Jim Vibert, Senior Counsel, Hewlett-Packard (Canada) Co.

The views expressed in this presentation are those of the author alone.

Social Media and Privacy - Impacts to Employment

Relationships and Marketing Efforts

OverviewWhat is social media?Prevalence of social mediaPrivacy issues with social mediaSocial media - impacts to employment

relationships, including privacy concernsSocial media – impacts to marketing efforts

What is Social Media? “Social media are media designed to be disseminated through social

interaction, using highly accessible and scalable publishing techniques. Social media use web-based technologies to transform and broadcast media monologues into social media dialogues. They support the democratization of knowledge and information.

Social media can take many different forms, including Internet forums, weblogs, social blogs, microblogging, wikis, podcasts, pictures, video, rating and social bookmarking. Technologies include: blogs, picture-sharing, vlogs, wall-postings, email, instant messaging, music-sharing, crowdsourcing, and voice over IP, to name a few.

Examples of social media software applications include: Blogs: Blogger, LiveJournal, Open Diary, TypePad, WordPress, Vox,

ExpressionEngine, Xanga Micro-blogging / Presence applications: FMyLife, Jaiku, Plurk, Twitter,

Tumblr, Posterous, Yammer, Qaiku Social networking: Facebook, Geni.com, Hi5, LinkedIn, MySpace, Ning,

Orkut, Skyrock, Qzone, Vkontakte, RenRen, Kaixin, ASmallWorld, studivz, Xing, RunAlong.se, Bebo, BigTent, Elgg, Hyves, Flirtomatic “

Source: http://en.wikipedia.org/wiki/Social_media

Prevalence of Social Media(Credit: Compete.com)

Prevalence of Social Media

“Social Networking has been the global consumer phenomenon of 2008. Two-thirds of the world’s Internet population visit a social network or blogging site and the sector now accounts for almost 10% of all internet time. ‘Member Communities’ has overtaken personal Email to become the world’s fourth most popular online sector after search, portals and PC software applications.

The story is consistent across the world, ‘Member Communities’ has taken a foothold in every major market from 50% of the online population in Switzerland and Germany to 80% in Brazil. Facebook has become the largest player on the global stage, dominant in many countries, yet localised offerings have won the day in many others.

However, the growth in popularity of social networks – and the resultant broadening audience – is only half the story. The staggering increase in the amount of time people are spending on these sites is changing the way people spend their time online and has ramifications for how people behave, share and interact within their normal daily lives (emphasis added).”

Source: The Nielsen Group, March 2009, Global Faces and Networked Places - A Nielsen report on Social Networking’s New Global Footprint

Privacy OverviewPersonal Information Protection and Electronic

Documents Act:4. (1) This Part applies to every organization in respect of personal information that(a) the organization collects, uses or discloses in the course of commercial activities; or(b) is about an employee of the organization and that the organization collects, uses or discloses

in connection with the operation of a federal work, undertaking or business.

Provincial privacy laws in effect in B.C., Alberta and Quebec govern personal information even within private employment relationships.

Other provinces left without formal privacy laws for private sector employees – gap is starting to be filled within common law concept of “invasion of privacy”

Constitutional controversy even with federal control of “commercial activities” – State Farm has launched constitutional challenge to PIPEDA in Federal Court

Privacy Commissioner of Canada and FacebookFrom PIPEDA Case Summary #2009-008:

6. “Social networking sites are a cultural phenomenon. In the last five years, the popularity of these sites has exploded, with millions of people around the world joining them to keep in touch with their friends and family and to meet new people. They represent a dramatic shift in the way people communicate, and their use raises interesting questions about long-held views on what it means to have a private life or a sense of “privacy”.

7. In an age where it appears almost everyone is leaving their digital footprints everywhere, including their views, pictures, beliefs and sometimes romantic foibles, our notions of controlling one’s personal information – the foundation on which the Personal Information Protection and Electronic Documents Act (the Act) is built – are being significantly challenged.

8. Facebook is the most popular social networking site in the world – with over 200 million users worldwide and nearly 12 million users in Canada alone. It describes itself as a “social utility that helps people communicate more efficiently with their friends, family and coworkers.” Its tag line is “Facebook is a social utility that connects you with the people around you.”

