|
|
| To amend section 4113.99 and to enact sections | 1 |
| 4113.35 to 4113.39 of the Revised Code to prohibit | 2 |
| employers and educational institutions from | 3 |
| requiring an employee, applicant, student, or | 4 |
| prospective student to provide access to any | 5 |
| personal Internet account of the employee, | 6 |
| applicant, student, or prospective student. | 7 |
| Section 1. That section 4113.99 be amended and sections | 8 |
| 4113.35, 4113.36, 4113.37, 4113.38, and 4113.39 of the Revised | 9 |
| Code be enacted to read as follows: | 10 |
| Sec. 4113.35. As used in sections 4113.35 to 4113.39 of the | 11 |
| Revised Code: | 12 |
| (A) "Access information" means a user name, password, login | 13 |
| information, or other security information that protects access to | 14 |
| a personal internet-based account or electronic device. | 15 |
| (B) "Educational institution" means a public or private | 16 |
| educational institution and each separate school of a public or | 17 |
| private educational institution, and includes all of the | 18 |
| following: | 19 |
| (1) A state institution of higher education as defined in | 20 |
| section 3345.011 of the Revised Code; | 21 |
| (2) A private, nonprofit institution in this state holding a | 22 |
| certificate of authorization pursuant to Chapter 1713. of the | 23 |
| Revised Code; | 24 |
| (3) A career college in this state that holds a certificate | 25 |
| of registration from the state board of career colleges and | 26 |
| schools under Chapter 3332. of the Revised Code; | 27 |
| (4) A private institution exempt from regulation under | 28 |
| Chapter 3332. of the Revised Code as prescribed in section | 29 |
| 3333.046 of the Revised Code, if the program has a certificate of | 30 |
| authorization issued pursuant to Chapter 1713. of the Revised | 31 |
| Code; | 32 |
| (5) A school operated by a board of education or an | 33 |
| educational service center; | 34 |
| (6) A community school established under Chapter 3314. of the | 35 |
| Revised Code; | 36 |
| (7) A STEM school established under Chapter 3326. of the | 37 |
| Revised Code; | 38 |
| (8) A college preparatory boarding school established under | 39 |
| Chapter 3328. of the Revised Code; | 40 |
| (9) A chartered nonpublic school; | 41 |
| (10) A nonchartered nonpublic school; | 42 |
| (11) A career-technical center, joint vocational school | 43 |
| district, comprehensive career-technical center, or compact | 44 |
| career-technical center; | 45 |
| (12) An educational testing service. | 46 |
| (C) "Employer" has the same meaning as in section 4113.51 of | 47 |
| the Revised Code. | 48 |
| (D) "Internet-based account" means an account created within | 49 |
| a bounded, internet-based system that requires an individual to | 50 |
| use an electronic device to view, create, utilize, or edit the | 51 |
| individual's account information, profile, display, | 52 |
| communications, or other stored data. | 53 |
| Sec. 4113.36. No employer shall do either of the following: | 54 |
| (A) Ask or require an employee or an applicant for employment | 55 |
| to grant access to, allow observation of, or provide access | 56 |
| information to the employee's or applicant's personal | 57 |
| internet-based account; | 58 |
| (B) Discharge, discipline, fail to hire, or otherwise | 59 |
| penalize an employee or an applicant for employment for failing or | 60 |
| refusing to grant access to, allow observation of, or provide | 61 |
| access information to the employee's or applicant's personal | 62 |
| internet-based account. | 63 |
| Sec. 4113.37. No educational institution shall do either of | 64 |
| the following: | 65 |
| (A) Ask or require a student or prospective student to grant | 66 |
| access to, allow observation of, or provide access information to | 67 |
| the employee's or applicant's personal internet-based account; | 68 |
| (B) Expel, discipline, fail or refuse to admit, or otherwise | 69 |
| penalize a student or prospective student for failure to grant | 70 |
| access to, allow observation of, or provide access information to | 71 |
| the student's or prospective student's personal internet-based | 72 |
| account. | 73 |
| Sec. 4113.38. (A) Nothing in section 4113.36 of the Revised | 74 |
| Code shall be construed to prohibit an employer from doing any of | 75 |
| the following: | 76 |
| (1) Requesting or requiring an employee to disclose access | 77 |
| information to allow the employer to gain access to or operate | 78 |
| either of the following: | 79 |
| (a) An electronic communication device paid for in whole or | 80 |
| in part by the employer; | 81 |
| (b) An internet-based account or other service provided by | 82 |
| the employer, obtained by virtue of the employee's employment | 83 |
| relationship with the employer or used for the employer's business | 84 |
| purposes. | 85 |
| (2) Disciplining or discharging an employee for transferring | 86 |
| the employer's proprietary, confidential, or financial information | 87 |
| to an employee's personal internet-based account without the | 88 |
| employer's authorization; | 89 |
| (3) Conducting an investigation or requiring an employee to | 90 |
| cooperate in an investigation in either of the following | 91 |
| circumstances: | 92 |
