48-3507. Employer's rights not limited by act.

Nothing in the Workplace Privacy Act limits an employer's right to:

(1) Promulgate and maintain lawful workplace policies governing the use of the employer's electronic equipment, including policies regarding Internet use and personal Internet account use;

(2) Request or require an employee or applicant to disclose access information to the employer to gain access to or operate:

(a) An electronic communication device supplied by or paid for in whole or in part by the employer; or

(b) An account or service provided by the employer, obtained by virtue of the employee's employment relationship with the employer, or used for the employer's business purposes;

(3) Restrict or prohibit an employee’s access to certain web sites while using an electronic communication device supplied by or paid for in whole or in part by the employer or while using an employer’s network or resources, to the extent permissible under applicable laws;

(4) Monitor, review, access, or block electronic data stored on an electronic communication device supplied by or paid for in whole or in part by the employer or stored on an employer’s network, to the extent permissible under applicable laws;

(5) Access information about an employee or applicant that is in the public domain or is otherwise obtained in compliance with the Workplace Privacy Act;

(6) Conduct an investigation or require an employee to cooperate in an investigation under any of the following circumstances:

(a) If the employer has specific information about potentially wrongful activity taking place on the employee’s personal Internet account, for the purpose of ensuring compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct; or

(b) If the employer has specific information about an unauthorized download or transfer of the employer's private proprietary information, private financial data, or other confidential information to an employee’s personal Internet account;

(7) Take adverse action against an employee for downloading or transferring an employer’s private proprietary information or private financial data to a personal Internet account without the employer’s authorization;

(8) Comply with requirements to screen employees or applicants before hiring or to monitor or retain employee communications that are established by state or federal law or by a self-regulatory organization as defined in 15 U.S.C. 78c(a)(26), as such section existed on January 1, 2016; or

(9) Comply with a law enforcement investigation conducted by a law enforcement agency.

Source