To amend section 4113.99 and to enact sections 4113.35 to 4113.39 of the Revised Code to prohibit employers and educational institutions from requiring an employee, applicant, student, or prospective student to provide access to any personal Internet account of the employee, applicant, student, or prospective student.

Section 1.  That section 4113.99 be amended and sections 4113.35, 4113.36, 4113.37, 4113.38, and 4113.39 of the Revised Code be enacted to read as follows:

Sec. 4113.35.  As used in sections 4113.35 to 4113.39 of the Revised Code:

(A) "Access information" means a user name, password, login information, or other security information that protects access to a personal internet-based account or electronic device.

(B) "Educational institution" means a public or private educational institution and each separate school of a public or private educational institution, and includes all of the following:

(1) A state institution of higher education as defined in section 3345.011 of the Revised Code;

(2) A private, nonprofit institution in this state holding a certificate of authorization pursuant to Chapter 1713. of the Revised Code;

(3) A career college in this state that holds a certificate of registration from the state board of career colleges and schools under Chapter 3332. of the Revised Code;

(4) A private institution exempt from regulation under Chapter 3332. of the Revised Code as prescribed in section 3333.046 of the Revised Code, if the program has a certificate of authorization issued pursuant to Chapter 1713. of the Revised Code;

(5) A school operated by a board of education or an educational service center;

(6) A community school established under Chapter 3314. of the Revised Code;

(7) A STEM school established under Chapter 3326. of the Revised Code;

(8) A college preparatory boarding school established under Chapter 3328. of the Revised Code;

(9) A chartered nonpublic school;

(10) A nonchartered nonpublic school;

(11) A career-technical center, joint vocational school district, comprehensive career-technical center, or compact career-technical center;

(12) An educational testing service.

(C) "Employer" has the same meaning as in section 4113.51 of the Revised Code.

(D) "Internet-based account" means an account created within a bounded, internet-based system that requires an individual to use an electronic device to view, create, utilize, or edit the individual's account information, profile, display, communications, or other stored data.

Sec. 4113.36.  No employer shall do either of the following:

(A) Ask or require an employee or an applicant for employment to grant access to, allow observation of, or provide access information to the employee's or applicant's personal internet-based account;

(B) Discharge, discipline, fail to hire, or otherwise penalize an employee or an applicant for employment for failing or refusing to grant access to, allow observation of, or provide access information to the employee's or applicant's personal internet-based account.

Sec. 4113.37.  No educational institution shall do either of the following:

(A) Ask or require a student or prospective student to grant access to, allow observation of, or provide access information to the employee's or applicant's personal internet-based account;

(B) Expel, discipline, fail or refuse to admit, or otherwise penalize a student or prospective student for failure to grant access to, allow observation of, or provide access information to the student's or prospective student's personal internet-based account.

Sec. 4113.38.  (A) Nothing in section 4113.36 of the Revised Code shall be construed to prohibit an employer from doing any of the following:

(1) Requesting or requiring an employee to disclose access information to allow the employer to gain access to or operate either of the following:

(a) An electronic communication device paid for in whole or in part by the employer;

(b) An internet-based account or other service provided by the employer, obtained by virtue of the employee's employment relationship with the employer or used for the employer's business purposes.

(2) Disciplining or discharging an employee for transferring the employer's proprietary, confidential, or financial information to an employee's personal internet-based account without the employer's authorization;

(3) Conducting an investigation or requiring an employee to cooperate in an investigation in either of the following circumstances:

(a) The employer has specific information about activity on the employee's personal internet-based account and must conduct the investigation to ensure compliance with applicable laws, regulations, or other prohibitions against work-related employee misconduct.

(b) The employer has specific information about an unauthorized transfer of the employer's proprietary, confidential, or financial information to an employee's personal internet-based account.

(4) Restricting or prohibiting an employee's access to certain web sites while using an electronic communication device paid for in whole or in part by the employer or while using the employer's network or resources, in accordance with state or federal law;

(5) Monitoring, reviewing, or accessing electronic data that is stored on an electronic communication device paid for in whole or in part by the employer or that is traveling through or stored on an employer's network, in accordance with state or federal law;

(6) Complying with a duty that is established under state or federal law or by a self-regulatory organization, as that term is defined in section 3 of the "Securities Exchange Act of 1934," 48 Stat. 881, 15 U.S.C. 78c, as amended, to screen an employee or an applicant prior to hiring or to monitor or retain employee communications;

(7) Viewing, accessing, or utilizing information about an employee or applicant for employment that can be obtained without the employee's or applicant's access information or that is available in the public domain.

(B) Nothing in section 4113.37 of the Revised Code shall be construed to prohibit an educational institution from doing either of the following:

(1) Requesting or requiring a student to disclose access information to allow the educational institution to gain access to or operate either of the following:

(a) An electronic communication device paid for in whole or in part by the educational institution;

(b) An account or service provided by the educational institution that is either obtained by virtue of the student's admission to the educational institution or is used by the student for the institution's educational purposes.

(2) Viewing, accessing, or utilizing information about a student or prospective student that can be obtained without the student's or prospective student's access information or that is available in the public domain.

Sec. 4113.39.  (A) Except as provided in division (B) of this section, an individual who is the subject of an alleged violation of section 4113.36 or 4113.37 of the Revised Code may bring an action in the court of common pleas in the county where the alleged violation occurred or where the person alleged to have committed the violation resides to enjoin the violation and to recover up to one thousand dollars in damages, plus reasonable attorney's fees and court costs.

(B) No individual may bring an action pursuant to division (A) of this section until the individual has made a written demand of the alleged violator in accordance with this division. An individual shall make a written demand at least sixty days before filing an action under division (A) of this section. The individual shall make the written demand for not more than one thousand dollars and shall include reasonable documentation of the alleged violation in the written demand. The individual shall serve the written demand by certified mail to the address of the alleged violator at the alleged violator's residence, principal office, or place of business or by any other means permitted by the Rules of Civil Procedure for service of process.

(C) It is an affirmative defense to an action under this section that an employer or educational institution that allegedly committed a violation of section 4113.36 or 4113.37 of the Revised Code acted to comply with requirements of a federal or state law.

Sec. 4113.99.  (A) Whoever violates section 4113.15 of the Revised Code is guilty of a misdemeanor of the first degree.

(B) Whoever violates section 4113.16, 4113.18, or 4113.19 of the Revised Code is guilty of a minor misdemeanor.

(C) Whoever violates section 4113.17 of the Revised Code is guilty of a minor misdemeanor for a first offense; for each subsequent offense such person is guilty of a misdemeanor in the fourth degree.

(D) Whoever violates section 4113.36 or 4113.37 of the Revised Code is guilty of a misdemeanor in the first degree and shall be fined not more than one thousand dollars.

Section 2.  That existing section 4113.99 of the Revised Code is hereby repealed.