining information about an employee or applicant for employment that is in the public domain or that is otherwise lawfully obtained.

Six states already have similar laws and many others are considering similar legislation.  The National Conference of State Legislatures has a good resource that tracks what all of the states are doing in this area. 

Here are a couple of issues I see with the Texas version.

1.  There is no exemption for employers to investigate wrongdoing.

For example, Michigan lays out some exceptions that exclude “Disciplining or discharging an employee for transferring the employer’s proprietary or confidential information or financial data to an employee’s personal internet account without the employer’s authorization”; and “conducting an investigation or requiring an employee to cooperate in an investigation . . .”   

2.  There is no exemption for highly-regulated industries like securities.

The Michigan law exempts employers “if there is specific information about activity on the employee’s personal internet account, for the purpose of ensuring compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct.”

3.   What about shoulder-surfing?

The statute forbids employers from using “other means for accessing a personal account” but there is a qualifier at the end that seems to limit the employer’s access to the account ”through an electronic communication device.”  So, can an employer tell an applicant or employee to log-in to Facebook while I look over your shoulder?  It is certainly not clear.  Other states take a more direct approach.    The California law expressly forbids requiring an employee to “access personal social media in the presence of the employer” which would prevent shoulder surfing.

4.  Immunity for employers who can no longer access social media accounts.

 I normally advise companies not to use social media to screen applicants unless you have and follow a specific plan.  I could foresee, however, that a mishap could happen at work and a creative plaintiff’s lawyer could argue negligent hiring because a social media search would have revealed the employee was racist, sexist, violent, etc.  It would make sense then that if employers are prohibited from doing thorough social media research, they should not be held liable for failing to do so if something went wrong.  Michigan has addressed this in its version by stating:

Sec. 7. (1) This act does not create a duty for an employer or educational institution to search or monitor the activity of a personal internet account.

(2) An employer or educational institution is not liable under this act for failure to request or require that an employee, a student, an applicant for employment, or a prospective student grant access to, allow observation of, or disclose information that allows access to or observation of the employee’s, student’s, applicant for employment’s, or prospective student’s personal internet account.

5.  What about students?

Many of the bills apply the same rules to secondary school, colleges and universities.  If we care about privacy, shouldn’t we apply it to them as well.

These are just a few issues and I still question whether this a fix in search of a problem.  Yes, there have been one or two publicized incidents of employers demanding access to social media accounts.  But, I’m not the only one that questions whether laws forbidding requests for social media accounts are necessary.  As the economy recovers, I would think this is something the market will handle.  Besides, I see certain positions where such requests would be encouraged such as youth camp counselors or mental health providers, security personnel and employees for religious institutions. 

This is the second part of our Texas Leg Watch 2013.  The Texas Legislature meets every odd year, so we will monitor any bills of interest to the online media, marketing and start-up community.  Our first post looked at a proposal that would allow civil lawsuits to be brought against internet online advertisements that resulted in human trafficking perhaps usurping the federal Communications Decency Act protections.

Yes, it’s the lazy way to do a post during the week before Christmas and New Year.  In my next post, we will use this information to help predict the trends of legal issues for online media, marketing, internet law and start-ups for 2013.

1.   SOPA The Debate in Plain English and the SOPA Update and Editorial

The two posts were actually numbers 1 and 3 respectively and if you click on the Update and Editorial, you can see the original post.  The original post was done in December 2011, but as Congress debated the issue in early January 2012, the readers kept coming.  These two posts were the most popular ever for this blog and there was a lot of angst about what Congress.  As we sit here with three days before the end of 2012, it almost seems quaint that Congress fought about SOPA rather than a made up self-imposed fiscal cliff.

2.   The Law of Using Images from the Web on Your Blog

This tells me there is a need for some Internet Law 101 type of information.  On my list of things to do in 2013 is to put together a series of these types of posts for a more permanent placement.  Should I self-publish an e-book?

3.  City of Paris Ordered to Pay for Reverse Domain Name Hijacking

This was the most interesting litigation matter I worked on this year.  If you are a domainer the decision was very important.  Or, if you just think the French are rude or still don’t like Zinedine Zidane from his 2008 World Cup headbutt, you might just find this story interesting.

