H.F. 2339 Section 1. NEW SECTION . 735.1 Definitions. 1 As used in this chapter, unless the context otherwise 2 requires: 3 1. “Electronic communications device” means any device 4 that uses electronic signals to create, transmit, and receive 5 information. “Electronic communications device” includes 6 computers, telephones, personal digital assistants, and other 7 similar devices. 8 2. “Employer” means the state of Iowa or any political 9 subdivision, board, commission, department, or institution 10 thereof, and every other person employing employees within this 11 state. “Employer” includes an agent or representative of an 12 employer. 13 Sec. 2. NEW SECTION . 735.2 Employer prohibitions. 14 An employer shall not do any of the following: 15 1. Request or require that an employee or applicant for 16 employment disclose the employee’s or applicant’s user name, 17 password, or other means for accessing a personal account or 18 service through an electronic communications device. 19 2. Discharge, discipline, or otherwise penalize or threaten 20 to discharge, discipline, or otherwise penalize an employee for 21 an employee’s refusal to disclose the employee’s user name, 22 password, or other means for accessing a personal account or 23 service through an electronic communications device. 24 3. Fail or refuse to hire any applicant for employment as a 25 result of the applicant’s refusal to disclose the applicant’s 26 user name, password, or other means for accessing a personal 27 account or service through an electronic communications device. 28 Sec. 3. NEW SECTION . 735.3 Actions not prohibited. 29 This chapter does not prohibit an employer from doing any of 30 the following: 31 1. Requiring an employee to disclose any user name, 32 password, or other means for accessing nonpersonal accounts 33 or services that provide access to the employer’s internal 34 computer or information systems. 35 -1- LSB 5951YH (2) 85 je/sc 1/ 4

H.F. 2339 2. Based on the receipt of information about the use of 1 a personal internet site, internet-based account, or similar 2 account by an employee for business purposes, requiring the 3 employee to disclose the employee’s user name, password, or 4 other means for accessing the employee’s personal account 5 for purposes of conducting an investigation to ensure 6 compliance with applicable state or federal law or regulatory 7 requirements. 8 3. Based on the receipt of information about the 9 unauthorized downloading of an employer’s proprietary 10 information or financial data to a personal internet site, 11 internet-based account, or similar account by an employee, 12 requiring the employee to disclose the employee’s user name, 13 password, or other means for accessing the employee’s personal 14 account for purposes of investigating such action by the 15 employee. 16 4. Complying with a duty to screen employees or applicants 17 for employment prior to hiring or to monitor or retain employee 18 communications pursuant to state or federal law or regulatory 19 requirements. 20 5. Viewing, accessing, or utilizing information about 21 an employee or applicant for employment that can be obtained 22 without the use of any user name, password, or other means for 23 accessing a personal account or service through an electronic 24 communications device, or that is available in the public 25 domain. 26 EXPLANATION 27 The inclusion of this explanation does not constitute agreement with 28 the explanation’s substance by the members of the general assembly. 29 This bill prohibits an employer from requesting or requiring 30 that an employee or applicant for employment disclose the 31 employee’s or applicant’s user name, password, or other 32 means for accessing a personal account or service through 33 an electronic communications device. The bill prohibits 34 an employer from discharging, disciplining, or otherwise 35 -2- LSB 5951YH (2) 85 je/sc 2/ 4

H.F. 2339 penalizing or threatening to discharge, discipline, or 1 otherwise penalize an employee for an employee’s refusal 2 to disclose the employee’s user name, password, or other 3 means for accessing a personal account or service through an 4 electronic communications device. The bill also prohibits an 5 employer from failing or refusing to hire any applicant for 6 employment as a result of the applicant’s refusal to disclose 7 the applicant’s user name, password, or other means for 8 accessing a personal account or service through an electronic 9 communications device. 10 The bill defines “employer” as the state of Iowa or 11 any political subdivision, board, commission, department, 12 or institution thereof, and every other person employing 13 employees within this state. “Employer” includes an agent or 14 representative of an employer. The bill defines “electronic 15 communications device” as any device that uses electronic 16 signals to create, transmit, and receive information. 17 “Electronic communications device” includes computers, 18 telephones, personal digital assistants, and other similar 19 devices. 20 The bill sets out various actions by an employer which 21 are not prohibited by the bill. An employer may require an 22 employee to disclose any user name, password, or other means 23 for accessing nonpersonal accounts or services that provide 24 access to the employer’s internal computer or information 25 systems. Based on the receipt of information about the use of 26 a personal internet site, internet-based account, or similar 27 account by an employee for business purposes, an employer 28 may require the employee to disclose the employee’s user 29 name, password, or other means for accessing the employee’s 30 personal account for purposes of conducting an investigation 31 to ensure compliance with applicable state or federal law or 32 regulatory requirements. Based on the receipt of information 33 about the unauthorized downloading of an employer’s proprietary 34 information or financial data to a personal internet site, 35 -3- LSB 5951YH (2) 85 je/sc 3/ 4

H.F. 2339 internet-based account, or similar account by an employee in 1 violation of the bill, an employer may require the employee to 2 disclose the employee’s user name, password, or other means 3 for accessing the employee’s personal account for purposes 4 of investigating such action by an employee. An employer 5 may comply with a duty to screen employees or applicants for 6 employment prior to hiring or to monitor or retain employee 7 communications pursuant to state or federal law or regulatory 8 requirements. An employer may view, access, or utilize 9 information about an employee or applicant for employment that 10 can be obtained without the use of any user name, password, or 11 other means for accessing a personal account or service through 12 an electronic communications device, or that is available in 13 the public domain. 14 -4- LSB 5951YH (2) 85 je/sc 4/ 4