So-So Social Media Privacy? State Legislators Should Reject New Model Bill and Stick With ACLU’s Gold Standard.

Social media has emerged as one of the most important free speech platforms of the 21st century, and as its use has spread far and wide, so has the interest of others in seeing what we post. Sometimes this interest has a dark side. More and more, job applicants and employees are being forced to provide employers with access to their social media accounts. Students are being forced to do the same by their schools, sometimes as a condition of participating on sports teams or in an extra-curricular activity. And increasingly landlords are presenting tenants with leases that include social media account access provisions. If you use a social media or other password-protected online account and you are a student, employee, or tenant, you have every reason to be concerned.

The ACLU is working to empower social media users by codifying their right to control who has access to the content of their online accounts. Along with other privacy advocates and partners in the technology industry, we have been making steady progress in advancing social media privacy bills in numerous states, including as part of our nationwide #TakeCTRL campaign, that protect social media users from those who would leverage their positions of power to gain access to the users’ personal online accounts.

Unfortunately, the emerging standard for protecting the privacy of social media accounts that we have worked to establish using ACLU model legislation is now threatened by a competing model that would roll back our progress. Who is behind this effort? It is the Uniform Law Commission (ULC), an association of attorneys that drafts model state legislation on subjects they deem of importance, which unveiled its Uniform Employee and Student Online Privacy Protection Act on November 17th. When you compare the ULC model bill to the latest version of the ACLU model bill, the Personal Online Account Privacy Act, it is abundantly clear why the ACLU bill is the gold standard for protecting social media privacy. State legislators who are considering proposing bills to protect social media and other online account privacy should note the following critical differences between the ACLU and ULC bills.

The ULC bill does not cover most students.

According to the U.S. Census Bureau, about 58 million students were enrolled in elementary and secondary schools in 2015, while 19 million were enrolled at the college level or above (post-secondary). Despite this, the ULC bill’s privacy protections only cover students “at the post-secondary level.” This means the ULC bill fails to protect a whopping 75 percent of all students. That stunning shortfall grows even larger in the case of certain student populations, such as Latinos, where 80 percent are not protected by the ULC bill.

Although the idea of a self-proclaimed student privacy act failing to cover three out of every four students seems laughable, the problems it creates are quite serious. Students, perhaps more than any other group, are hardwired for intellectual curiosity. They want to be able to use their online accounts to safely share new ideas and engage with their peers. While students may feel comfortable sharing certain thoughts and personal photographs with friends or family, they may not feel comfortable sharing them with teachers and school administrators.

But beyond that, some students may want to explore and discuss certain subjects that are taboo where they go to school, including certain political perspectives or sensitive issues, like sexual orientation or gender identity. Keeping these discussions private is not only a preference, it can sometimes be a necessity. In fact, it is not uncommon for some students to maintain multiple social media accounts, with access to some accounts being more restricted than others.

Students, the ACLU, and our social media company allies know full well that if the students do not truly have the ability to decide who can and cannot view the content they place on a particular social media platform, they will eventually stop using it. The only way to protect these platforms, and free speech on social media in general, is to pass the real student protections that are only found in the ACLU bill.

The ULC bill makes it too easy for employers and school officials to gain full access to a social media account.

Under the ULC bill, it is fairly easy for an employer or school official to gain access to the entire content of a person’s social media account. All that is required is for a person to make an unsubstantiated allegation of misconduct and to link that allegation to a specific social media account. On the other hand, under the ACLU bill, such allegations must identify the problematic social media content with specificity. If that is done, employers and school officials would then be allowed only to view the specifically identified content, and not the entire account.

The ULC appears to recognize its approach is problematic, but its attempts to limit the damage are wholly inadequate. First, the ULC bill states that the employer or school official “shall attempt reasonably to limit its access to content that is relevant” to the allegation. But that, of course, is impossible, because one cannot determine if content is relevant until it has been accessed and viewed. Second, perhaps recognizing this impossibility, the ULC bill states that employers and school officials “shall use the content [they view] only for the specified purpose” of the search. While that may sound good, in practice it is entirely inadequate.

It is true that the ULC bill would prohibit an employer who is looking for evidence of data theft from going to the police after finding a picture of the user smoking marijuana, but that is hardly the full extent of the risk the ULC bill creates. For example, what if a non-LGBT-friendly employer or school learns an account user is gay? Or if a conservative business learns a user posted “#ImWithHer”? Or what if a staunchly progressive school teacher sees a student’s “Make America Great Again” post? Such revelations could adversely affect an employee’s chance at a job promotion or a student’s grades, but it would be extremely difficult to prove causation. The only way to truly protect against such risks is to prohibit employers and school officials from viewing the content in the first place.

That is what the ACLU bill does. Under our bill, when misconduct is alleged, an employer/school official is only permitted to view the specifically identified content that has been reported. This narrow right to view content is designed to enable employers/school officials to verify the validity of allegations and to confirm the related content has not been manipulated or faked. This approach is workable because social media and other online communications accounts only function if their communications are received by others. The ACLU bill recognizes that anyone with solid grounds for reporting misconduct will already have access to the offending content and can freely share it with an employer or school official. As such, there is no need to require the user to open up his or her entire account for inspection.

Both the ACLU and ULC bills, to varying degrees, limit the circumstances in which an employer or school official can gain access to a personal online account, but when those circumstances are met, the ACLU bill allows employers or school officials to view an account’s content through a metaphorical keyhole, while the ULC bill allows them to break down the door and search the entire house.

The ULC bill’s proposed protections are already outdated.

In many ways, the ULC is not well-equipped to draft model bills that address developing technologies and technological trends. The ULC drafting and approval process takes many years, and the further along they are in their committee-driven process, the more difficult it becomes to adjust to new developments in law, public policy, or the way technologies are used. That is very evident with the ULC’s Uniform Employee and Student Online Privacy Protection Act, which may have been a decent online privacy bill earlier in the decade when they stated drafting it, but now is outdated and would constitute a retreat from recent privacy gains that are being made in the states.

One such example is the ULC bill’s failure to account for the growing trend of landlords demanding access to tenants’ social media accounts so they can monitor their activities. While the latest version of the ACLU bill applies the same protections to tenants as it does to employees and students, the three-years-in-the-making ULC bill does not – it completely missed this developing opportunity to protect the newest class of persons who are being forced to turn over access to their social media accounts.

A clear choice for state legislators looking to protect their constituents’ social media privacy: Sponsor the ACLU’s Personal Online Account Privacy Act.

Looking at the overall picture, the ACLU’s model bill, the Personal Online Account Privacy Act, covers of 100 percent of employees, students, and tenants. The ULC model bill covers 100 percent of employees, but only 25 percent of students and zero percent of tenants. For those seeking to enact broad, up-to-date protections for social media and other personal online accounts, the ACLU bill is the only real option. The ULC bill simply chooses to leave too many vulnerable people unprotected, and even with respect to those it does cover, it fails to offer protections that are up to current standards.

As we enter an era in which the protection and preservation of our private communications is more important than ever, we hope state legislators, technology companies, and privacy advocates will continue to be strong supporters of the ACLU model bill. ULC model bills are great resources in many contexts, but this is not one of them.