Employers are increasingly using social media to evaluate job candidates during the hiring process. Responses to this growing practice have varied widely and include applicants deleting their accounts while interviewing (or permanently), scrubbing their profiles of all unprofessional information and images, and/or restricting access to or limiting the visibility of their accounts to a select group of "friends."

The last of these three proactive measures is, however, no guarantee that a potential employer will never view a job applicant's password-protected social media profile. In fact, over the past several months, it was widely reported that human resources professionals and other hiring officials have been asking to do just that.

Lawmakers reacted to this practice with no shortage of outrage. In May of this year, Maryland passed a law expressly outlawing employer requests for social media login information, and since then, similar legislation has been introduced in about a dozen other states as well as at the federal level.

Despite this recent flurry of legislative activity, in most states, it is not per se illegal for employers to ask job applicants for their social media login information. This article provides an overview of the legal risks and potential benefits of doing so with a cautionary tale based on the 1999 movie "Office Space."

Let's say you're the director of human resources at a software company called Intertrode. Your company's top competitor, Initech, was recently put out of business by a fire that destroyed its entire operation. As a result, you find yourself sifting through dozens of resumes from former Initech software engineers. You decide to schedule interviews with two seemingly qualified candidates: Michael Bolton and Samir Nagheenanajar. They have all the right training and experience.

After interviewing Michael and Samir, you're almost certain that they would both be very successful at Intertrode, but you've been a human resources professional long enough to know that resumes and interviews often don’t provide the "full picture" on job applicants. You don’t want to make the mistake of hiring terrible employees just because they "look good on paper" and "say all the right things" when interviewing.

You want to dig a little deeper before you commit to either Michael or Samir. So, you ask them if you can log onto their Facebook accounts to review messages, pictures and posts. Michael and Samir reluctantly agree to let you do so. The reality is they don't have much of a choice as their job prospects are bleak considering their former employer's recent demise.

You start by flipping through Michael's photographs, and you're quite disturbed when you see several photographs of him and Samir in a field smashing a printer with a baseball bat. You can only assume that it belonged to their former employer. Obviously, Intertrode has policies prohibiting workplace violence and the destruction of company-owned property.

Next, you review Michael's status updates and wall posts from friends. You are quite surprised to learn that he was such a disgruntled employee who often complained with his co-workers about various aspects of his job at Initech. He certainly did not express these sentiments during his interview. You are particularly troubled by a post from Michael's former co-worker Peter Gibbons, which says: "We're not wrong! Initech is wrong! Initech is an evil corporation." Michael "liked" it.

There's another post from Peter, which says: "Once again today is the worst day of my life. I have no motivation to do this job. What do we care if Initech ships a couple extra units? We won’t see a dime of it." You notice that Michael "liked" this one too and posted a comment, which said: "They don't understand. I could come up with a program that could rip that place off big time … big time."

At this point, you are questioning whether Michael is such a great fit after all. You certainly don't want to hire someone who perpetually complains about his employer and threatens to steal from it.

Finally, you check out Michael’s "Interests" page, and you learn that he really likes rap music. You're concerned that someone who listens to rap music may not "fit in" with Intertrode's culture. Ultimately, you decide not to hire Michael. Samir's Facebook page also raises some eyebrows. For example, you wonder why a few months ago Peter Gibbons posted a link to the definition of "money laundering" on Samir's wall with a comment that says "I can’t believe what a bunch of nerds we are!" Samir "liked" it.

A few days ago, someone named Lawrence tagged Samir in a photo of a scantily clad young woman with a caption that said: "Hey, man, check out this chick!" You are concerned that the young woman pictured in the photograph is under 18 years of age.

You also notice that Samir complains a lot about his colleagues not being able to pronounce his last name. One post reads: "No one in this country can ever pronounce my name right. It's not that hard: Na-ghee-na-na-jar. Nagheenanajar." Peter "liked" it, and Michael commented: "Yeah, well, at least your name isn’t Michael Bolton." Ultimately, you decide not to hire Samir either.

Did you do something wrong?

Equal Employment Opportunity Laws

You may have increased the likelihood that Samir will bring a claim of national origin discrimination and/or retaliation against Intertrode based on your failure to hire him. Under Title VII of the Civil Rights Act of 1964 and state EEO laws, it is illegal for you to refuse to hire Samir either because of his national origin or because he complained to his past employer about workplace discrimination or harassment.

Samir may argue that you refused to hire him because after viewing his Facebook posts, you determined that certain Intertrode employees would also struggle to pronounce his last name, and you did not want to subject them to Samir's ire because of this. Samir may also argue that his post about his former co-workers not being able to pronounce his last name was a complaint about workplace harassment related to his national origin and that you retaliated against him by refusing to hire him because he engaged in this protected activity.

National Labor Relations Act

Your review of Michael and Samir's Facebook pages also may have created some risk for Intertrode under the NLRA. Under Section 7 of the NLRA, employees have a right to engage in protected, concerted activity, which in certain circumstances includes discussing, among other things, issues relating to compensation or work conditions. The NLRB has ruled that certain social media activity by current employees constitutes protected, concerted activity under the NLRA and, as a result, policies and practices relating to employees' social media usage have been held to have a chilling (and unlawful) effect on employees' Section 7 rights.

