DEPARTMENT OF LABOR AND EMPLOYMENT Division of Labor SOCIAL MEDIA AND THE WORKPLACE LAW RULES 7 CCR 1103-5 [Editor's Notes follow the text of the rules at the end of this CCR Document.] _________________________________________________________________________ Rule 1. General Statement of Purpose The general purpose of these Social Media and the Workplace Law rules, effective January 1, 2014, is to implement the provisions of § 8-2-127, C.R.S. These rules are adopted pursuant to the Division of Labor's authority in § 8-1-107(2)(p), C.R.S., § 8-1-103(3), C.R.S., § 8-1-111, C.R.S., and § 8-2-127, C.R.S.

Rule 2. Definitions

2.1 "Applicant" means an applicant for employment.

2.2 "Electronic communications device" means a device that uses electronic signals to create, transmit, and receive information, including computers, telephones, personal digital assistants, and other similar devices.

2.3 "Employer" means a person engaged in a business, industry, profession, trade, or other enterprise in the state or a unit of state or local government. "Employer" includes an agent, a representative, or a designee of the employer. "Employer" does not include:

1. 1. the department of corrections, 2. county corrections departments, or 3. any state or local law enforcement agency.

2.4 "Division" means the division of labor within the department of labor and employment. Rule 3. Prohibited Access to Social Media Information 3.1 An employer may not suggest, request, or require that an employee or applicant disclose, or cause an employee or applicant to disclose, any user name, password, or other means for accessing the employee's or applicant's personal account or service through the employee's or applicant's personal electronic communications device.

3.2 An employer shall not compel an employee or applicant to add anyone, including the employer or his or her agent, to the employee's or applicant's list of contacts associated with a social media account.

3.3 An employer shall not require, request, suggest, or cause an employee or applicant to change privacy settings associated with a social networking account. Rule 4. Adverse Actions by Employers Code of Colorado Regulations 1 4.1 An employer shall not discharge, discipline, or otherwise penalize or threaten to discharge, discipline, or otherwise penalize an employee for an employee's:

1. 1. refusal to disclose any information specified in Rule 3; or 2. refusal to add the employer to the list of the employee's contacts; or 3. refusal to change the privacy settings associated with a social media account.

4.2 An employer shall not fail or refuse to hire an applicant because:

1. 1. the applicant refuses to disclose any information specified in Rule 3; or 2. the applicant refuses to add the employer to the applicant's list of contacts; or 3. the applicant refuses to change the privacy settings associated with a social media account. Rule 5. Exceptions to Employer Prohibitions

5.1 An employer may access information about employees and applicants that is publicly available online.

5.2 The social media and the workplace law and these rules do not prohibit an employer from requiring an employee to disclose any user name, password, or other means for accessing nonpersonal accounts or services that provide access to the employer's internal computer or information systems.

5.3 The social media and the workplace law and these rules do not prevent an employer from:

1. a) Conducting an investigation to ensure compliance with applicable securities or financial law or regulatory requirements based on the receipt of information about the use of a personal web site, internet web site, web-based account, or similar account by an employee for business purposes; or b) Investigating an employee's electronic communications based on the receipt of information about the unauthorized downloading of an employer's proprietary information or financial data to a personal web site, internet web site, web-based account, or similar account by an employee.

5.4 The social media and the workplace law and these rules do not prohibit an employer from enforcing existing personnel policies that do not conflict with these rules. Rule 6. Employee Disclosure of Confidential Information 6.1 The social media and the workplace law and these rules do not permit an employee to disclose information that is confidential under federal or state law or pursuant to a contract agreement between the employer and the employee.

Rule 7. Complaints 7.1 A person who is injured by a violation of this law may file a complaint with the division.

1. 7.1.1 Anonymous complaints are not accepted by the division.
2. 7.1.2 Complaints shall be filed using the division-approved form.

Code of Colorado Regulations 2

1. 7.1.3 The complaint may only be filed by the individual (or the individual's representative) who has been directly affected by the employer's prohibited social media practices; the complainant must be the specific employee or applicant whose social media information was involved.
2. 7.1.4 The complaint shall include the complainant's signature, contact information, and basis for the complaint. Failure to include this information on the complaint form may result in administrative dismissal of the complaint.
3. 7.1.5 An employer who is subject to a complaint shall be notified in writing of the complaint by the division via U.S. postal mail. In the event that the employer cannot be contacted via U.S. postal mail, or other circumstances exist which warrant the use of other contact methods, the division shall utilize other methods to contact the employer. Rule 8. Investigations

8.1 Complaints shall be assigned to division investigators. Investigatory methods utilized by the division may include, but are not limited to:

1. 8.1.1 Interviews of the employer, applicant, employee, and other parties;
2. 8.1.2 Information gathering, fact-finding, and reviews of written submissions;
3. 8.1.3 Any other techniques which enable the division to assess the employer's compliance with the law.

Rule 9. Initial Decisions and Fines 9.1 After investigating the complaint and assessing the employer's compliance, the division investigator will issue an initial decision in writing.

1. 9.1.1 The initial decision will be provided to the employer and complainant in writing.
2. 9.1.2 The initial decision will contain information on the extent of the employer's compliance with the law, and will describe what provisions of the law were adhered to and/or violated.
3. 9.1.3 The initial decision issued by the division investigator may levy a fine not to exceed one thousand dollars for the first offense and a fine not to exceed five thousand dollars for each subsequent offense.
4. 9.1.4 The initial decision will contain information on appeal rights and procedures. Rule 10. Appeals and Hearings

10.1 The initial decision issued by the investigator may be appealed to the division.

10.2 Parties who appeal the initial decision are entitled to an appeals hearing and final agency decision in conformity with the Colorado Administrative Procedure Act, § 24-4-105, C.R.S.

10.3 A division hearing officer will preside over the hearing.

10.4 The decision by the hearing officer is considered the final agency decision. This decision may be appealed to district court.

Rule 11. Deposit of Fines Code of Colorado Regulations 3 Fines shall be transmitted and credited to the general fund of the state. Rule 12. Severability If any provision of these rules or their application to any person or circumstance is held illegal, invalid, or unenforceable, no other provisions or applications of the rules shall be affected that can be given effect without the illegal, invalid, or unenforceable provision or application, and to this end the provisions of these rules are severable.

_________________________________________________________________________ Editor's Notes History Entire rule eff. 01/01/2014.

Code of Colorado Regulations 4