The news that some employers have asked for direct access to the Facebook accounts — including user names and passwords — of people applying for jobs at their firms has set off a firestorm of controversy. The reports have raised questions about whether the practice is illegal and if such a policy could expose those employers to potential discrimination lawsuits. The dust-up has even triggered calls by some in Congress for a federal investigation into the practice.

But those recent events only highlight a new reality: the identity that individuals create in the world of social media is quickly becoming an important factor in hiring decisions and in people’s broader professional lives. “The questions around employer access to social network logins reflect a broader debate in society about a host of digital privacy issues,” says Andrea Matwyshyn, a Wharton professor of legal studies and business ethics. “This is a new concern — the degree to which employers can gain access to all role identities through one virtual space. There is no parallel to that in the real world.”

While the reaction to the practice has been swift and intense, it’s hard to predict if it will become a lasting trend. But Matwyshyn says she began hearing about employers requesting access to the Facebook accounts of potential hires as far back as 2008. To date, however, she notes that there is no good data on how widespread the practice has become. But the fact that it exists at all is not entirely unexpected: According to Matwyshyn, a number of studies show that most employers look at candidates’ online profiles when making hiring decisions. Case in point: A 2011 survey by social media monitoring service Reppler found that 91% of recruiters reported using social networking sites to evaluate job applicants.

But checking out a publicly available profile on Facebook — or even asking a job candidate to “friend” someone in human resources at a company where they are applying for a position — is worlds apart from gaining unfettered access to someone’s account through a password. “If you can take Facebook passwords, what about Gmail passwords?” asks Stuart Soffer, a non-residential fellow at The Center for Internet and Society at Stanford Law School and managing director of IPriori, an intellectual property consulting firm. If left unchecked, Soffer notes, the practice could expand beyond human resources departments evaluating potential employees. “What about allowing Facebook access to insurers so they can see what you are saying about your health?” he notes. “They could use it as a basis for judging the risk of insuring you.”

The request for access to login information, however, raises serious legal questions. For one thing, Facebook has stated that sharing or soliciting a Facebook password is a violation of the company’s statement of rights and responsibilities. Matwyshyn says that means employers could be essentially asking job candidates to violate their contract with Facebook, creating “an untenable conflict between contract law and employers’ perceptions of their own interest in vetting candidates.”

In addition, if a Facebook account includes information on an applicant’s race or age, for example, that could potentially expose the employer to claims of discriminatory hiring practices. According to Matwyshyn, it is legally hazy whether accessing someone’s Facebook account where that information is available is akin to asking it in the interview. “Arguments can be made that this is a back-door method to gaining information that the prospective employer wouldn’t otherwise have access to,” she says.

Clearly concerned about the legal and business implications of privacy breaches, Facebook has come out against the practice. “We don’t think employers should be asking prospective employees to provide their passwords because we don’t think it’s the right thing to do,” Facebook chief privacy officer Erin Egan said in a statement. “But it also may cause problems for the employers that they are not anticipating.”

Meanwhile, the issue is getting the attention of Congress. Senate Democrats Charles Schumer and Richard Blumenthal, from New York and Connecticut respectively, have asked the Justice Department and the Equal Opportunity Commission to look into the practice. But even if it is eventually prohibited or otherwise curbed through legal or legislative channels, Wharton management professor Nancy Rothbard predicts that the use of social media in hiring decisions will continue to be a flashpoint in the years ahead. “The core of the problem is the blending of personal and professional lives,” Rothbard says. “We are still in the infancy of trying to understand how to deal with all this.”

Opening the Window — and Closing a Door?

Just how far employers can legally go to check out job candidates online may not be clear — but why they are looking for new methods of evaluating applicants is easy to understand, notes Wharton management professor Adam Grant. He says research has shown that the typical job interview is a poor tool for predicting which candidates will succeed. If that does not work, companies need to find something that does. “Applicants are very motivated to put their best foot forward in an interview,” Grant notes. “It is very difficult to spot the people who will represent an organization well. But on Facebook, you can see the applicant making day-to-day decisions — it is a window into how an individual is likely to act.”

In fact, recent research has provided evidence that online profiles can be very revealing about specific personality traits. A paper published recently in the Journal of Applied Social Psychology titled, “Social Networking Websites, Personality Ratings, and the Organizational Context: More Than Meets the Eye,” studied 518 undergraduate students and their Facebook profiles. The researchers found that the Facebook profiles were a good predictor of the so-called “big five personality traits”: conscientiousness, agreeableness, extroversion, emotional stability and openness. And for a subset of the group where the researchers were able to contact supervisors at companies that had hired those students, there was a correlation between scores on two personality traits — emotional stability and agreeableness — and job performance.