Michael and Samir are prospective, not current, employees. Nonetheless, given the direction of the current NLRB's growing interest in and activity relating to employees' social media rights, it is certainly conceivable that the NLRB may conclude that refusing to hire Michael or Samir because of their gripes about compensation and work conditions with a former employer has a similarly chilling effect on their Section 7 rights as it would if they were current employees.

Off-Duty Employee Conduct Laws

Michael may argue that you decided not to hire him because he listens to rap music. Depending on the state in which you operate, he may have a viable claim under your state's off-duty employee conduct law. In New York, for example, state law makes it unlawful for an employer to refuse to hire an individual because of that person's legal recreational activities outside of work hours, off the employer's premises and without use of the employer's equipment or other property. Listening to rap music is certainly a legal recreational activity and, therefore, an illegal basis upon which to make hiring decisions in New York and some other states.

Stored Communications and Computer Fraud and Abuse Acts

Some may argue that you violated the Stored Communications Act or the Computer Fraud and Abuse Act. The SCA makes it unlawful to access a person's electronic communications without that person's authorization, and the CFAA prohibits intentional access without authorization to data stored on a computer.

Federal courts have already applied the SCA in cases where employers accessed current employees' social media accounts. For example, in 2009, the U.S. District Court for the District of New Jersey held that the jury could have reasonably inferred that an employer had violated the SCA when managers accessed employees' MySpace chat group postings by obtaining login information from a co-worker who was also part of the group.

Essentially, the co-worker testified at trial that she felt she had to give the managers her user name and password because she "probably would have gotten in trouble" otherwise. For that reason, the court held that the jury had a reasonable basis to conclude that the managers' accessing of the chat group postings was not "authorized" and, therefore, in violation of the SCA.

Although the Pietrylo case involved a current employee, the U.S. Department of Justice and the Equal Employment Opportunity Commission have been asked by congressional Democrats to investigate whether employer requests for access to job applicants' social media login information violates current federal law.

It is certainly conceivable that a court may find that the pressure Michael and Samir felt because of their bleak job prospects after Initech's demise is comparable to that felt by the co-worker in the Pietrylo case who gave her MySpace login information to her manager because she thought she would get in trouble if she refused to do so.

Mandatory Reporting Laws

Your review of Samir's Facebook profile may have triggered your obligation to report your concern about the photograph that Samir's Facebook friend Lawrence posted of a scantily clad young woman who you believed may have been under the age of 18. Most, if not all, states have laws that require certain individuals to report instances of suspected child abuse.

In some states, such as Texas, every individual regardless of profession is a mandatory reporter who is required by law to report suspected child abuse. In Texas, child abuse is defined as an act or omission that endangers or impairs a child's physical, mental or emotional health and development. Taking or posting a sexually exploitative photograph of a child would likely meet this definition. Before reviewing job applicants' password-protected messages and photographs, it is important to be cognizant of your potential obligations under the mandatory reporting laws in your state.

Negligent Hiring

Just as your review of Michael and Samir's Facebook profile pages may increase your legal risk should you decide not to hire them, it may also increase your risk to the extent you decide to hire them despite the information you obtained from accessing their accounts. For example, when reviewing their social media profiles, you viewed images of both Michael and Samir violently destroying a printer.

If you hire Michael or Samir despite having viewed these images, and then either of them lashes out in the workplace and causes injury to another employee, you may be liable to that other employee based on your negligent hiring of Michael and Samir. Essentially, the other Intertrode employee may argue that you knew or should have known about the risk of workplace violence created by Michael and Samir's tendencies as pictured in the photographs you reviewed.

Weighing the Legal Risks and Adopting Best Practices

Despite the legal risks you've taken by reviewing Michael and Samir's Facebook profiles, you undoubtedly realized certain benefits from using social media as a pre-employment screening tactic. At a minimum, in this case, you may have avoided hiring two disgruntled software engineers who destroyed the property of and embezzled from their previous employer.

There are instances where, like here, the benefits of using social media in evaluating job candidates may outweigh the legal risks of doing so. In other cases, the legal risks may substantially outweigh the benefits, and striking the right balance may depend on the nature of your business. In some industries, legitimate business justifications may exist for vetting prospective employees' password-protected social media accounts.

Regardless, employers who use or are considering using social media during the hiring process either by requesting applicants' login information or simply viewing their public social media profiles should develop policies and practices that maximize the benefits, but minimize the legal risks of doing so. After all, the cost of a lawsuit or NLRB action pertaining to your review of prospective employees' social media activity is likely to exceed the fractions of cents that Michael and Samir conspired to take from Initech.

Natalie Hrubos is an associate in Duane Morris' employment, labor, benefits and immigration practice group in the firm's Philadelphia office.

The opinions expressed are those of the authors and do not necessarily reflect the views of the firm, its clients, or Portfolio Media, publisher of Law360. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

Reprinted with permission of Law360.