By now, most people recognize that social media has become global and pervasive. This is true for both individuals as well as businesses. People use social media for a variety of reasons, perhaps to connect with family and friends, to find a job, or to catch up on news. They may also use social media at work, to look up professional information about a colleague, to provide customer service or to market their business. Companies now routinely use social media to promote their business and brand, to attract new customers, find and recruit top talent and do competitive research.

The fact is that employees are active on social media, sometimes for personal reasons, and sometimes to support their work-related activities. However, the line between those activities is increasingly blurred. Problems can and do arise when employees’ social media activities are not in line with their employer’s expectations. Often, employers don’t have a social media policy in place at all. By leaving important questions unanswered, both employee and employer are exposed to all kinds of risks.

Employee Privacy Laws - Social Media on a mobile device

Generally, privacy is defined as the right to keep personal information, matters and activities out of the hands of others.

Among other things, personal privacy can include the right of an employee not to divulge social media passwords to an employer, and for their social media use at work not to be monitored without explicit consent. The concept of privacy itself can also vary in different parts of the world. In some regions privacy is a constitutionally guaranteed right, while in some countries, privacy isn’t considered a basic human right at all.

In the United States, and for global companies, employee privacy laws significantly impact the use of social media in the workplace. Understanding employee privacy laws and their impact on employees’ use of social media is an important first step towards managing the risks associated with that use. while guiding and protecting your employees and company at the same time.

Employer vs Employee

In general, an employer usually has a desire to both promote and protect the business. An employer’s interests may include building great products, growing market share, remaining competitive, serving customers responsibly, managing risks and protecting its reputation. Many businesses now regularly engage in marketing and public relations, customer service and sales, commerce and other business activities on social media.

On the other hand, employees may use social media for both personal or work-related reasons. Those activities may also be on company time – or not. Employees may use social media for personal activities to stay in touch with family and friends. They may also use social media to collaborate with colleagues, build professional credibility, follow thought leaders and advocate on behalf of their employer. Social media can be used by employees to generate leads, build and maintain relationships with clients, and keep up with industry trends.

For example, a company recruiter may look in their personal LinkedIn network for colleagues who might be a good fit for a new job posting at the company. But what happens when that recruiter comes across personal information about a potential recruit? Can the recruiter use that information to screen out candidates? What happens when a senior attorney decides to follow a junior colleague on Twitter? Could that be considered “monitoring” the employee and would that require the colleague’s consent?

In both these cases, the boundaries between the employee’s personal and professional lives is blurred. Employees and employers are charting new territory as they try to balance employee rights with a company’s legitimate business interests.

Given the range of possible activities that can occur in social media, it’s only natural that there’s tension between an employer’s interests and its employees’ rights to privacy.

As a result of those conflicting needs and interests, employers can find themselves with unhappy or rogue employees, ugly, time-consuming and expensive employment disputes and even lawsuits, fines and sanctions. This has resulted in a significant increase in recent years of lawsuits and cases involving employee privacy violations occurring specifically with social media.

This is an outline of some of the issues that should be taken into consideration when a company thinks about employee privacy laws in the context of social media.

What are Employee Privacy Laws?

Employee privacy laws are regulations that pertain to an employee’s privacy rights related to their employment. Employee privacy laws define the boundaries between an employee’s right to personal privacy while balancing the rights of an employer to protect itself from risks or harm that may result from an employee’s activities.

Privacy laws can vary by region or industry. Different countries, states and regions have established various laws related to employees’ rights to personal privacy, data protection and labor-related rights. For example, in the United States, personal privacy can potentially extend to the right to free speech, which is protected within the Constitution.

Regional and country-specific laws directly affect employees’ rights to use social media in the workplace and employer’s rights to monitor those employees’ activities.

Employee privacy laws also vary across industries. In the U.S., a wide range of regulators, particularly those in the health care, financial services, communications, and insurance sectors, have authority to issue and enforce privacy regulations.

Employees aren’t immune from the consequences either. They may be surprised to learn the limits of their rights to privacy when using social media.

The result is a complicated web of employee privacy laws that must be untangled by employers even as social media and related laws and regulations evolve rapidly.

Employee Privacy Laws Related to Social Media

Employee privacy laws can be grouped into the following categories:

Employment Discrimination
Free Speech
Labor- Or Union-Related Activities
Account/Password Access and Management
Prohibition of Social Media Use In The Workplace
Monitoring Employee Use of Social Media
Regional Privacy Laws

We’ll take a look at these seven different categories and examine how each might impact your workplace social media policy.

