NY A01320

Prohibits employers and postsecondary educational institutions from requiring, coercing, or requesting employees or students to disclose login information or content from their personal online accounts protected by passwords

Bars employers and schools from demanding that individuals alter privacy settings, access accounts in the employer's/institution's presence, or face adverse action for refusing to comply with such requests

Allows exceptions for accessing publicly available information, complying with court orders or federal/state law, or investigating specific misconduct or security threats based on particular facts about an account

Requires employers and institutions that inadvertently acquire login information through network monitoring to keep it secure, not use it to access accounts, and dispose of it as soon as reasonably practicable

Creates civil enforcement through Attorney General actions (penalties up to $1,000 per violation, capped at $100,000 per event) and private lawsuits by affected employees or students seeking injunctive relief, actual damages, and attorney's fees