Yes, that was a gratuitous French soccer snub.  Now, to collect against the City of Paris in 2013.

4.  The three-part series on online defamation that included (1)  Protecting Yourself Online Does not Have to Include Legal; (2) How to Identify the Anonymous Online Defamer; and (3) Conclusion – Anti-SLAPP

This may have been popular because I often send potential clients there.  If you think you have been wronged on a review site or by some blogger, read this series for a basic understanding of your options and the role a lawyer can play.

5.   The Cost of Fake Online Reviews Goes Beyond Morality

This tells me businesses are really concerned about online reviews.  The DMCA protects the review sites, but should there be changes to this law?  Of course, the review site is protected, but you should know by now that if you provide the review and it crosses the line, you could be liable.

On an interesting note, just out of the top five most viewed posts in 2012 was a post I did back in 2009 entitled Online Harassment Becomes Law Today.  That tells me not much has been written about the Texas law and it probably has not been used too often.  I often tell potential clients about it suggesting they visit with a local D.A. about enforcing the penal provision.  I’ve not had anyone come back and tell me the D.A.. agreed to prosecute.

In July, Netflix CEO Reed Hastings posted on Facebook that viewing on his company’s site “exceeded 1 billion hours” of videos in June.   The stock rose 6.2% on the day of the post.  Last week, the SEC sent Netflix notice it may investigate.  You can read the Washington Post story here. 

Reg FD, or Fair Disclosure, is the issue.  In a nutshell, companies must make public disclosures of material information to the general public and cannot selectively provide information to favored shareholders or investors.  That’s loaded for two reasons – “public disclosure” and “material.”

Public Disclosure

Usually companies provide press releases to recognized wires or news services and then make public filings with the SEC to make public disclosures.  The reg also allows for “any other non-exclusionary method.”  

This time, the CEO sent the information to 200,000 of his fans on Facebook–many of whom were part of the business media who would have received the press release.  The CEO also posted on his blog earlier in June that Netflix was almost at 1 billion hours per month.  Neither were followed with press releases or SEC filings.

Reg FD was passed in 2000 — before Facebook and Twitter.  It wasn’t until 2008 that the SEC formally approved making public disclosures via company websites under certain circumstances.  Will this force the SEC to accept other more popular ways and current ways of disseminating information?  Perhaps every CEO of publicly traded company should be required to follow an official SEC account so all of their posts or tweets are re-issued and available in one spot. 

Material

Even if the post was not considered a public disclosure, there is still a question as to whether it was material.   As you can probably guess, “material” is not expressly defined, but the SEC has provided some guidelines.  It may be material if there is a “substantial likelihood that a reasonable shareholder would consider it important” such as earnings, M&A issues, new products, changes in management or serious defaults. 

Although Netflix says the information was not material, the stock did have its biggest one day rise in six weeks. 

So do we ban posts and tweets from the corner office?

The Wall Street Journal ran a story in September about the risk of CEOs being on Twitter. If you can’t stop the CEO, here are some tips to minimize risks for upper level management involved in social media.

 1.   Have a plan.  Review your current process you use to disseminate information to investors analysts and other in light of Reg FD.  After you spot the risks, prepare a policy outlining the consequences and share it with executives, investor relations and anyone else who is responsible for talking to investors.  Use the policy to do periodic Reg FD planning and designate a primary compliance person to review statements before they go out if there is a question.

2.   Have a specific plan regarding earnings or other major announcements and collect all public statements not including social media such as SEC filings, press conferences and and conference call transcripts. 

3.   Track the social media accounts of your major executives.  Unless you want to pre-approve the CEO’s message about the company softball game in advance, at least allow your primary compliance person to track all of the various social media accounts to take swift action.

4.  Plan for the unintentional selective disclosure.  That is a term of art under the Regs and requires corrective action beyond the scope of this post.  Assume it is going to happen and be prepared for it with IR, management and your legal team.

5.  When in doubt, bring a witness.  If you are hosting a conference or call and you are concerned, bring someone along whose sole job is to recognize and note any unintentional disclosures.