#1 Employment Discrimination and Employee Privacy

In the United States, various employment discrimination laws are in place to protect people in certain “classes” or groups from discrimination in the workplace. There are a number of federal and state statutes that outline how these “classes” are protected.

These classes include:

Race
Religion
National Origin
Age (people over 40)
Gender Identity/Sex
Pregnancy
Citizenship
Familial status
Genetics/Color
Veteran status
Physical or mental disability status

The most important federal statute that prohibits workplace discrimination is Title VII of the Civil Rights Act of 1964, which prohibits discrimination on the basis of race, color, religion, sex and national origin. Individual states have also created other classes of employment protection under state law.

Hiring, Recruiting and Screening in Social Media

In social media, the risk of running across this type of protected information is obvious. People often share a great deal of highly personal information on their social media profiles. An employer may directly or inadvertently come across information on an employee’s personal social media account that could be considered “protected”.

Philip Gordon, an attorney with the law firm of Littler Mendelson in Denver, Colorado has written prolifically about workplace privacy and online surveillance. According to an interview by Consumer Reports, Gordon suggests that “A string of birthday wishes might reveal an applicant’s age”. As such, employers would be wise to use caution when searching for or screening candidates on social media.

Employers that use social media to hire, recruit or screen potential job candidates or to monitor current employees must be particularly cautious about collecting any of these types of personal information from their employees. Since this information is deemed “protected”, an employer that collects or uses any of this information may run the risk of being accused of discrimination.

To avoid being accused of illegal behavior, many companies are now farming out recruiting work to consultants, thereby insulating in-house HR teams and hiring managers from using social media in possibly illegal ways.

#2 Free Speech and Employee Privacy

In the United States, the first amendment to the Constitution states that the following rights belong to its citizens:

“Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.” – First Amendment, U.S. Constitution

Social Media and Free Speech

In a recent and high-profile case, an employee in Northern Virginia, was fired by her employer shortly after she flipped off the Trump motorcade as it passed her on her morning bicycle route. Juli Briskman was terminated by Akima, her employer after she notified them that she was the person on the bicycle in the highly-publicized photo.

Does an employee have the right to post her personal opinion (or photo in this case) on her personal social media account? An employer’s workplace social media policy can state that an employee must conform to certain business standards or be subject to the consequences. In the case of Ms. Briskman, her employer felt her behavior was not in conformance with their company policy – hence the firing.

The challenge for employees and employers is that on social media, many people feel that the First Amendment gives them the right to say anything, to anyone, at any time.

In fact, social media is often used as a megaphone precisely because it has the potential to reach a wide audience.

Code of Conduct vs Personal Privacy

While employees have certain rights with respect to personal privacy, companies also have the right to expect a certain standard of conduct of their employees. In the case of Ms. Briskman, while she had the right to her personal opinion, the company decided that she did not have the right to violate her company’s employee code of conduct and still expect to retain her position at the company.

Even the First Amendment Has Limits

With respect to employees and the right to freedom of speech, the meaning of the First Amendment only extends to the right to express yourself without interference or constraint by the United States government. While the the U.S. Supreme Court issued a decision in the landmark 1996 case Reno v. ACLU that specifically extended the First Amendment to written, visual and spoken expression posted on the Internet, this does not mean that anything said online is protected by “free speech”.

The United States Supreme Court has held that the government can limit both the content of speech and the ability to engage in speech as long as the government has a “substantial justification”. Hate speech, advocating illegal activity, defamation and copyright infringement are all examples of substantial justification.

To avoid the landmines associated with debating and litigating constitutional rights, any company would be wise to carefully consider how their employees’ rights to freedom of speech might impact the wording of their workplace social media policy.

#3 Labor-Related Activities and Employee Privacy

A Sweeping Social Media Policy Can Be Unlawful

In the interest of protecting themselves, employers often create social media policies that are broad and sweeping.

These types of policies can invariably prohibit activities that are protected by federal labor law, such as the discussion of wages or working conditions by employees.

U.S. Labor Laws Impact Social Media

In the United States, the National Labor Relations Act (“NLRA”) plays a pivotal role on the issue of employee privacy laws.

Under the NLRA, employees in the United States have the right to conduct union or labor-related activities on their personal social media accounts.

What are Protected Concerted Activities?

Examples of protected concerted activities include:

organizing co-workers,
complaints about working conditions and
on-the-job protests, picketing and strikes.

