Social media has changed the way people and businesses interact with each other. Whether it’s Facebook, Twitter, YouTube or blogs, organizations need to know the benefits as well as the risks associated with social media. Not only must an organization be concerned with what the public and its competitors are saying via social media, but it must also be concerned with what its own employees are saying. Whether an employee is officially blogging or tweeting on behalf of the organization, or airing grievances with the organization on their personal Facebook page, the organization may end up suffering as a result of inappropriate postings by employees.
This article will review the legal and business risks associated with the use of social media by an organization’s employees, and conclude with suggestions for a social media policy to address these risks. Though not itself a complete solution, having a policy that governs email and Internet use, and particularly social media use, will help to mitigate some of the risks and clarify some of the uncertainty around the dos and don’ts of social media use by employees and the consequences for failing to adhere to the organization’s requirements. Even in the case of intentional misconduct, a social media policy and associated training may cause an employee to think twice before posting and will help to provide a clearer path to permissible action by the employer in response.
Legal Risks
Generally speaking, an employer may be responsible and held liable for an employee’s social media activities if they are found to be:
- in breach of privacy laws (e.g. for the improper collection, use or disclosure of an individual’s personal information in violation of the Personal Information Protection and Electronic Documents Act, where applicable);
- infringing copyright (e.g. for non-original content posted on social media sites without permission) or other third party intellectual property rights; defamatory (which the courts have recognized as being particularly harmful when occurring online);
- harassment or discriminatory in nature, contrary to the Human Rights Code (e.g. the dissemination of racist or sexist jokes) – employers may be found liable under this Code for failure to prevent and/or stop online harassment in the workplace;
- spam (sending of commercial electronic messages without the prior consent of the recipient or without the prescribed contents) contrary to Bill C-28 (which received royal assent on December 15, 2010) or other anti-spamming legislation;
- false or misleading advertising under the Competition Act, or a violation of the Canadian Code for Advertising, the U.S. Federal Trade Commission Act or the U.S. Federal Trade Commission Guidelines Concerning the Use of Endorsements and Testimonials in Advertising. For example, the FTC endorsement guidelines require that employee bloggers who provide testimonials or discuss or review products or services of their employer must disclose that they are employees of the organization, since these posts can affect how people evaluate and make consumer choices. Furthermore, these guidelines prohibit employers from condoning or encouraging any false or deceptive advertising or marketing practices concerning their organization’s products, including testimonial blogs and posts by employees; or
- breach of the Terms of Use of third party social media platforms.
Business Risks
Whether done intentionally or inadvertently, social media may be used as a tool to divulge an organization’s confidential and proprietary information. This can result in the loss of valuable trade secrets that forfeit the organization’s competitive advantage, including loss of the ability to obtain patents for certain inventions.
Inappropriate postings by employees can also result in damage to the organization’s brand and general reputation, which can be difficult to reverse. For example, two Domino’s Pizza employees released a video on YouTube that depicted one of the employees tainting the food in disgusting ways (putting cheese up their nose) and violating a number of public health laws (we will spare you the details). The video went viral through YouTube, Twitter, blogs, etc. – millions of people viewed the video, tarnishing the reputation of the company and the brand it had spent years building. In another example, stewards employed by Virgin Atlantic Airlines posted negative comments on Facebook about the condition of the airline’s airplanes (e.g. comments that it was full of cockroaches) and about its passengers, resulting in the airline’s reputation being severely damaged (and 13 stewards being fired).
For public companies, premature or otherwise inappropriate disclosures via social media may result in unintended and undesirable effects on the company’s stock price, which could compromise deal negotiations or result in shareholder law suits.
Dealing with Inappropriate Employee Use of Social Media
Employee Discipline and Termination
As referenced earlier, if an employee makes disparaging marks about his or her employer or work colleagues via social media, this can damage the organization’s reputation and violate privacy, labour/employment, human rights and/or defamation laws. Such remarks may be grounds for an employer taking reasonable and proportionate action against the employee, including, in appropriate circumstances, termination.
Often, such inappropriate employee postings are made on third party sites using the employee’s personal equipment and on the employee’s personal time. This may at first seem to present somewhat of a problem for an employer who wishes to regulate such activity. However, inappropriate work-related postings on social media outlets, even outside of work-hours and without using the employer’s equipment, may give an employer just cause for termination. The case of Lougheed Imports Ltd. operating as West Coast Mazda doing business as West Coast Detail & Accessory Centre and United Food and Commercial Workers International Union, Local 1518 (2010), a British Columbia Labour Relations Board decision, considered postings by two unionized employees to their personal Facebook accounts. The postings contained remarks about the employee’s managers, supervisors and organization, which were found to be offensive, insulting, disrespectful, derogatory and damaging to their employer’s business. The termination of these employees for cause was upheld by the Board.
