SB 164 Summary: The Password Privacy Protection Act

• Employers cannot request or require employees or job applicants to disclose usernames, passwords, or authentication credentials for personal online accounts or services unrelated to business purposes.

• Employers may request credentials only for employer-supplied devices, employer-provided accounts, accounts used for business purposes, or accounts created as a result of employment.

• Employers cannot discharge, discipline, penalize, or refuse to hire applicants based solely on their refusal to disclose personal account credentials.

• Employees are prohibited from transferring employer proprietary information, confidential information, or financial data to personal accounts without authorization, and employers may investigate and discipline unauthorized transfers.

• Employers retain the right to monitor, restrict, or block data on employer-paid devices and networks, investigate work-related misconduct, and access publicly available information about employees and applicants.