In the flurry of bills passed in the lame duck session, HB 5523 was among those that have been signed into law.
HB 5523, styled as the Internet Privacy Protection Act, prohibits employers and educational institutions from demanding access to, or firing / disciplining employees and students for refusing to provide access to their personal email accounts, social media accounts, and other personal internet accounts except for some very limited circumstances.
The bills properly exempts accounts owned by an employer or educational institution from such a ban and permits investigations when there is specific information concerning work-related employee misconduct, unauthorized transfer of the employer's information, or criminal activity.
The bill also protects employers and educational institutions by affirmatively setting out that they do not have a duty to search or monitor such personal accounts. it also states that they are not liable for failing to request or require the student or employee to allow such access to their personal accounts.
Of course, the ban doesn't prevent a school or employer from using information that is publicly available or made public by the employee or student. So don't expect to get off under this bill if you call in a sick day and then post on Facebook about your attending some event on the same day.
Overall, its a good law and one that helps to separate the work/educational institutional sphere from people's private lives (to the extent that there's much in the way of a private life left).