“There is strong evidence that social networking is a valid way of assessing someone’s personality,” says Donald Kluemper, a professor of management at the Northern Illinois University College of Business and a co-author of the study. But he says that does not mean there is evidence that an unstructured perusal of a Facebook account will result in better hiring decisions. “Until a method is validated in a number of ways, including a study of adverse impacts and the legal issues, I wouldn’t recommend companies rely on social networking profiles,” Kluemper states.

Right now, the use of social media information is far from fine-tuned, with recruiters typically checking out social media sites to get a general sense of the person applying for a job or to hunt for any red flags. But it is possible the use of that information could become more sophisticated. “People are mining that data right now for other purposes, including targeting ads to the right people,” says Shawndra Hill, a Wharton operations and information management professor. “It is not out of the realm of possibility to focus that on other outcomes, like how good a match someone is for a job or whether there is a high likelihood they might do something illegal.”

While the value of that data may be apparent, it remains to be seen how social media should ultimately fit into some aspects of professional life. Take the less controversial practice of managers’ friending their colleagues through Facebook. Rothbard notes that this practice also creates numerous potential headaches. Two years ago, she and some colleagues did a series of interviews with 20 people at a variety of levels and in a number of different industries, and found that people were often unnerved friending either bosses or subordinates. “People felt very uncomfortable with crossing the private and professional boundary when it came to the hierarchy [within an organization],” Rothbard says. “They talked about friending their bosses with similar discomfort and language as they did when they spoke about friending their moms.”

Interestingly, Rothbard adds that the rules for social networking in the workplace may differ based on gender. She led a study of 400 students in which participants were shown Facebook profiles, told that the person was either a boss, a peer or a subordinate, and then asked to rate the individuals based on how likely they were to accept that person’s friend request. The findings: Female bosses with bare-bones profiles were less likely to be accepted than those who revealed more personal information, while the opposite pattern held for male bosses. “Women who have limited profiles are more likely to be shunned than the women who have a more active presence,” Rothbard notes. “People see them as cold. But male bosses who reveal less information are more likely to be accepted than those who reveal a lot of information.”

The increased scrutiny of people’s virtual lives may change the way individuals operate in the social networking realm. According to Rothbard, there are essentially four ways of dealing with privacy issues. There are those who control their list of friends carefully, rejecting friend requests from people with whom they don’t want to share personal information. Then there are those who accept virtually all requests, but are very careful about what they post, limiting that content to very safe, less revealing information. There is also a hybrid approach in which people use privacy settings to share some information with close friends and less sensitive material with others. And finally there is the “let it all hang out” crowd — those who are comfortable sharing all their information with a large group of close (and not so close) friends.

Grant predicts that more people will opt for the more controlled, filtered approach as they realize their social media profile is being scrutinized by potential employers. “As employers gain this information, so do candidates,” Grant points out. “So candidates may use Facebook more carefully and remove the cues that are so valuable [to employers].” Soffer agrees that people will become much more careful about their social media personas. “There are ways around this,” Soffer says of the unwanted exposure of social media behavior. “One thing that could happen is people will start having two Facebook accounts.” One will be for close friends; the other, a more sanitized version for employers.

But there is always the potential that something posted for viewing by a small group of close friends on Facebook could get out into larger circulation. And for that reason, some argue that the risks of being active in the social media space outweigh the benefits. “If you are a CEO, or aspire to be a CEO or director of a public company, I think it makes sense to refrain from social networking,” notes Dennis Carey, vice chairman at Korn Ferry International. “There are other ways to communicate with employees and the outside world through properly controlled channels. Some of the messages that are conveyed can be misconstrued or taken out of context by a third party. “

The fear of a photo or comment made long ago coming back to haunt you is hardly unfounded. Because sites like Facebook are less than 10 years old, it is not certain how long someone’s social networking history will remain accessible. “It is unclear how long the information persists,” Hill says. “Firms have different privacy policies, and often privacy policies change over time. While there are policies that allow for deleting data you no longer want on the site, it is hard to guarantee that this information won’t live on a database somewhere.”

All the controversy worries some fans of the social media revolution. “I worry that there is already a sense right now that our participation online may come back to haunt us,” notes Chris Ridder, co-founder of the law firm Ridder, Costa & Johnstone LLP and a non-residential fellow at The Center for Internet and Society at Stanford Law School. “It inhibits our ability to express ourselves. If we can only express public relations-like statements, it takes away a good bit of the utility of the Internet. I think it would be a shame if we were to lose the playful aspect of this new technology.”