9. Our role as a privacy educator and advocate is clear. Users and employers need some signposts to help them navigate this world in a way that balances the social benefits many receive from social networking with the knowledge that what is posted online is never completely private.

10. In terms of our regulatory role, social networking sites like Facebook present an interesting challenge. The purpose of the Act is to balance an organization’s need to collect, use and disclose personal information for appropriate purposes with the individual’s right to privacy vis-à-vis their personal information. In the off-line world, organizations may collect particular personal information, and use and disclose such personal information, in order to provide a specific service.”

Privacy Commissioner of Canada and Facebook Complaint filed by the Canadian Internet

Policy and Public Interest Clinic (CIPPIC) . A broad based challenge (24 allegations

on 12 distinct subjects) to Facebook’s compliance with PIPEDA, including three key areas of:Privacy controls that were weak or confusing to

users (core issue of knowledge and consent)Broad and seemingly uncontrolled access to

personal information granted to third party developers (core issues of consent and protection), and

Maintenance of records longer than needed (de-activated accounts, etc.) (core issue of data retention)

Privacy Commissioner of Canada and Facebook On weak and confusing privacy controls, the

Commission seeks to ensure the users are giving informed consent:

“An overarching concern was that, although Facebook provides information about its privacy practices, it is often confusing or incomplete. For example, the “account settings” page describes how to deactivate accounts, but not how to delete them, which actually removes personal data from Facebook’s servers. The Privacy Commissioner’s report recommends more transparency, to ensure that the social networking site’s nearly 12 million Canadian users have the information they need to make meaningful decisions about how widely they share personal information.”

Source: July 16, 2009, Press Release, Privacy Commissioner of Canada

Organizations must make efforts to ensure user is advised of the intended purposes and that the user can understand how the information will be used or disclosed.

Privacy Commissioner of Canada and Facebook On granting third part developers access to personal

information, the Commission seeks to ensure the users are giving informed consent and that appropriate information protection safeguards are in place:

“The investigation also raised significant concerns around the sharing of users’ personal information with third-party developers creating Facebook applications such as games and quizzes. (There are more than 950,000 developers in some 180 countries.) Facebook lacks adequate safeguards to effectively restrict these outside developers from accessing profile information, the investigation found. The report recommended a number of changes, including technological measures to ensure that developers can only access the user information actually required to run a specific application, and also to prevent the disclosure of personal information of any of the user’s friends who are not themselves signing up for an application.”

Source: July 16, 2009, Press Release, Privacy Commissioner of Canada

Findings stress need for: technological control to effectively prevent third party developers from accessing

more personal information than is needed – contracts with third party developers speaking to privacy not alone sufficient

oversight and monitoring of third party compliance elimination of overly broad consent language – consent should be for specific

information for specific application needing it Consent should be limited to user him/herself – not all personal information of that

person’s friends.

Privacy Commissioner of Canada and Facebook On maintenance of records longer than needed (de-activated accounts):

“The investigation also found that Facebook has a policy of indefinitely keeping the personal information of people who have deactivated their accounts – a violation of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private-sector privacy law. The law is clear that organizations must retain personal information only for as long as is necessary to meet appropriate purposes. Recommendations to Facebook included the adoption of a retention policy whereby personal information in deactivated accounts is deleted after a reasonable length of time.”

Source: July 16, 2009, Press Release, Privacy Commissioner of Canada

Privacy Commissioner of Canada and Facebook Subsequent Facebook agreement in August

2009 to agree to implement all recommendations.

New complaint filed in 2010 re further changes made by Facebook to its privacy controls. OPC to revisit matters as needed.

Social Media - Impacts When Hiring Employees

Search of social media sites with publically viewable content Ability to search broad cross section of publically viewable

social media with view to gaining a better understanding of the candidate

When conducting searches, employers need to be mindful of privacy expectations of candidates

Can help prospective employer get a better ‘read’ on the candidate – their background, interests, character, ability to express themselves and write well, etc.

