An employer may not do any of the following:
(1) request an employee or an applicant for employment to disclose a username and password, or a password that allows access to the employee's or applicant's personal Internet account; or
(2) take adverse action, fail to hire, or otherwise penalize an employee or applicant for employment for failure to disclose information described in Subsection (1).