Use Caution with Overly Restrictive Social Media Policies

An employee may choose to organize, complain or protest about their workplace on social media. If an employer prohibits social media use too broadly, it can be interpreted as too restrictive. In fact, it’s been interpreted that according to the NLRA, an employer may generally not take action against an employee who posts items critical of the employer’s employment practices, subject to the posts being joined in by co-employees, or if the posts are for the purpose of urging, preparing for, or carrying out concerted complaints or actions.

Employees who want to engage in these types of “protected” activity on social media are doing so under their rights as outlined in the NLRA Section 7 & 8(a)(1).

Unlawful Firing of Employees Due to Social Media Activity

In a decision issued December 14, 2012, the NLRB found that it was unlawful for a non-profit organization to fire five employees who participated in Facebook postings about a coworker who intended to complain to management about their work performance.

In its analysis, the Board majority applied settled Board law to social media and found that the Facebook conversation was concerted activity and was protected by the National Labor Relations Act.

The NLRB also states that “individual griping” by employees is not covered by the NLRA. Work-related complaints must be related to some type of group action, or “seek to initiate, induce or prepare for group action, or bring a group complaint to the attention of management.” Activity is not protected if employees say things about their employer that are “egregiously offensive or knowingly and deliberately false”, or if employees publicly disparage their employer’s products or services without relating their complaints to any labor controversy.

It’s therefore broadly interpreted that according to the NLRA, an employer may generally not take action against an employee who posts items critical of the employer’s employment practices, subject to the posts being joined in by co-employees, or being for the purpose of urging, preparing for, or carrying out concerted complaints or actions.

An employer also may not discriminate against an employee or applicant based on posts which indicate previous support of or involvement in union or protected concerted activities.

#4 Accounts, Passwords and Employee Privacy

If you think that, as an employer, you can insist on access to your employees’ social media accounts so you can monitor their behavior, think again. Many states have put regulations in place that protect employees’ online privacy by explicitly prohibiting employers from asking for access to an employee’s personal social media accounts.

Some states have specific employee/employer social media laws in place, while others have laws related to general internet privacy.

The following examples include excerpts from California, Michigan and Oregon state laws and illustrate the differences between states’ laws.

EXAMPLE #1 CALIFORNIA EMPLOYEE PRIVACY LAWS

The California Labor Code has a specific provision related to Employer Use of Social Media (Chapter 2.5 Section 980). The Section lays out an employer’s responsibilities with respect to their employees’ use of social media and restrictions on what an employer can ask for.

An employer in with California employees is prohibited from asking a current or prospective employee to provide access to their social media account, or to disclose their social media account credentials to the employer. Here’s the full text of the relevant Section:

California Labor Code

CHAPTER 2.5. Employer Use of Social Media [980- 980.]

(a) As used in this chapter, “social media” means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.

(b) An employer shall not require or request an employee or applicant for employment to do any of the following:

(1) Disclose a username or password for the purpose of accessing personal social media.

(2) Access personal social media in the presence of the employer.

(3) Divulge any personal social media, except as provided in subdivision (c).

(c) Nothing in this section shall affect an employer’s existing rights and obligations to request an employee to divulge personal social media reasonably believed to be relevant to an investigation of allegations of employee misconduct or employee violation of applicable laws and regulations, provided that the social media is used solely for purposes of that investigation or a related proceeding.

(d) Nothing in this section precludes an employer from requiring or requesting an employee to disclose a username, password, or other method for the purpose of accessing an employer-issued electronic device.

(e) An employer shall not discharge, discipline, threaten to discharge or discipline, or otherwise retaliate against an employee or applicant for not complying with a request or demand by the employer that violates this section. However, this section does not prohibit an employer from terminating or otherwise taking an adverse action against an employee or applicant if otherwise permitted by law.

EXAMPLE #2 MICHIGAN EMPLOYEE PRIVACY LAWS

In Michigan, the Internet Privacy Protection Act outlines an employer’s duties with regard to requesting information from an employee about their personal Internet account:

STATE OF MICHIGAN

INTERNET PRIVACY PROTECTION ACT (EXCERPT)
Act 478 of 2012

37.273 Duties of employer.

Sec. 3.

An employer shall not do any of the following:

(a) Request an employee or an applicant for employment to grant access to, allow observation of, or disclose information that allows access to or observation of the employee’s or applicant’s personal internet account.

(b) Discharge, discipline, fail to hire, or otherwise penalize an employee or applicant for employment for failure to grant access to, allow observation of, or disclose information that allows access to or observation of the employee’s or applicant’s personal internet account.