Against this new found wealth of information on prospective employees, employers also gain instant access at an early stage to information that might otherwise have been unknown – age, race, religion, marital status, and other areas of possible discrimination

If information used incorrectly by hiring managers, this could lead to human rights violations

Even when not used improperly, use of information from social media could be mistakenly viewed by a disgruntled candidate as the reason for not being hired and alleged human rights of violations could follow

Social Media – Impacts with Current Employees

Time wasted, insubordination and corrective actionRisk of IP/CI loss or compromiseEmployee’s expectation of privacyDefamation of other employeesHarassment of other employeesDamage to company brand/reputationIssues with short and long term disability claims

Real Life Impacts – Privacy, Social Network Posts, and Loss of Employment Benefits Depressed woman fails 1st try to recoup benefitsLast Updated: Friday, December 11, 2009 | 2:47 PM ETCBC News

“A Quebec woman who says her disability pay for depression was cancelled because of her Facebook profile has lost her first bid to have her benefits restored while she battles her insurance company.Nathalie Blanchard, 29, made headlines around the world when she went public this fall with her fight against Manulife, the insurance company underwriting her long-term disability leave for depression.Nathalie Blanchard, shown here on a beach holiday during her sick leave. (Facebook) Blanchard, a Granby resident, took sick leave from her job at IBM last year, after she was diagnosed with major depression. She has since taken different approaches to treat her mood disorder, including prescription medication and therapy. Under doctor's orders, she has also tried to have fun.Photographs of that fun — a beach holiday last year, a night out on the town with friends — are part of the evidence Manulife used to stop payments this fall. Blanchard said the company told her that based on her Facebook photos, she looked well enough to work.Manulife stopped paying her sick-leave benefits, and her mortgage company, Desjardins, ended her insurance payments.While her lawyer, Tom Lavin, presses Manulife, Desjardins and IBM to review the case, Blanchard went to court this week to ask for a temporary reinstatement of her benefits until a final decision is made. The judge who heard her request at the Cowansville courthouse refused.”

Source: http://www.cbc.ca/canada/montreal/story/2009/12/11/quebec-facebook-sick-leave-benefits.html

Real Life Impacts – Privacy, Social Network Posts, and Loss of Employment Benefits From macleans.ca: Depressed girls gone wild?By Colby Cosh - Wednesday, November 25, 2009

– “Blanchard also says, by the way, that she “doesn’t understand how Manulife accessed her photos because her Facebook profile is locked and only people she approves can look at what she posts.” I hope that since this interview, someone has taken her aside and gently explained the Sherlockian maxim that “when you have eliminated the impossible, whatever remains, however improbable, must be the truth.” In this case, the compelling conclusion is that somebody Blanchard trusted snitched on her to the insurer, perhaps in a spasm of dudgeon over her insurance-subsidized lifestyle. It happens. In fact, it was known to happen before there was such a thing as Facebook.”

Real Life Impacts – Blogs and Termination of Employment

2008 Case: Alberta v. Alberta Union of Provincial Employees

Employee setting up personal blog and posting negative comments about fellow employees on a “no names” basis.

“…Roberta likes to talk – unfortunately she’s menopausal – she might have short term memory problems – always forgets the people’s names she’s talking about, or the point of her story, or the ending – most of the time we just listen for a few minutes until we figure out who made eye contact with her, then we ditch the person from the conversation for the rest of the break …….If I had to choose a planet she came from, I’d say it was some dark planet with very little oxygen….”

Leads to eventual termination because the postings had irreparably undermined the employment relationship.

Employee said the comments were meant to humorous .

Source: Alberta v. Alberta Union of Provincial Employees, 174 L.A.C. (4th) 371

Real Life Impacts – Blogs and Termination of Employment “The Union argued that few people in the workplace had

discovered the Grievor’s blogs at the time they came to management’s attention, minimizing any damage. In the Board’s view that is not the issue; the issue is there content and public access to that content.”

“Because blogs are a relatively new phenomenon that have not attracted a great deal of arbitral attention to date, the parties could only point to the one previous award on this subject, Chatham-Kent, a decision issued in 2007. In Chatham-Kent, an employee of a health care facility for seniors was fired for the contents of her blog. Like in the current case, there were no restrictions on public access – it was open to anyone with internet access.”

“Consistent with Chatham-Kent, the Board agrees that the impugned conduct in the current case was serious enough to undermine the employments relationship beyond repair, justifying discharge.”

