HF 272 (LSB 1031YH (6) 85)

HOUSE FILE 272

BY  KELLEY, KAJTAZOVIC, HALL, and RUNNING-MARQUARDT

A BILL FOR

An Act prohibiting employers from seeking access to certain online personal employee information.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  NEW SECTION.  735.1  Definitions.
   As used in this chapter, unless the context otherwise requires:
   1.  “Electronic communications device” means any device that uses electronic signals to create, transmit, and receive information. “Electronic communications device” includes computers, telephones, personal digital assistants, and other similar devices.
   2.  “Employer” means the state of Iowa or any political subdivision, board, commission, department, or institution thereof, and every other person employing employees within this state. “Employer” includes an agent or representative of an employer.
    Sec. 2.  NEW SECTION.  735.2  Employer prohibitions.
   An employer shall not do any of the following:
   1.  Request or require that an employee or applicant for employment disclose the employee’s or applicant’s user name, password, or other means for accessing a personal account or service through an electronic communications device.
   2.  Discharge, discipline, or otherwise penalize or threaten to discharge, discipline, or otherwise penalize an employee for an employee’s refusal to disclose the employee’s user name, password, or other means for accessing a personal account or service through an electronic communications device.
   3.  Fail or refuse to hire any applicant for employment as a result of the applicant’s refusal to disclose the applicant’s user name, password, or other means for accessing a personal account or service through an electronic communications device.
    Sec. 3.  NEW SECTION.  735.3  Employee prohibitions.
   An employee shall not download unauthorized employer proprietary information or financial data to an employee’s personal internet site, internet-based account, or similar account.
    Sec. 4.  NEW SECTION.  735.4  Actions not prohibited —— employers.
   This chapter does not prohibit an employer from doing any of the following:
   1.  Requiring an employee to disclose any user name, password, or other means for accessing nonpersonal accounts or services that provide access to the employer’s internal computer or information systems.
   2.  Based on the receipt of information about the use of a personal internet site, internet-based account, or similar account by an employee for business purposes, requiring the employee to disclose the employee’s user name, password, or other means for accessing the employee’s personal account for purposes of conducting an investigation to ensure compliance with applicable state or federal law or regulatory requirements.
   3.  Based on the receipt of information about the unauthorized downloading of an employer’s proprietary information or financial data to a personal internet site, internet-based account, or similar account by an employee in violation of section 735.3, requiring the employee to disclose the employee’s user name, password, or other means for accessing the employee’s personal account for purposes of investigating such action by the employee.
   4.  Complying with a duty to screen employees or applicants for employment prior to hiring or to monitor or retain employee communications pursuant to state or federal law.
   5.  Viewing, accessing, or utilizing information about an employee or applicant for employment that can be obtained without the use of any user name, password, or other means for accessing a personal account or service through an electronic communications device, or that is available in the public domain.
EXPLANATION
   This bill prohibits an employer from requesting or requiring that an employee or applicant for employment disclose the employee’s or applicant’s user name, password, or other means for accessing a personal account or service through an electronic communications device. The bill prohibits an employer from discharging, disciplining, or otherwise penalizing or threatening to discharge, discipline, or otherwise penalize an employee for an employee’s refusal to disclose the employee’s user name, password, or other means for accessing a personal account or service through an electronic communications device. The bill also prohibits an employer from failing or refusing to hire any applicant for employment as a result of the applicant’s refusal to disclose the applicant’s user name, password, or other means for accessing a personal account or service through an electronic communications device.
   The bill defines “employer” as the state of Iowa or any political subdivision, board, commission, department, or institution thereof, and every other person employing employees within this state. “Employer” includes an agent or representative of an employer. The bill defines “electronic communications device” as any device that uses electronic signals to create, transmit, and receive information. “Electronic communications device” includes computers, telephones, personal digital assistants, and other similar devices. 
   The bill prohibits an employee from downloading unauthorized employer proprietary information or financial data to an employee’s personal internet site, internet-based account, or similar account.
   The bill sets out various actions by an employer which are not prohibited by the bill. An employer may require an employee to disclose any user name, password, or other means for accessing nonpersonal accounts or services that provide access to the employer’s internal computer or information systems. Based on the receipt of information about the use of a personal internet site, internet-based account, or similar account by an employee for business purposes, an employer may require the employee to disclose the employee’s user name, password, or other means for accessing the employee’s personal account for purposes of conducting an investigation to ensure compliance with applicable state or federal law or regulatory requirements. Based on the receipt of information about the unauthorized downloading of an employer’s proprietary information or financial data to a personal internet site, internet-based account, or similar account by an employee in violation of the bill, an employer may require the employee to disclose the employee’s user name, password, or other means for accessing the employee’s personal account for purposes of investigating such action by an employee. An employer may comply with a duty to screen employees or applicants for employment prior to hiring or to monitor or retain employee communications pursuant to state or federal law. An employer may view, access, or utilize information about an employee or applicant for employment that can be obtained without the use of any user name, password, or other means for accessing a personal account or service through an electronic communications device, or that is available in the public domain.