An employer or college who obtains an applicant's Facebook password and uses that password to access the applicant's Facebook account may be committing a federal crime under 18 U.S.C. 1030 (Computer Fraud and Abuse Act, prohibiting access of protected computer systems without authorization or in excess of authorization). (Note that the Facebook Terms of Service prohibit sharing one's password or logging in under another's account.) See http://volokh.com/2011/12/01/judge-orders-plaintiff-to-give-... (noting that such access may be a federal crime even if authorized by a state court order).

The statute (18 U.S.C. 1030) also creates a civil remedy; Facebook may be able to sue employers who access an applicant's account. Even if the statute is held to not apply in such situations (or held to be unconstitutional as applied in such situations [1]), Facebook may still be able to sue under state law for inducing said applicants to breach their contract with Facebook (tortious inteference) by sharing their password.

[1] E.g., see U.S. v. Lori Drew, 259 F.R.D. 449 (C.D. Cal. 2009), where a district court held that 18 U.S.C. 1030 criminalized TOS violations (including falsifying one's date of birth) but was unconstitutional in that regard.