6.   Get insurance for your executives and the company.

Will the SEC come around and allow for Twitter and Facebook to be used for public disclosures?  If the speed of their implementation of crowd funding is any indication, it may be some time before there is some brightline guidance.  Until then, we have to watch what happens to others.  Tesla could be next — on December 4, the CEO tweeted “Am happy to report that Tesla was narrowly cash flow positive last week” to his almost 113,000 followers.

The State of Texas may find out and it may be more applicable to your site than you think.  In early filing for the 2013 legislative session, Democratic state Senator Leticia Van de Putte proposed a bill aimed at stopping at stopping human trafficking.  The entire text is here.

It allows for human trafficking victims to bring civil suits against the wrongdoers including websites, that allow advertisements promoting the compelled sex trade.  Specifically, it states a website can be liable if it:

publishes an advertisement that the [website] knows or reasonably should know constitutes promotion of  prostitution or aggravated prostitution and the publication of the advertisement results in compelling prostitution with respect to the victim. 

The Bill and Section 230

I’ll parse through the language below, but first I want to discuss how this law may interact with Section 230 of the Communications Decency Act.  Section 230 provides the operators of websites with immunity from any suits caused by the content created by others.  It states:

no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

It usually shields sites from defamation claims, but it has been applied to almost all claims that stem from the content  created by others.

So what happens if a website simply allows anyone to create ads, specifically adult services ads without having any say as to the content?  Would the CDA trump this Texas proposal?  Online adult listing companies have already prevailed on several related suits in Missouri, Washington and Illinois.  If Texas passes the law, it is likely to legislate its way into a lawsuit. 

Numerous local and state officials have attempted to crack down on at least one known adult-listing service without much success.  The passage of the law in Texas could be a symbolic statement increasing the fervor for Congress to make changes to the CDA.  The CDA already expressly excludes liability for federal criminal laws including child pornography.  Thus, Congress could carve out a similar exemption as it relates to human trafficking.

The Language of the Texas Bill 

If the proposed law were to survive CDA and other challenges, it could present some interesting trial issues.  First, you have to parse through the definitions.  “Promotion of prostitution” is essentially pimping for one person.  “Aggravated promotion of prostitution” is running a pimping enterprise of more than one prostitute.  So, to be liable, the media company would have to know, or reasonably show know, that the advertisement is for promotion of prostitution (i.e., pimping). 

A successful plaintiff would not have to show, however, that the website operator knew the pimp was engaging in “compelling prostitution.”  Compelled prostitution means that through force or threat of force, you force someone to commit prostitution or cause a minor to commit prostitution–the human trafficking aspect.

While crass, the law essentially means that an advertisement for a “reputable pimp” who does not engage in “compelling prostitution” would be OK.  But, if you think that the advertising pimp is “reputable” and they turn out not to be because they force people or use minors, the website would be in trouble. 

Also interesting is that if you are the actual prostitute and you advertise, then the media company cannot be held liable because you are not engaging in “promotion of prostitution.”   

How would this apply to my site?

You may be thinking that I don’t run an adult classified listing site, so while interesting, I don’t care.  If you run any interactive site that allows for user generated content or messages, you may want to think again.  Under this provision, “advertisement” is defined to include communications that promote a commercial service on websites “operated for a commercial purpose.”  Read broadly, that could apply to every website that makes any money regardless of whether you accept classified listings or allow users to advertise, as we normally think of the term, on your site.  In other words, the “advertisement” that creates liability, could be a comment a user posted on your blog that makes some money.

So, if a pimp takes to Facebook and posts a free message promoting human trafficking, could Facebook be held liable?  Their liability would all come down to what did Facebook know or should it have known?

Human trafficking is a serious issue.  According to reports, adult classified that may involve adult trafficking is also serious business.  Without action from Congress, any efforts by Texas or other states to crack down on online advertising is likely to lead straight to the courthouse.

Shoot me an email or a comment if there is a topic or question you think should be addressed.  I’m looking forward to it.  With this group, success is seeing the back of iPads and phones tweeting.  Actual human attention can be scary.