Many employees nevertheless have the misconception that they cannot be disciplined for conduct committed outside the workplace. As the Lougheed case demonstrates, however, this is not the case, and discipline may be properly administered when the employee’s off-duty behaviour, including conduct online, brings the employer’s reputation into disrepute, constitutes harassment, negatively affects workplace morale, etc.
Employee Privacy and Monitoring
The Lougheed case also addressed another common issue in employer-employee disputes – the employee’s right to a reasonable expectation of privacy. In Lougheed, the employees were not found to have a serious expectation of privacy when posting comments on Facebook even though the comments were made outside of the workplace (although query whether the conclusion would be the same if the employees had fewer Facebook friends, if their friends did not include as many of their co-workers or if their postings were subject to higher “privacy” settings, limiting their audience). Organizations should consider the extent to which they can and should lawfully monitor employee social media use that occurs outside of work.
Organizations should also reserve the right to monitor employee social media use which occurs on the time and equipment of the organization, including desktop and laptop computers, cell phones, handheld devices, etc. In addition to concerns around inappropriate postings, an employer will also be concerned about the amount of time being spent by employees on social media sites and the impact on productivity. Where social media is part of an organization’s advertising and marketing strategy, postings by employees should be regularly monitored for compliance with the organization’s guidelines.
The Social Media Policy
Many of the risks discussed in this article can be mitigated by implementing an organization-wide policy governing the use of social media by employees, contractors, consultants and agents (including marketing and advertising agents engaged by the organization). The policy should cover the use of social media at the workplace and outside of work, for both business use and personal use that could impact on the organization.
At a minimum, the policy should:
- provide a broad definition of “social media” that encompasses several activities, uses and platforms to reflect the ever-changing nature of social media;
- highlight the nature of social media (including its ability to reach a broad audience quickly and the permanent nature of postings) and its potential impact on the organization;
- describe the liability and risks associated with posting content on social media sites and inform employees that they can be personally accountable and liable for their actions;
- prohibit the disclosure of confidential or proprietary information of the organization;
- identify which social media sites and platforms may be accessed and used and for what purposes;
- set out appropriate restrictions on use, including time, place and people – i.e. confirm that social media sites are not to be accessed during company time, or if such access is required or desired by the employer, identify those sites that can be accessed, for what purposes, during which times and for how long;
- prohibit the posting or viewing of pornographic, obscene or other objectionable material;
- restrict usage on behalf of the organization to certain employees who have been properly trained, including a requirement that those individuals properly identify themselves as employees when discussing matters relating to the organization’s products and services. When an employee is not specifically authorized to speak on behalf of the organization, reference to the organization and its brand, products and services should be prohibited, and the employee must not represent or imply that he or she is expressing the opinion of the organization;
- provide a strategy and process for responding to third party postings about the organization that might impact on the organization’s brand or reputation (again, who should respond and what should they be saying and/or not saying);
- provide that employees do not have an expectation of privacy with respect to use of the Internet or online communications in the workplace;
- clearly state the employer’s right to monitor activity and access information stored on the organization’s systems and caution employees that the employer may monitor and take action based on information posted by employees on “private” sites;
- prohibit downloading, transferring or publishing material from or to social media sites which may result in copyright, patent or trade-mark infringement claims without third party or company permission;
- require employees to comply with relevant laws and industry regulations and to abide by the Terms of Use of social media sites;
- remind employees that they owe a duty of loyalty to their employer, which includes not making any derogatory or defamatory posts about the employer, whether at work or otherwise;
- outline restrictions on communications regarding co-workers and comments about the organization and management; and
- provide a warning that a violation or failure to comply with the policy may result in discipline, up to and including termination of employment, as well as the types of breaches, if any, that may result in automatic termination of employment.
The Social Media Policy should form part of each employee’s terms of employment that employees should receive at the time of their hire. The policy should not operate in isolation, rather, it should supplement the organization’s Internet/email policy and other policies and codes of conduct, including those relating to unlawful discrimination and harassment. The employer should also ensure that employees receive workplace training and education regarding the policy. Finally, the policy should be revisited and updated periodically, as appropriate.
Having a social media policy, together with proper employee training, will help to address the risks associated with social media use by employees. Each organization will have to determine which policies make the most sense for them from a business perspective while also addressing the risks.
Andrew Nunes is a partner in the Business Law Department and Technology & Intellectual Property Practice Group at Fasken Martineau DuMoulin LLP, and chair of the OBA IT & E-Commerce Section Executive Committee. He can be reached at anunes@fasken.com or 416 865 4510. Patrick Gannon is a partner in the Business Law Department and Labour, Employment and Human Rights Practice Group at Fasken Martineau DuMoulin LLP. He can be reached at pgannon@fasken.com or 416 865 5139.