EXAMPLE #3 OREGON EMPLOYEE PRIVACY LAWS

Oregon’s employment discrimination laws with respect to social media are very specific and contained within Chapter 659A — Unlawful Discrimination in Employment, Public Accommodations and Real Property Transactions; Administrative and Civil Enforcement:

659A.330 Employee social media account privacy. (1) It is an unlawful employment practice for an employer to:

(a) Require or request an employee or an applicant for employment to establish or maintain a personal social media account, or to disclose or to provide access through the employee’s or applicant’s user name and password, password or other means of authentication that provides access to a personal social media account;

(b) Require an employee or an applicant for employment to authorize the employer to advertise on the personal social media account of the employee or applicant;

(c) Compel an employee or applicant for employment to add the employer or an employment agency to the employee’s or applicant’s list of contacts associated with a social media website;

(d) Except as provided in subsection (4)(b) of this section, compel an employee or applicant for employment to access a personal social media account in the presence of the employer and in a manner that enables the employer to view the contents of the personal social media account that are visible only when the personal social media account is accessed by the account holder’s user name and password, password or other means of authentication;

(e) Take, or threaten to take, any action to discharge, discipline or otherwise penalize an employee for the employee’s refusal to:

(A) Establish or maintain a personal social media account;

(B) Disclose, or provide access through, the employee’s user name and password, password or other means of authentication that is associated with a personal social media account;

(D) Access a personal social media account as described in paragraph (d) of this subsection; or

(f) Fail or refuse to hire an applicant for employment because the applicant refused to:

(A) Establish or maintain a personal social media account;

(B) Disclose, or provide access through, the applicant’s user name and password, password or other means of authentication that is associated with a personal social media account;

(D) Access a personal social media account as described in paragraph (d) of this subsection.

(2) An employer may require an employee to disclose any user name and password, password or other means for accessing an account provided by, or on behalf of, the employer or to be used on behalf of the employer.

(3) An employer may not be held liable for the failure to request or require an employee or applicant to disclose the information specified in subsection (1)(a) of this section.

(4) Nothing in this section prevents an employer from:

(a) Conducting an investigation, without requiring an employee to provide a user name and password, password or other means of authentication that provides access to a personal social media account of the employee, for the purpose of ensuring compliance with applicable laws, regulatory requirements or prohibitions against work-related employee misconduct based on receipt by the employer of specific information about activity of the employee on a personal online account or service.

(b) Conducting an investigation permitted under this subsection that requires an employee, without providing a user name and password, password or other means of authentication that provides access to a personal social media account of the employee, to share content that has been reported to the employer that is necessary for the employer to make a factual determination about the matter.

(5) Nothing in this section prohibits an employer from accessing information available to the public about the employee or applicant that is accessible through an online account.

(6) If an employer inadvertently receives the user name and password, password or other means of authentication that provides access to a personal social media account of an employee through the use of an electronic device or program that monitors usage of the employer’s network or employer-provided devices, the employer is not liable for having the information but may not use the information to access the personal social media account of the employee.

(7) As used in this section:

(a) “Personal social media account” means a social media account that is used by an employee or applicant for employment exclusively for personal purposes unrelated to any business purpose of the employer or prospective employer and that is not provided by or paid for by the employer or prospective employer.

(b) “Social media” means an electronic medium that allows users to create, share and view user-generated content, including, but not limited to, uploading or downloading videos, still photographs, blogs, video blogs, podcasts, instant messages, electronic mail or Internet website profiles or locations. [2013 c.204 §2; 2015 c.229 §1]

#5 Prohibition of Social Media Use and Employee Privacy

Many employers are concerned with the risks of employees using social media at work. These risks can include data or confidentiality breaches, social engineering, cyberattacks and time wasted as employees browse social networks on company time. Employers often try to manage those risks by completely banning its use in the workplace. Mechanisms are put in place to prevent access to social media on company-issued devices, such as desktops, laptops and mobile phones. Prohibiting the use of social media in the workplace can mitigate some of the risks of employees using social media, however there are some employee privacy and labor-related issues that employers should be aware of:

Prohibiting Social Media Use and Federal Labor Laws

In most countries, an employer is allowed to prohibit the use of social media sites during work on both employer-provided equipment and personal devices. However, in the United States, employers should proceed with caution on prohibiting employees’ social media use, even on employer-provided devices.

By blocking all access to social media by employees, an employer may run the risk of violating federal labor laws. In the United States, under Section 7 of the NLRA, any monitoring of social media use (and related policies) must account for the rights of workers to engage in protected concerted activities.

Any prohibition against the use of social networks must avoid infringing the rights of employees to engage in those protected concerted activities.

