Scenario

The Equal Employment Opportunity Commission (EEOC) files a discrimination action against a multinational organization in federal court on behalf of employees who claim ongoing emotional distress caused by a hostile work environment. The organization receives a discovery request from the EEOC seeking the production of the personal Facebook and MySpace profiles of the employees accused of the discriminatory acts. The discovery request seeks the accused employees complete social media profiles, including their status updates, wall comments, photographs and activity streams.

The Proliferation of Social Media

The use of social media such as Facebook, MySpace, Twitter, YouTube and LinkedIn has exploded over the past few years. One study found that online social media use has risen more than 230 percent over the last three years. The ubiquity of social media has made it impossible for organizations to ignore. Seventy-nine percent of the Fortune 100 companies use at least one social media platform to communicate with their customers, and 20 percent of companies are using all four of the main social technologies (Twitter, YouTube, Facebook, and blogs). Social media can increase public awareness of an organization, offer branding and public relations opportunities, increase interaction between employees and consumers, and increase productivity by enabling time-sensitive access to information.

The Legal Treatment of Social Media

Although the content on social media sites is increasingly at issue in legal disputes, the legal system has been slow to articulate consistent guidelines for its treatment in litigation. By using email and other electronic communication formats as precedent, courts and regulators have looked to the Federal Rules of Civil Procedure and other laws—such as the Stored Communications Act of 1986—for guidance. But reference to decades-old electronic communication laws to analyze issues related to cutting-edge electronic communication through social media has translated into a perplexing mix of court decisions around the country. In particular, courts have grappled with an individual’s privacy concerns when weighing whether content on social media sites is discoverable.

While individuals generally believe that information posted to a social media account with privacy settings is private and protected from disclosure, those privacy settings may not prevent disclosure when the content is relevant to a litigation. For example, one court ordered the production of content from the plaintiffs’ Facebook and MySpace accounts where the plaintiffs’ alleged damages included emotional distress. The court noted that the privacy settings on the social media sites did not provide a basis for protecting content from discovery.

In contrast, another court shielded from discovery the content from a plaintiff’s Facebook and MySpace account to the extent that the content was not available to the general public. Still other courts have found that certain types of information on a Facebook account may be discoverable, while other types—such as pictures linked from another user’s Facebook account—may not.

In addition to the legal standards promulgated by the courts, organizations should be aware that regulators have also recognized the relevance of communications via social media. For example, the Financial Industry Regulatory Authority (FINRA) recently issued guidance on the use of social media sites that requires member firms to retain records of communications with customers through social media sites related to the firms broker-dealer business, just as they would for other communications. And where an organization is required to retain certain types of communications, it can expect that those communications will be discoverable when relevant to a subsequent litigation.

Best Practices: Know the Risks & Develop a Plan

The legal uncertainty regarding social media in discovery—and the lack of standardized protocols for preservation, collection and production—makes managing the risks associated with social media use a challenge. Some organizations view the risks posed by social media as too great, banning the use of social media by employees as a matter of policy. However, as with most new technologies, a complete ban on the use of social media may be impractical for most companies.

  • Understand the risks associated with different types of social media use. Use of social media can be organized into three categories, each of which presents different risks to an organization.
    • Organization-sponsored, outwardly facing sites. These sites are created by the organization to fit clear objectives. The content often creates a formal organizational presence on the social media site and is geared toward disseminating information to customers and others outside of the organization. In theory, this type of social media use is easier for the organization to control, but it presents many of the same risks associated with communications with customers through other means.
    • Internal sites and blogs. These types of social media facilitate communication within an organization. They focus on increasing productivity and employee interaction, and may create risks of discrimination or other employment-related claims.
    • Employees’ personal sites. Use of this type of social media generally lacks organizational goals, but may nonetheless associate the user with the organization. Personal social media sites also give rise to the most confusion regarding privacy issues and whether the organization “controls” an employee’s personal social media accounts for purposes of discovery. The risks represented by these sites include misrepresentations about the organization by the employee, associating improper conduct by the employee with the organization or revealing confidential information to the public.
  • Understand how the organization uses social media. Conduct an inventory of the social media being used by the organization and its employees, determine how they are being used and identify which are the most beneficial to achieving the organization’s goals. Analyze the risks associated with social media in the context of the organization’s business plan.
  • Develop policies and procedures. Develop policies and procedures that ensure the organization and its personnel comply with the applicable requirements. Policies and procedures must consider social media in the context of the organization’s business and its compliance and supervisory programs. A policy should clearly identify the individual employees, teams or groups authorized to access social media for the organization’s benefit and to associate themselves with the organization in their personal social media accounts.
  • Ensure proper training. Proper employee training and clear management communication are essential to the success of a social media policy. Employees must understand not only the risks presented by social media use to the organization and themselves, but also the benefits of appropriate use of this technology.
  • Enforce social media policies. An organization must enforce its social media policies and procedures by incorporating them into current enforcement and compliance programs. Enforcement of a social media policy may require collaboration among an organizations’ information technology, human resources and legal departments.
  • Anticipate discovery concerns. Advanced planning can reduce the risks associated with preserving and producing information from social media sites. Develop a legal hold plan that incorporates social media and be prepared to discuss those issues with opposing counsel.