2017 Colorado Revised Statutes
Title 8 - Labor and Industry
Labor I - Department of Labor and Employment
Article 2 - Labor Relations, Generally
Part 1 - General Provisions
§ 8-2-127. Prohibitions of employer - requiring access to personal electronic communication devices - definitions - rules
(1) As used in this section:
(a) "Applicant" means an applicant for employment.
(b) "Electronic communications device" means a device that uses electronic signals to create, transmit, and receive information, including computers, telephones, personal digital assistants, and other similar devices.
(c) "Employer" means a person engaged in a business, industry, profession, trade, or other enterprise in the state or a unit of state or local government. "Employer" includes an agent, a representative, or a designee of the employer. "Employer" does not include the department of corrections, county corrections departments, or any state or local law enforcement agency.
(2) (a) An employer may not suggest, request, or require that an employee or applicant disclose, or cause an employee or applicant to disclose, any user name, password, or other means for accessing the employee's or applicant's personal account or service through the employee's or applicant's personal electronic communications device. An employer shall not compel an employee or applicant to add anyone, including the employer or his or her agent, to the employee's or applicant's list of contacts associated with a social media account or require, request, suggest, or cause an employee or applicant to change privacy settings associated with a social networking account.
(b) Paragraph (a) of this subsection (2) does not prohibit an employer from requiring an employee to disclose any user name, password, or other means for accessing nonpersonal accounts or services that provide access to the employer's internal computer or information systems.
(3) An employer shall not:
(a) Discharge, discipline, or otherwise penalize or threaten to discharge, discipline, or otherwise penalize an employee for an employee's refusal to disclose any information specified in paragraph (a) of subsection (2) of this section or refusal to add the employer to the list of the employee's contacts or to change the privacy settings associated with a social media account; or
(b) Fail or refuse to hire an applicant because the applicant refuses to disclose any information specified in paragraph (a) of subsection (2) of this section or refuses to add the employer to the applicant's list of contacts or to change the privacy settings associated with a social media account.
(4) This section does not prevent an employer from:
(a) Conducting an investigation to ensure compliance with applicable securities or financial law or regulatory requirements based on the receipt of information about the use of a personal website, internet website, web-based account, or similar account by an employee for business purposes; or
(b) Investigating an employee's electronic communications based on the receipt of information about the unauthorized downloading of an employer's proprietary information or financial data to a personal website, internet website, web-based account, or similar account by an employee.
(5) A person who is injured by a violation of this section may file a complaint with the department of labor and employment. The department shall investigate the complaint and issue findings thirty days after a hearing. The department may promulgate rules regarding penalties that include a fine of up to one thousand dollars for the first offense and a fine not to exceed five thousand dollars for each subsequent offense.
(6) Nothing in this section prohibits an employer from enforcing existing personnel policies that do not conflict with this section.
(7) Nothing in this section permits an employee to disclose information that is confidential under federal or state law or pursuant to a contract agreement between the employer and the employee.