| (a) The employer has specific information about activity on | 93 |
| the employee's personal internet-based account and must conduct | 94 |
| the investigation to ensure compliance with applicable laws, | 95 |
| regulations, or other prohibitions against work-related employee | 96 |
| misconduct. | 97 |
| (b) The employer has specific information about an | 98 |
| unauthorized transfer of the employer's proprietary, confidential, | 99 |
| or financial information to an employee's personal internet-based | 100 |
| account. | 101 |
| (4) Restricting or prohibiting an employee's access to | 102 |
| certain web sites while using an electronic communication device | 103 |
| paid for in whole or in part by the employer or while using the | 104 |
| employer's network or resources, in accordance with state or | 105 |
| federal law; | 106 |
| (5) Monitoring, reviewing, or accessing electronic data that | 107 |
| is stored on an electronic communication device paid for in whole | 108 |
| or in part by the employer or that is traveling through or stored | 109 |
| on an employer's network, in accordance with state or federal law; | 110 |
| (6) Complying with a duty that is established under state or | 111 |
| federal law or by a self-regulatory organization, as that term is | 112 |
| defined in section 3 of the "Securities Exchange Act of 1934," 48 | 113 |
| Stat. 881, 15 U.S.C. 78c, as amended, to screen an employee or an | 114 |
| applicant prior to hiring or to monitor or retain employee | 115 |
| communications; | 116 |
| (7) Viewing, accessing, or utilizing information about an | 117 |
| employee or applicant for employment that can be obtained without | 118 |
| the employee's or applicant's access information or that is | 119 |
| available in the public domain. | 120 |
| (B) Nothing in section 4113.37 of the Revised Code shall be | 121 |
| construed to prohibit an educational institution from doing either | 122 |
| of the following: | 123 |
| (1) Requesting or requiring a student to disclose access | 124 |
| information to allow the educational institution to gain access to | 125 |
| or operate either of the following: | 126 |
| (a) An electronic communication device paid for in whole or | 127 |
| in part by the educational institution; | 128 |
| (b) An account or service provided by the educational | 129 |
| institution that is either obtained by virtue of the student's | 130 |
| admission to the educational institution or is used by the student | 131 |
| for the institution's educational purposes. | 132 |
| (2) Viewing, accessing, or utilizing information about a | 133 |
| student or prospective student that can be obtained without the | 134 |
| student's or prospective student's access information or that is | 135 |
| available in the public domain. | 136 |
| Sec. 4113.39. (A) Except as provided in division (B) of this | 137 |
| section, an individual who is the subject of an alleged violation | 138 |
| of section 4113.36 or 4113.37 of the Revised Code may bring an | 139 |
| action in the court of common pleas in the county where the | 140 |
| alleged violation occurred or where the person alleged to have | 141 |
| committed the violation resides to enjoin the violation and to | 142 |
| recover up to one thousand dollars in damages, plus reasonable | 143 |
| attorney's fees and court costs. | 144 |
| (B) No individual may bring an action pursuant to division | 145 |
| (A) of this section until the individual has made a written demand | 146 |
| of the alleged violator in accordance with this division. An | 147 |
| individual shall make a written demand at least sixty days before | 148 |
| filing an action under division (A) of this section. The | 149 |
| individual shall make the written demand for not more than one | 150 |
| thousand dollars and shall include reasonable documentation of the | 151 |
| alleged violation in the written demand. The individual shall | 152 |
| serve the written demand by certified mail to the address of the | 153 |
| alleged violator at the alleged violator's residence, principal | 154 |
| office, or place of business or by any other means permitted by | 155 |
| the Rules of Civil Procedure for service of process. | 156 |
| (C) It is an affirmative defense to an action under this | 157 |
| section that an employer or educational institution that allegedly | 158 |
| committed a violation of section 4113.36 or 4113.37 of the Revised | 159 |
| Code acted to comply with requirements of a federal or state law. | 160 |
| Sec. 4113.99. (A) Whoever violates section 4113.15 of the | 161 |
| Revised Code is guilty of a misdemeanor of the first degree. | 162 |
| (B) Whoever violates section 4113.16, 4113.18, or 4113.19 of | 163 |
| the Revised Code is guilty of a minor misdemeanor. | 164 |
| (C) Whoever violates section 4113.17 of the Revised Code is | 165 |
| guilty of a minor misdemeanor for a first offense; for each | 166 |
| subsequent offense such person is guilty of a misdemeanor in the | 167 |
| fourth degree. | 168 |
| (D) Whoever violates section 4113.36 or 4113.37 of the | 169 |
| Revised Code is guilty of a misdemeanor in the first degree and | 170 |
| shall be fined not more than one thousand dollars. | 171 |
| Section 2. That existing section 4113.99 of the Revised Code | 172 |
| is hereby repealed. | 173 |