IN HB1420

Employers cannot request employees or job applicants to disclose passwords, usernames, or other access information for personal Internet accounts, nor can they penalize individuals for refusing such requests

Educational institutions face the same restrictions regarding students and prospective students, and cannot expel, discipline, or deny admission based on refusal to provide personal account access

Exemptions apply to employer/school-provided devices and accounts, investigations into unauthorized transfers of proprietary or confidential information, and publicly available information

Violations constitute a Class B misdemeanor, and individuals may bring civil actions seeking actual damages or up to $1,000 in liquidated damages, plus attorney's fees and injunctive relief

A written demand for damages (capped at $1,000) must be submitted at least 60 days before filing a civil lawsuit; compliance with federal or state law serves as an affirmative defense