If a workplace social media policy states that employees are prohibited from using social media, the policy should clearly specify the employer’s legitimate business interests that are being protected or achieved through the policy.

Additionally, any other restrictions related to an employee’s use of social media should be narrowly tailored to serve those specific business interests.

In other words, balance the needs of the business with the employees’ rights to use social media for labor-related activities.

Prohibiting Personal Social Media Use on Company Devices

Preventing employees from using social media on company devices and on company time isn’t always as effective as it may seem. While risks to the company are mitigated to some degree by shutting off complete access to social media on company devices and time, other risks still exist and may even be overlooked by an employer as a result. Most employees will continue to use social media on their personal devices, and the same risks apply.

Employees can and do use their personal social media profiles to vent about poor management or working conditions, difficult customers and confidential company strategies. They post photos of company events, local volunteering efforts and visiting colleagues in hospital. Shutting down social media access at the office is not a cure-all to social media risks. Make sure that your company has an approach and policy for your employees’ personal use of social media in addition to work-related use.

#6 Monitoring Employees’ Social Media Use

Employee privacy laws often include rules on monitoring employees’ use of social media. These laws are written to protect an employee’s rights to privacy while balancing an employer’s need to monitor employee activities to protect the business from harm.

We’ve found that there are a handful of approaches that employers commonly use when monitoring their employees’ use of social media:

No monitoring: Employee can access all social networks on company or personal devices with no monitoring or supervision.
“Unofficial” Monitoring: Ad-hoc or “unofficial” monitoring of employees’ personal use of social media. Can occur even when all access to social media on company devices is blocked.
Intentional Monitoring of Specific Networks: Allow and monitor employees use of “approved” social networks while monitoring employees’ personal and work-related use of social media.

No Monitoring: The riskiest approach for an employer is to allow employees full, unmonitored and unsupervised access to all social networks. In this case, an employer is exposing their business and employees to a myriad of risks associated with social media activities including strategic, operational, legal, financial and reputational risks.

“Unofficial” Monitoring: Many employees, managers or leaders will connect with each other on LinkedIn or Facebook, “outside the office”. This can be construed as “monitoring” their teams’ personal social media activities. If this is the case, make sure employees are aware of and consent to any monitoring that is taking place of their personal social media profiles.

Intentional Monitoring of Specific Networks: Thoughtful, intentional and selective monitoring of employees’ social media activity helps to mitigate risks for an employer. Intentional monitoring should include processes to gain monitoring consent from employees, approvals of specific social networks for use by employees, and methods for employees to request an exception.

Monitoring of employees’ social media activities should only be done by designated employees who have been well-trained on the limits to their activities. Monitoring should also be conducted using specialized social media monitoring tools, with the capability of storing, searching and retrieving information and data as needed.

Monitoring Employees in the U.S.

In the United States, any employer monitoring of employees must comply with individual state employee privacy laws, as well as the rights of workers to engage in certain “collective activities” related to labor conditions.

The National Labor Relations Board (“NLRB”) oversees enforcement of National Labor Relations Act (“NLRA”), which describes the rights of workers and the circumstances under which employers can monitor those employees in connection with those activities.

#7 Regional Employee Privacy Laws

Employee privacy laws vary region to region, country by country. Companies that operate in multiple regions, countries or jurisdictions must be particularly vigilant of employee privacy laws that vary by region.

For example, in Brazil, individual privacy is a constitutionally guaranteed right, whereas in India, there are no specific legal or inherent constitutional rights related to internet or social media privacy.

In the United States, the National Labor Relations Act plays a pivotal role on the issue of employee privacy laws. Additionally, 25 states have now enacted laws to clarify employee privacy with respect to social media.

Employers with employees in multiple states, regions or countries should ensure that any rules, regulations, guidelines, standards and policies related to social media take local employee privacy laws into consideration.

In Part 2 of this post, we’ll take a look at different privacy laws in different parts of the world and their potential impact on social media and employee privacy in the workplace.

Summary

Social media can be challenging in the workplace, especially when it comes to the rights of employees. There are many issues to consider including free speech, privacy, monitoring, advertising and state-specific laws.

It’s critical to balance an employer’s business interests while weighing an employee’s desire and rights to use social media in certain ways.

Most importantly, a well-written, detailed social media policy is an essential foundation in managing the risks for both employees and employers.

If your company is considering establishing a new social media policy or updating an existing policy, contact us for help on recommendations on improving your current policy or to develop a new workplace social media policy.

Note: This article is not legal advice and should not be taken as such. If you have questions about employment law and social media, we’re happy to offer references to attorneys who specialize in these areas.