Michigan’s New “Internet Privacy Protection Act” Sets Limitations for Employers and Employees

On December 28, 2012, Michigan joined California,1 Illinois,2 and Maryland3 in enacting a social media password protection law when Governor Rick Snyder signed the “Internet Privacy Protection Act” (IPPA or the “Act”). In an accompanying statement, the governor declared that “cyber security is important to the reinvention of Michigan, and protecting the private internet accounts of residents is a part of that,” and that “potential employees and students should be judged on their skills and abilities, not private online activity.” To accomplish these objectives, the IPPA, like the other states’ social media legislation, generally prohibits employers from gaining access to applicants’ or employees’ personal social media accounts. The Act, however, also permits employers to access employees’ use of employer equipment and systems and allows for investigations, under certain circumstances, of employees’ personal social media accounts. While relatively straightforward, the Act will require businesses operating in Michigan to grapple with a range of interpretive challenges.