SECTION 173.1600 - This act prohibits educational institutions, as described, from doing any of the following: require, request, or coerce a student or prospective student to disclose the user name, password, or any other means of authentication, or provide access, to a personal social media account; require, request, or coerce a student or prospective student to access a personal social media account in the presence of a school employee or school volunteer in a manner that enables the employee or volunteer to observe the contents of the account; or compel a student or prospective to add anyone to his or her list of contacts for a personal social media account or change the settings on such an account that affect a third party's ability to view its contents.

This act also prohibits educational institutions from taking certain actions against a student or prospective student for failing to provide certain information to the institution.

Educational institutions may access information about a student or prospective student that is publicly available; comply with state and federal laws; request or require that a student or a prospective student share specific content, as described in the act; prohibit a student or prospective student from using a personal social media account for school purposes; or prohibit a student or prospective student from accessing or operating a personal social media account during school hours or while on school property.

A student or prospective student may bring a cause of action for general or specific damages based on any violation of this section.

This section is identical to a provision contained in HB 912 (2015).

SECTION 285.045 - This act creates the Password Privacy Protection Act. This act prohibits any employer from requesting or requiring an employee or applicant to disclose any user name, password, or other authentication means for accessing a personal online account or personal online service or compel an employee or applicant to add the employer or agency to his or her list of contacts associated with a personal internet account. However, an employer may request or require an employee to disclose a user name, password, or other authentication means to access an electronic communications device supplied by or paid for by the employer; any accounts or services provided by the employer; any accounts or services the employee uses for business purposes; or any accounts or services used as a result of their employment relationship.

Employers are prohibited from doing any of the following: discharging, disciplining, penalizing, or threatening to discharge, discipline or penalize an employee solely for refusing to disclose any such information; failing or refusing to hire an applicant as a result of refusing to disclose such information; or be held liable for failure to request or require that an applicant or employee disclose any such information.

Employers are prohibited from transferring an employer's proprietary or confidential information or financial data to an employee's personal online account or personal online service without the employer's authorization.

These provisions must not be construed to prevent an employer from engaging in certain investigations, certain disciplinary actions, restricting or prohibiting employee access to certain websites, or monitoring, reviewing, accessing, or blocking certain electronic data, as described in the act.

This act does not prohibit or restrict an employer from viewing, accessing, or utilizing certain employee or applicant information that is publicly available or can be obtained in other ways. In addition, this act must not be construed to prohibit an employer from requesting an employee to provide an email address to conduct business-related communications with the employee. No such address may be disclosed to a third party.

MICHAEL RUFF