Overview
Use of social media and online marketing is becoming a mainstay in corporate communications. You can use this to your advantage by acknowledging and leveraging use of social media by your company's employees and customers, and manage the risks by making it clear to employees where the lines are drawn between their professional use and personal use of social media. Also be aware of the various legal considerations bearing on your company's online communications, which may present hidden dangers.
What is a social media policy?
In the simplest terms, a social media policy is your company's principles and guidelines for communicating online to the outside world.
Why have a social media policy for your company or organization?
Because social media blurs the line between the personal and the professional, people often give less thought to their postings and online activities and often disclose more information or disclose less circumspectly than they would otherwise. What is "said" via social media can spread virally and live online indefinitely. Potential risks social media policies are intended to combat include employees inadvertently disclosing company trade secrets or other proprietary information, which may lead to the loss of trade secret status or violate securities laws, insulting competitors' products, which may provoke a lawsuit, and using racially inflammatory or offensive language, which may harm a company or its brands.
Tips on developing a social media policy for business use
Foremost, a social media policy should reflect your company's culture and industry, including its tolerance for legal risk and any special regulatory considerations that might apply (for example, if you work in a regulated industry like finance or medicine). Every company is different in terms of what type and how much social media engagement is acceptable or encouraged. For example, consider whether your company wants to encourage or discourage participation in social media across all platforms, or take a hybrid approach, e.g., encourage participation in LinkedIn and blogs, but not on Facebook or Foursquare. Consider also whether your company wants to encourage transparency regarding an employee's association with the company (by requiring a disclaimer, "The opinions and positions expressed are my own and don't necessarily reflect those of Newco") or your company wants to discourage any reference to one's identity, employer, trademarks or job title ("Never write about or mention Newco or your job without written authorization from management.").
Some companies with extensive, existing policies (e.g., regarding anti-harassment, ethics and protection of company information) may choose to extend their existing policies to a social media context with a social media policy as simple as "all company policies that address inappropriate behavior apply to your conduct online, including Internet communications, including communications via social media." Others prefer a more detailed approach to help put their employees on notice regarding what's appropriate/inappropriate specifically in a social media context. For example, companies may want to drill down on categories of information not to be disclosed online, including the following key topics:
- The numbers: Non-public financial or operational information. This includes strategies, forecasts and most anything with a dollar-figure attached to it. If it's not already public information, it's not the employee's job to make it so. Promotions: Internal communication regarding drive times, promotional activities, inventory allocations or retail holiday strategies. Personal information: Never share personal information regarding other employees or customers. Legal information: Never share anything to do with a legal issue, legal case, or attorneys. Anything that belongs to someone else: Let others post their own stuff; the employee should only post the employee's own creations to avoid running into copyright or trademark infringement issues, which may include not posting images or logos that are copyrighted or trademark protected by the employee's employer. Confidential information: Do not publish, post, or release information that is considered confidential or top secret.
Companies may also desire to address whether it is acceptable to post about clients or potential clients, and under what circumstances, if any, and if a company dissuades anyone not operating under the mantle of the company's official social media account, i.e., its official Facebook page(s) or official Twitter handle(s) from communicating about the company lest they be construed or misconstrued as a spokesperson for the company. For example, many companies require employees to use a "the views expressed are my own and not the views of Newco" type disclaimer in their social media activities. However, companies need to take care with requiring employees to disclose their social media accounts to their employer. A number of U.S. states restrict employers from forcing the employee to provide access to the account or "shoulder surfing" (watching while the employee accesses the account), and this trend has the potential to continue to spread to other countries.
If your company's culture is policy-averse, you can refer to social media "guidelines" rather than a policy (see, e.g., IBM Social Computing Guidelines and Walmart's Social Media Guidelines, the latter which address both employee and customer engagement via social media). In any event, employers need to be up front with employees (and contractors, if company policies apply to a company's contractors) about how much privacy (i.e., freedom from company oversight) the employees (and contractors) have with respect to social networking that may implicate company interests.
In-house counsel can be proactive in channeling employees' enthusiasm for social media and defining what is permitted and what is not. Consider rolling out a new social media policy or policy update with interactive training seminars to help educate employees about the policy, as well as their inherent duties of loyalty and confidentiality, to help make clear that those duties apply to them, even while "off the clock" and using their own computers and mobile devices via their own social media accounts.
Hidden dangers online
While it can be easy, quick and often more cost effective than using traditional media such as mail, print, television or radio advertising, to disseminate content online and reach an indefinitely large, global audience, there are potential legal risks, which merit consideration.
In the last 10-15 years, numerous countries have passed new laws in areas of privacy and data protection that may be implicated depending on the information collected by a company from its followers or connections via social media. In Europe, Canada, and other countries, protection of each citizen's private information is considered to be a human right, secured by statute and enforced by government and private rights of action. While the U.S. approaches privacy from a different perspective, in the U.S. alone, there is a patch work of federal and state laws bearing on privacy. For example, the majority of U.S. states have some sort of data breach notification law, which may be triggered when personal information collected from consumers via social media is at risk of theft or misuse or has been stolen or misused. The State of California in particular has been active in legislating on privacy issues in recent years, for example, recently giving minors a "right to be forgotten," and sets the tone for other U.S. states.
Technology associated with the Internet easily allows text, graphics, photos, and logos to be copied and pasted. Doing so will, in many instances, violate U.S. and foreign copyright laws. For example, using any third-party content without permission can result in both criminal and civil liability under the U.S. Copyright Act.
Social media sites generally prohibit posting defamatory content and may, but are not obligated to, take down such content. Lawsuits alleging online defamation are not uncommon and are generally treated by courts in the U.S. and other countries in the same manner as those involving traditional defamation claims. Defamation occurring via social media is likely to be attributable to an actual individual (assuming their profile information accurately reflects their identity), which magnifies the risk of liability for such online activities and may form the basis for legal action against both the individual poster and his/her employer under a vicarious liability theory.
Promotions such as contests, sweepstakes, deals and premium offers (i.e., buy one, get one free) are usually regulated differently across borders. Make sure your company's doesn't conflict with local laws before running it. Such promotions may also be subject to additional terms under the guidelines for the individual social media platform on which the promotion is administered. Find an example of promotion guidelines here.
In a number of countries, advertising related to certain types of products is subject to approval by various governmental authorities. For example, medical drug advertising may require prior approval. Reaching out to local counsel to help navigate applicable local laws is recommended.
Companies increasingly check online profiles when screening job applicants and may make hiring decisions based on those findings. Beyond the obvious impact on the applicant, does an employer who uses information from a social networking profile in making employment decisions face any risk in doing so? If an employer makes an adverse employment decision because of information gathered from Facebook or another social network, could it violate labor and employment laws? What if the information revealed on the site puts the applicant in a protected class or is otherwise protected under applicable laws? The answer to these questions can vary by jurisdiction.
Embracing social media, as more and more companies are doing, can be a fruitful endeavor, but manage the risks through a social media policy and by being cognizant of the hidden legal risks associated with online activity.
