Social media poses lots of risks. Many of these risks stem from the fact that the lines between our professional and personal lives are blurring. We are taking our work home with us and often bringing our personal lives to work.

You need to be aware of the risks of social media in order to protect your organisation against them. Most of the risks of social media are obscure because people perceive social media to be something personal, not professional. But LinkedIn is a professional social media platform which has its own array of risks and is starting to change that perception. Both personal and professional social media can be a risk and negatively affect your organisation.

Reputational damage to your organisation

The old distinction between work and home is breaking down. You, as an employer, can possibly take disciplinary action against an employee who posts something inappropriate if it impacts your organisation. This is regardless of the employee posting it at home, work, on your computer equipment or their own.

You can protect your organisation against the risks of social media with a social media policy. This is a way to inform your employees of whether their online behaviour is appropriate or not. The culture of your organisation will impact the way you draft your social media policy. Your culture might require a prescriptive policy or a principle based policy.

Risks of cybercrimes on social media

Reputational harm

What happens if your employee commits a cybercrime using social media? How might this affect your organisation? The biggest risk on social media is the reputational damage it might cause your organisation. If an employee commits a cybercrime, you might not be vicariously liable but you need to consider the reputational damage you might suffer due to the likely public nature of the crime.

For example, if your employee commits a crime of hate speech that incites harm on their social media account, maybe Twitter. This can quickly escalate and have high reputational damage consequences for your organisation. You need to ensure you have procedures in place to deal with these incidents quickly and appropriately to reduce the potential reputational fallout.

Does the Cybercrimes Act impose obligations on you as the employer?

If your organisation falls under the definition of “electronic services provider” and your employee commits a cybercrime on social media while using your “electronic communications network”, then it is possible your organisation may be obligated to report the cybercrime within 72 hours of your discovering it.

Whether or not you need to report the cybercrime would depend on a number of factors including:

  • the nature of the crime your employee commits and which definition it falls under;
  • the interpretation of “electronic services provider” or “electronic communications network” in your unique context; and
  • when the reporting obligations come into effect in the Cybercrimes Act.

Breach of confidentiality

One of the biggest social media risks is the disclosure of company confidential information. This can include trade secrets, know-how and other proprietary information. If the information contains personal information, it might also be a data protection breach.

The common law incorporates an implied term of confidentiality into employment contracts. Most employment contracts also have confidentiality clauses in them. You should, however, look at your own unique circumstances. You need to determine if it is necessary to include, or even expand upon the existing confidentiality clause to deal with potential social media risks.

Wasting time

Trying to control your employees’ personal online activity is not practical. Equally impractical would be trying to ban the use of Facebook and other social media platforms during office hours. Through your Social Media Policy or Acceptable Use Policy, you need to articulate what your organisation permits and what it does not.

Not all social media usage will be time wasting though. This is another example of professional and personal blurring together. If your employee works in marketing, they might need to spend a large portion of their time on social media. Your policies need to address these nuances.

Third party liability

This encompasses a wide range of potential risks, including copyright infringement. If an employee reproduces the copyright owner’s photos, music and writing without their consent. Another threat is if your employee defames rival companies or competitors on your organisation’s social media platform.

Cyberbullying

Cyberbullying is a reality and your organisation risks exposing itself to claims of harassment by employees if your organisation was aware of what was going on and especially if the line manager was participating in the offensive conversations. For example, if the line manager was linked to the person as a “friend” on Facebook.

Ownership of social media accounts

When an employee creates a social media account in your organisation’s name, it is highly likely that you will be able to obtain the name of the account from your employee. However, this might not be so simple where your competitor owns the social media account. This is what some of the major social media platforms have to say about ownership of a user account:

  • Facebook: In registration, you undertake not to “provide any false personal information on Facebook, or create an account for anyone other than yourself without permission” (clause 4.1 of the “Statement of Rights and Responsibilities”). If you select a username for your account, Facebook reserves the right to “remove or reclaim it” if “appropriate” to do so. For example, when a trademark owner complains about a username that does not closely relate to a user’s actual name (clause 4.10).
  • Twitter: Twitter reserves the right to “reclaim usernames” (under its terms of service). Further, in terms of the “Twitter rules” you are not entitled to “impersonate others” or “engage in username squatting”.
  • Linkedin: Under their User Agreement you agree not to violate any “trademark rights” (which means that if you register the account of a company which has a trademark, you are in violation of this clause).

These risks can most effectively be managed by developing a social media legal strategy, which may include getting a social media policy.

How we can help you