Legal: Risk in a Social Media Policy


Social media should no longer be mysterious. Even as new platforms emerge and existing ones evolve, the foundational principles that animate most every iteration of social media remain constant. At base, social media serve the goal of for interaction. The form and content of this interaction are multifarious but serve the goal of elevating simple messages to interactive dialogue.

However, for many companies, the novelty of a new or recast platform can obscure the broader goal of thoughtful communication. The temptation for many companies is to establish a presence in a new social medium while it is in its nascent state to capitalize on the surge of new users or branch out into a new feature of an existing platform without full knowledge of its functionality. When these forays are undertaken without deliberate forethought and planning, legal risks begin to emerge which can vitiate the potential benefits of the social media presence.  If companies can establish a social media strategy that advances the business initiative that they are trying to implement, then companies can adopt a concomitant social media policy that will mitigate the potential for legal risk.

At the outset, it is worthwhile to distinguish between strategy and policy in the social media context. A strategy will establish the goals of an initiative (for example, increasing engagement with certain customers), the steps required to achieve those goals and the ways in which the social media initiative serves an organization’s broader goals. A coherent social media strategy will contemplate not only the business goal of the initiative but also display a full knowledge of the social media it intends to use, including its functionality, the information it requires and the degree of disclosure inherent in its use.

A policy sets the parameters for the implementation of the strategy. Through the establishment of guidelines informed by, for example, internal efficiency principles or other imperatives specific to the organization or the industry it operates in, a policy stipulates the rules within which the strategy can operate. It is at the inception of strategy and policy that the awareness of legal risks becomes paramount.

As an organization begins to establish an online presence that goes beyond the mere display of information on its website, it must be aware of the type of information that it is exchanging with the public. Given that effective participation on social media platforms demands an active and consistent engagement, the demands on information sharing can become challenging as organizations must provide content on an ongoing basis. Inadvertence is the most obvious and insidious danger. An example: an employee responsible for a company’s Twitter account tweets a message announcing positive financial results and includes link to financial statements which have not been properly vetted and contain sensitive financial information. This presents very real legal ramifications which can give rise to liability for the company, not to mention embarrassment.

Another example could be a glib statement on a company’s Facebook page about a competitor which might be regarded as libelous. Control over the information emanating from the company.

In drafting a social media policy, a company can obviate these pitfalls by delineating responsibility for social media output as well as regulating the interactions with those responsible for such output. Any financial information, industry insight, customer data or similar information should be vetted prior to being handed over for dissemination. As much as the prospect can be challenging given demands of generating content, the same care should be devoted to the drafting of social media content as to the drafting of a formal press release.

While a company must regulate the information it shares from its official sources such as the company Facebook page or Twitter account, it must also cast a wider net to capture and control information relating to it emanating from both third parties and unsanctioned individuals within the company. Another example: a mining company is conducting an exploration program on a potentially valuable new property. A geologist on the exploration team takes a picture of himself and tweets it. The geologist forgets that he has enabled geotagging on his tweets which note his location on every tweet. While his Twitter profile does not list his occupation, his LinkedIn page does and specifies which company he currently works for. Although the example is byzantine, all these elements can be pieced together to form a valuable piece of corporate intelligence. This ostensibly harmless tweet has now become a threat to the company’s competitive advantage.

The management of incoming communications through social media interaction of a company is as important as the management of outgoing information. Most companies have traditionally devoted significant resources to the collection and processing of customer data. The amount of customer data and personal information that has become almost freely available through the participation of individuals in social media was unheard of ten years ago. However, this personal information is usually given within the confines of the privacy policy under which it was solicited.

Depending on the use to which the personal information is put, overlapping privacy policies can restrict the implementation of the social media strategy. By way of example, organizations that set up fan pages on Facebook cannot collect personal information from users unless they obtain user consent while companies wishing to develop and launch a Facebook application may only request personal information from users that is necessary to run the application. However, they do not need user consent for every subsequent data collection.

One area of concern for violations of privacy policies comes up when companies integrate social media features directly into their websites. The central issue whether and to what extent does the company’s privacy policy applies to the information which is collected through the integrated social media platform. An ancillary issue is whether the company’s handling and use of such personal information violates its privacy policy. When the sources of personal information overlap, competing privacy policies will require careful navigation. Unfortunately, the failure to abide by the terms of privacy policies and terms of use can give rise to legal liability. That liability can arise directly with the social media platform provider and result in a banning or a breach of contract action or with the individual users, giving rise to potential class actions for misuse of personal information.

As companies attempt to keep pace with the various avenues of social media interaction, they must develop a methodical approach to their social media strategy and the policies that guide them. Whether the information is generated internally or being collected externally, a full knowledge of the legal implications of social media presence and the policies of social media platforms is essential to minimizing legal risk and advancing broader corporate strategy.

By Samuel H. Carsley

*Samuel H. Carsley practices in the areas of corporate and securities law with McLean & Kerr LLP, a law firm based in Toronto.