Source: Alberta v. Alberta Union of Provincial Employees, 174 L.A.C. (4th) 371

Social Media - Impacts with Former Employees

Employment status changes – disclosures made through social media, some private, some perhaps less so, and the affect on severance negotiations/mitigation arguments

Former employee’s honouring of confidentiality obligations, non-compete, non-solicitation provisions – ability to monitor, investigate, and gain evidence of compliance through social media

Social Media – Impacts to Employment Relations and How to Address

Implement policies to specifically address employee’s usage of the “internet” generallyBe clear that there should not be an expectation of

privacyState that use should be kept to a minimum and

not interfere with job functionsState that system/network access are company

property to be used by employees for job functions primarily

List types of sites that are prohibitedState consequences for breaching policy

Standards of business conductImplement standards of business conduct, or codes

of behaviour, to which employees must adhere

Social Media – Impacts to Employment Relations and How to AddressBan

Consider banning social media or severely restricting access

But is this practical given number of sites?And is this desirable for employee attraction and

retention?Better approach is a balance between allowing access

and controlling amount of time spent and inappropriate site visits via internet use policy

Monitoring Implement monitoring tools – many possible tools and

gating criteria for reports – sites visited, time spent, competitor names and other key word triggers used, etc.

Warn employees of monitoring - lack of privacy expectation

Even so, courts will not condone overly invasive controls – such as key stroke recording of personal mail accounts

Social Media - Impacts to Marketing Efforts

Pros• Savvy companies are increasingly using social media

as an integral part of their overall marketing efforts• Could take several forms from CEO blogs to Twitter

campaigns by members of the Marketing Department • Great way to provide pro-active communications in

real time, e.g.– To initiate viral marketing efforts to promote new

products, services or social events, events that may be directly or indirectly be connected to products or services promotions themselves

– Ability to quickly launch a new campaign in response to unexpected changes or opportunities in the market

• Great way to provide reactivate communications in real time, i.e. new form of PR/marketing response to unexpected negative business impacts

Social Media - Impacts to Marketing EffortsConsPossible breaches of privacy laws, IP

and/or confidentialityPossible libel, defamation and

harassment issuesPossible securities law violationsEven when not legally offending,

postings could be brand damaging

Social Media - Impacts to Marketing EffortsPolicy ConsiderationsCompanies should have a policy that specifically

addresses use of social media by employees Policy should reflect company values and should

require employees using social media to focus on the positive aspects of a company’s products or services

Employees should be told to avoid making statements that could be seen to defame, libel, or harass others

Prohibit employees from commenting on anything related to legal matters or any litigation involving the company without the approval of the Law Department. Employees must not comment in any way on rumors or speculation in the market; affirming or denying rumors, or even suggesting denial or affirmation is not permitted

Social Media - Impacts to Marketing EffortsPolicy ConsiderationsEmployees to indentify themselves as such

when using social media for company business

Third parties hired should declare that they are being compensated

Failure to properly identify oneself, or pose as someone else, could lead to legal liability

Practice called “astroturfing” can be viewed by legal authorities to be a form of false advertising and a deceptive commercial practice. Canadian Competition Act forbids making representations that are false or misleading in a material respect

Social Media - Impacts to Marketing EffortsPolicy ConsiderationsTrain employees on policyMake it clear that views expressed by the employee are

his/her own and not those of the company (could be exceptions for pre-approved/controlled Marketing campaigns)

Generally avoid use of company intellectual property, again except for pre-approved/controlled marketing campaigns

Senior executive blogs and other official marketing campaigns should have the same level of review and thoughtful effort put into them as other marketing campaigns.

When used in an official “marketing” capacity by the Marketing or PR departments, the use of social media is the same as other marketing efforts: it needs to be thoughtful and controlled

Social Media - Impacts to Marketing EffortsPolicy ConsiderationsThe same concerns with the truth of the material and the

need to understand possible impacts to securities law violations remains. This concern is heightened with more senior level “CEO type” blogs

Monitor social media sites in same pro-active way that company would other traditional media activity – but be prepared to respond more quickly with social media response campaigns

In addition, monitor social media for third parties who may be misappropriating your brand, i.e. confusingly similar names of sites

Finally, employees should be reminded that the same rules apply as with other company business: i.e. that confidential of the company and its customers and personal and private information about individuals, including fellow employees, cannot be disclosed when using social media.

Social Media marketing collectionsCollected by www.smm.vn