A. As used in this section:

"Employer" includes, in addition to the persons enumerated in the definition of employer in § 40.1-2, (i) any unit of state or local government and (ii) any agent, representative, or designee of a person or unit of government that constitutes an employer.

"Social media account" means a personal account with an electronic medium or service where users may create, share, or view user-generated content, including, without limitation, videos, photographs, blogs, podcasts, messages, emails, or website profiles or locations. "Social media account" does not include an account (i) opened by an employee at the request of an employer; (ii) provided to an employee by an employer such as the employer's email account or other software program owned or operated exclusively by an employer; (iii) set up by an employee on behalf of an employer; or (iv) set up by an employee to impersonate an employer through the use of the employer's name, logos, or trademarks.

B. An employer shall not require a current or prospective employee to:

1. Disclose the username and password to the current or prospective employee's social media account; or

2. Add an employee, supervisor, or administrator to the list of contacts associated with the current or prospective employee's social media account.

C. If an employer inadvertently receives an employee's username and password to, or other login information associated with, the employee's social media account through the use of an electronic device provided to the employee by the employer or a program that monitors an employer's network, the employer shall not be liable for having the information but shall not use the information to gain access to an employee's social media account.

D. An employer shall not:

1. Take action against or threaten to discharge, discipline, or otherwise penalize a current employee for exercising his rights under this section; or

2. Fail or refuse to hire a prospective employee for exercising his rights under this section.

E. This section does not prohibit an employer from viewing information about a current or prospective employee that is publicly available.

F. Nothing in this section:

1. Prevents an employer from complying with the requirements of federal, state, or local laws, rules, or regulations or the rules or regulations of self-regulatory organizations; or

2. Affects an employer's existing rights or obligations to request an employee to disclose his username and password for the purpose of accessing a social media account if the employee's social media account activity is reasonably believed to be relevant to a formal investigation or related proceeding by the employer of allegations of an employee's violation of federal, state, or local laws or regulations or of the employer's written policies. If an employer exercises its rights under this subdivision, the employee's username and password shall only be used for the purpose of the formal investigation or a related proceeding.

2015, c. 576.