NEWS

By Matt Nordfjord/Managing Shareholder, CST Municipal Law

Much of an employee’s public-facing speech may take the form of social media posts. As technology evolves, employers, including counties, may be tempted to seek access to an employee’s or applicant’s non-public social media accounts. However, Michigan law prohibits employers from doing so under the Michigan Internet Privacy Protection Act (“IPPA”) MCL 37.271 et seq.

Prohibitions for employers

The IPPA restricts employers from requesting access to an employee’s or job applicant’s “personal internet account.” Under MCL 37.273, an employer cannot:

(a) Request an employee or an applicant for employment to grant access to, allow observation of, or disclose information that allows access to or observation of the employee’s or applicant’s personal internet account.

(b) Discharge, discipline, fail to hire or otherwise penalize an employee or applicant for employment for failure to grant access to, allow observation of, or disclose information that allows access to or observation of the employee’s or applicant’s personal internet account. Id.

Key definitions under the IPPA

“Personal internet account” is defined as “an account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, utilize, or edit the user’s account information, profile, display, communications, or stored data.”  (MCL 37.272(d) (i.e. Gmail, Facebook, X, TikTok etc.))  “Access information” means “username, password, login information, or other security information that protects access to a personal internet account.”  (MCL 37.272(a))

Important exemptions and limitations

The IPPA is not a blanket ban on all employer actions related to online activity. Several key exemptions exist:

1. Publicly available information: Employers can view, access, or use any information about an employee or applicant that is publicly available (i.e., visible without requiring access information).

1. Employer-provided devices and accounts: An employer can request or require access information for devices, accounts, or services that were provided by the employer or paid for in whole or in part by the employer. This also applies to devices used for the employer’s business purposes.
2. Investigations for specific misconduct: If an employer has specific information about activity on an employee’s personal internet account, they may investigate and require cooperation. This is permitted for purposes of ensuring compliance with laws, regulations, or to address prohibited work-related misconduct.

First Amendment implications for counties as public employers

For county employers the First Amendment provides an additional layer of protection for speech. The following three-pronged test determines if an employee’s speech is protected:

1. Private citizen speech: The employee must have spoken as a private citizen, not as part of their official duties. Speech made in an official capacity is not protected by the First Amendment.
2. Matter of public concern: The speech must address a matter of public concern, which relates to any political, social, or other community issue (Marquardt v Carlton, 971 F.3d 546 (6th Cir. 2020)). Courts distinguish this from speech concerning purely personal workplace grievances. 
3. Balancing test: The employee’s interest in speaking on the matter must outweigh the public employer’s interest in promoting the efficiency of public services. (Pickering v. Bd. of Educ. of Twp. High Sch., 391 U.S. 563 (1968)) Courts will consider the potential negative impact on the employer’s operations, mission, and working relationships balanced against the employee’s First Amendment protection.

Practical takeaways

Given these restrictions, public employers in Michigan are generally prohibited from requesting or demanding social media passwords from employees or applicants, including during pre-employment background checks. While public information remains fair game, employers must be mindful of the IPPA’s limits and the First Amendment rights of their employees when investigating social media conduct. Employers should ensure all hiring and disciplinary policies align with the IPPA, consult legal counsel when an investigation involves an employee’s personal internet account, and focus social media monitoring efforts on publicly available information and work-related accounts or devices.