I actually think it is a pretty good question for the candidate.
Today, going into an interview, I would assume that HR had done a basic online check - google, facebook, linkedin. All of this is public information and I wouldn't consider checking these as invasive. This question gives the candidate an opportunity to answer "yes, but it is strictly private" (points for a candidate that won't, in the future, embarrass the company), "No, I do not use social media" (except for a few positions, this would be a neutral answer) or "Yes, but under a different name. It seems that someone with my name has a pretty colorful life, though" (aka, the Cancun pictures are not of me, I just have a common name). It also allows candidates to talk about how they use social media to develop a network (if applicable).
However, I would decline to friend them (unless I gave the networking answer, of course!). If asked for my password, I would walk out. Yes, I feel that strongly about it.