Although numerous states have adopted legislation protecting employees’ social media accounts from employers, as far as I am aware Maryland is the only state to enact legislation that offers privacy protections to college students’ (or applicants’) social media accounts from postsecondary institutions.
This Act applies to Maryland institutions of postsecondary education. In general, what the Act does is:
- prohibit colleges/universities from requiring or requesting a student (or applicant or prospective student) to disclose information (for example a password) that would allow the college/university to access and review the student’s “personal electronic account”;
- prohibit institutions from requiring a student (or applicant or prospective student), as a condition of participating in curricular/extracurricular activities (take note athletic departments), to add certain people as contacts or to change their privacy settings;
- prohibit an institution from threatening to take actions against a student (or not admit an applicant) if they do not allow the institution to access or observe information contained in their personal electronic account.
Although institutions are prohibited by this Act from doing the above, the legislation makes clear that the Act is not intended to:
- prohibit an institution from requiring the disclosure of access information to an account opened on behalf of the institution or that is provided by the institution;
- prohibit an institution from viewing or using information that can be obtained without protected access information or that is publicly available;
- create a duty requiring an institution to monitor the activity of a personal electronic account, or create institutional liability for an institution’s failure to request or compel access to information contained in a student’s (or applicant’s) personal electronic account;
- apply to a criminal investigation into publicly accessible communications that is performed by an institution’s law enforcement unit, or an investigation relating to publicly accessible communications that is conducted pursuant to an institution’s health and safety assessment policy or protocol.
The Act also provides a framework for a person to seek injunctive relief and monetary damages for potential violations. However, note that the monetary damages are limited to $1,000.
Although this Act is currently limited to institutions in Maryland, it would not be surprising to see more states adopt this sort of legislation. This is the experience found in the case of legislation offering protections for employee social media accounts where over the course of a few years many states adopted similar protectionist legislation. Counsel, student affairs professionals, and athletic departments should be aware that this may be on their horizon.
Feedback and shares welcome. Please let me know what you think of this post, other posts, or my blog. Thank you for visiting!