NY A01360

Prohibits employers from requiring, coercing, or requesting employees to disclose login information or content of protected personal online accounts, with limited exceptions for law enforcement, regulatory compliance, and investigation of work-related misconduct or safety threats.

Prohibits educational institutions from requiring, coercing, or requesting students to disclose login information or content of protected personal online accounts, with limited exceptions for public information, legal compliance, and investigation of education-related misconduct or safety threats.

Allows employers and educational institutions to request employees and students add them to account access lists, but prohibits adverse employment or educational actions for refusing to disclose login credentials or alter account settings.

Creates civil enforcement mechanisms allowing the Attorney General to seek injunctive relief and up to $1,000 per violation (capped at $100,000 per event), and allows employees and students to sue for injunctive relief, actual damages, and attorney's fees.

Establishes rules for handling login information incidentally acquired through network monitoring: prohibits use to access accounts, requires reasonable security efforts, and mandates prompt disposal except when needed for ongoing security breach investigations.