INTERNET PRIVACY PROTECTION ACT H.B. 5523 (H-3):
COMMITTEE SUMMARY
House Bill 5523 (Substitute H-3 as passed by the House)
Sponsor: Representative Aric Nesbitt
House Committee: Energy and Technology
Senate Committee: Energy and Technology
CONTENT
The bill would create the "Internet Privacy Protection Act" to do the following:
-- Prohibit an employer or educational institution from requesting an employee, applicant for employment, student, or prospective student to grant access to or allow observation of his or her personal internet account.
-- Designate a violation of the prohibition as a misdemeanor and prescribe a fine.
-- Allow an individual who was the subject of a violation to bring a civil action and recover up to $1,000 in damages.
-- Require an individual to make a written demand of the alleged violator for a maximum of $1,000 before filing a civil action.
Prohibitions
The bill would prohibit an employer from requesting an employee or applicant for employment to grant access to, allow observation of, or disclose information that allowed access to or observation of the employee's or applicant's personal internet account. The bill would prohibit an educational institution from making a similar request of a student or prospective student.
An employer could not discharge, discipline, fail to hire, or otherwise penalize an employee or applicant, and an educational institution could not expel, discipline, fail to admit, or otherwise penalize a student or prospective student, for failure to grant access to, allow observation of, or disclose information that allowed access to or observation of the person's personal internet account.
"Employer" would mean a person, including a unit of State or local government, engaged in a business, industry, profession, trade, or other enterprise in Michigan. The term would include an agent, representative, or designee of the employer.
"Educational institution" would mean a public or private educational institution or a separate school or department of a public or private educational institution, including an academy; elementary or secondary school; extension course; kindergarten; nursery school; school system; school district; intermediate school district; business, nursing, professional, secretarial, technical, or vocational school; public or private educational testing service or administrator; and an agent of an educational institution. The term would have to be construed broadly to include public and private institutions of higher education to the greatest extent consistent with constitutional limitations.
"Personal internet account" would mean an account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, use, or edit the user's account information, profile, display, communications, or stored data. "Access information" would mean user name, password, login information, or other security information that protects access to a personal internet account.
Violations
A person who violated a prohibition established by the bill would be guilty of a misdemeanor punishable by a maximum fine of $1,000.
An individual who was the subject of a violation could bring a civil action to enjoin the violation, and could recover up to $1,000 in damages plus reasonable attorney fees and court costs. At least 60 days before filing a civil action for damages or adding a claim for damages to an action seeking injunctive relief, the individual would have to make a written demand of the alleged violator for a maximum of $1,000. The demand would have to include reasonable documentation of the violation. The demand and documentation either would have to be served in the manner provided by law for service of process in civil actions, or mailed by certified mail to the alleged violator at his or her residence, principal office, or place of business. An action could be brought in the circuit court for the county where the alleged violation occurred or for the county where the person against whom the complaint was filed resided or had his or her principal place of business.
It would be an affirmative defense to an action that the employer or educational institution acted to comply with the requirements of a State or Federal law.
Scope of Act
The proposed Act would not prohibit an employer from requesting or requiring an employee to disclose access information to the employer to gain access to or operate any of the following:
-- An electronic communications device paid for in whole or in part by the employer.
-- An account or service provided by the employer, obtained by virtue of the employee's employment relationship with the employer, or used for the employer's business purposes.
The Act also would not prohibit an employer from disciplining or discharging an employee for transferring the employer's proprietary or confidential information or financial data to an employee's personal internet account without the employer's authorization.
In addition, the Act would not prohibit an employer from conducting an investigation or requiring an employee to cooperate in an investigation in either of the following circumstances:
-- If there were specific information about activity on the employee's personal internet account, for the purpose of ensuring compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct.
-- If the employer had specific information about an unauthorized transfer of the employer's proprietary or confidential information or financial data to an employee's personal internet account.
The proposed Act would not prohibit or restrict an employer from complying with a duty to screen employees or applicants before hiring or to monitor or retain employee communications that was established under Federal law or by a self-regulatory organization,
as defined in Section 3(a)(26) of the Federal Securities and Exchange Act. (Under that Act, "self-regulatory organization" means any national securities exchange, registered securities association, or registered clearing agency, or the Municipal Securities Rulemaking Board.)
Also, the proposed Act would not prohibit an educational institution from requesting or requiring a student to disclose access information to the institution to gain access to or operate either of the following:
-- An electronic communications device paid for in whole or in part by the institution.
-- An account or service provided by the institution that was either obtained by virtue of the student's admission to the institution or used by the student for educational purposes.
The proposed Act would not create a duty for an employer or educational institution to search or monitor the activity of a personal internet account. An employer or educational institution would not be liable for failure to request or require that an employee, student, applicant for employment, or prospective student grant access to, allow observation of, or disclose information that allowed access to or observation of his or her personal internet account.
Legislative Analyst: Julie Cassidy
FISCAL IMPACT
The bill could result in additional misdemeanor convictions. Increased fine revenue would benefit public libraries. Local courts could face a marginal increase in caseload due to civil actions brought due to alleged violations of the bill.
This analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent.