STAND. COM. REP. NO. 824

Honolulu, Hawaii

RE:    S.B. No. 429

       S.D. 2

Honorable Ronald D. Kouchi

President of the Senate

Twenty-Ninth State Legislature

Regular Session of 2017

State of Hawaii

Sir:

     Your Committees on Commerce, Consumer Protection, and Health and Ways and Means, to which was referred S.B. No. 429, S.D. 1, entitled:

"A BILL FOR AN ACT RELATING TO THE UNIFORM EMPLOYEE AND STUDENT ONLINE PRIVACY PROTECTION ACT,"

beg leave to report as follows:

     The purpose and intent of this measure is to adopt uniform laws to protect the online accounts of employees and students from employers and educational institutions, respectively.

     Your Committees received testimony in support of this measure from the University of Hawai‘i System, Hawai‘i Commission to Promote Uniform Legislation, and Hawai‘i Civil Rights Commission.  Your Committees received comments on this measure from the American Civil Liberties Union of Hawaii and Internet Coalition.

Your Committees find that privacy is a growing concern as social media use rises and employers increasingly ask current and prospective employees to grant the employer access to social media accounts.  Likewise, many educational institutions seek to examine the social media presence of current and prospective students.  Your Committees further find that in recent years there have been a number of reported incidents in which employers and schools have demanded, and received, such access.

Your Committees find that the Uniform Employee and Student Online Privacy Protection Act, completed by the Uniform Law Commission in 2016, addresses employers' access to employees' or prospective employees' social media and other online accounts accessed via username and password or other credentials of authentication as well as post-secondary educational institutions' access to students' or prospective students' similar online accounts.  Your Committees received testimony expressing concern that the Uniform Employee and Student Online Privacy Protection Act only covers students at the postsecondary level and allows employers or educational institutions to view the entire content of an employee's or student's personal online account based solely on a general allegation of misconduct.

     Your Committees have amended this measure by:

     (1)  Inserting language from the Personal Online Account Privacy Act to make this measure more comprehensive by covering more Hawaii students and creating stronger safeguards against abuse.  More specifically, this measure has been amended by:

          (A)  Adding a definition of the term "applicant";

          (B)  Amending the definition of "educational institution" to include a private or public school, institution, or school district, or any subdivision thereof, that offers participants, students, or trainees an organized course of study or training, as well as school employees and agents acting under the authority of an educational institution or a state or local educational agency authorized to direct or control an educational institution;

          (C)  Amending the definitions of "employee" and "employer" to no longer include prospective employees or unpaid interns working in exchange for academic credit or occupational experience;

          (D)  Amending the definition of "student" to no longer include a parent or legal guardian of a student under the age of majority and inserting a definition for the term "prospective student";

          (E)  Replacing the defined term "content" with the term "specifically identified content" and amending the definition;

          (F)  Replacing the defined term "protected personal online account" with the term "personal online account" and amending the definition to mean any online account maintained by an employee or student, including social media or electronic mail accounts, that is protected by a login requirement, but not including an account opened at an employer's or educational institution's behest or provided by an employer or educational institution and intended to be used solely or primarily on behalf of the employer or educational institution;

          (G)  Deleting definitions and references to the terms "login requirement", "online", "person", and "login information" and replacing references to the term "login information" with references to the user name and password, password, or other means of authentication that provide access to a personal online account;

          (H)  Deleting the provisions that explicitly allow employers and educational institutions to request an employee or student to add the employer or educational institution to, or not remove the employer or educational institution from, the set of persons to which the employee or student grants access to the content of the personal online account and inserting language that prohibits employers and educational institutions from requiring or coercing an applicant, employee, student, or prospective student to add anyone to the list of contacts associated with a personal online account;

          (I)  Inserting provisions that prohibit employers and educational institutions from requiring, requesting, or coercing an employee, applicant, student, or prospective student to provide password or authentication information to a personal technological device or to turn over an unlocked personal technological device for the purpose of gaining access to a personal online account;

          (J)  Inserting provisions that prohibit employers from refusing to hire applicants, and educational institutions from refusing to admit prospective students, as a result of the applicants' or prospective students' refusal to disclose specified information or take specific action related to their personal online account;

          (K)  Inserting language that limits an employer's and educational institution's access to an employee's, applicant's, student's, or prospective student's personal online account to specifically identified content when accessing the information to comply with legal and regulatory obligations, investigate allegations of misconduct, or investigate threats to safety or property;

          (L)  Inserting provisions to allow employers to prohibit employees and applicants, and educational institutions to prohibit students and prospective students, from:

              (i)  Using a personal online account for business or educational institution purposes; and

             (ii)  Accessing or operating a personal online account during business or school hours or while on business or school property;

          (M)  Inserting language to establish that an employer is not liable for having an employee's or applicant's, and an educational institution is not liable for having a student's or prospective student's, user name and password, password, or other means of authentication that provides access to a personal online account if acquired inadvertently through the use of an otherwise lawful technology that monitors the employer's network or devices for network security or data confidentiality;

          (N)  Inserting language to clarify that an educational institution shall not require, coerce, or request a student or prospective student to access a personal online account in the presence of an educational institution employee or educational institution volunteer, including a coach, teacher, or school administrator; and

          (O)  Inserting language that makes any employee or agent of an educational institution who violates the provisions of the measure subject to disciplinary proceedings and punishment, and specifies that if conflict with a collective bargaining agreement arises, the collective bargaining agreement and established practices prevail except in certain circumstances;

     (2)  Inserting a provision to clarify that the Uniform Employee and Student Online Privacy Protection Act does not affect employers' obligation to investigate complaints, allegations, or the occurrence of discriminatory practices prohibited under chapter 378, Hawaii Revised Statutes; and

     (3)  Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

     As affirmed by the records of votes of the members of your Committees on Commerce, Consumer Protection, and Health and Ways and Means that are attached to this report, your Committees are in accord with the intent and purpose of S.B. No. 429, S.D. 1, as amended herein, and recommend that it pass Third Reading in the form attached hereto as S.B. No. 429, S.D. 2.

Respectfully submitted on behalf of the members of the Committees on Commerce, Consumer Protection, and Health and Ways and Means,

________________________________ JILL N. TOKUDA, Chair

________________________________ ROSALYN H. BAKER, Chair