Social media governance

Transcription

1 Social media governance A guide for in-house counsel

2 Contents 1 Introduction 2 2 Background The facts Challenges of social media Attitudes to social media The role for legal 5 3 Social media crises Introduction Causes of crisis What brands can lack in a crisis Tips to avoid a crisis 9 4 Planning for governance Understand the social media matrix Objectives Plan a roadmap 11 5 Social media governance: tips for in-house counsel Introduction Get the attention of the business Engage with the stakeholders Plan for the worst, aim for the best Is this the best time to decide on your crisis management strategy? Develop a roadmap Use the right resources Be aware of the contractual and regulatory landscape 15 6 Kemp Little s social media team 16 Schedule 1: Template employee social media policy 18 Schedule 2: Checklists 25 Social media governance 1

3 1 Introduction As the use of social media by businesses becomes essential, improving social media governance is a key objective for many firms. There is no one size fits all answer; businesses are tackling this issue in a range of ways. Although social media involves legal issues, its evolution and management within a business is often driven by opportunity rather than risk. This can leave in-house counsel fielding the consequences of decisions rather than making them. Yet in our experience, in-house counsel are key to successful social media governance. This guide is intended for in-house counsel whose role encompasses any aspect of social media governance, or who feels that it ought to. It may aid your discussions with the business regarding the opportunities and risks presented by social media. We hope you find this helpful and welcome your feedback. Kemp Little LLP Social media governance 2

4 2 Background 2.1 The facts Social media is here to stay Social networking sites now reach 82% of the world s online population, representing 1.2 billion users around the world Nearly one in every five minutes spent online is now spent on social networking sites Major brands are engaged A large number of B2C brands have built strong communities e.g. Coca-Cola, Starbucks, Playstation, Nutella all have over 25M global fans on Facebook Increasing numbers of B2B businesses are engaging There is now an expectation that businesses will have a social media presence. You can t afford to get this wrong Social media governance is rapidly becoming a priority for businesses this will be happening already, even if on an informal basis By ensuring your company is properly managing its engagement, it can maximise opportunities and minimise risk A social media crisis can rapidly get out of control it is vital to plan ahead 2.2 Challenges of social media Enterprise use of social media is in its infancy, and many businesses are unsure of how to manage this channel internally The use of social media and the issues it raises touches so many parts of the business. There may be differences of opinion within the business about what areas are a priority, and how to deal with them Legal, liability and risk can be marginalised in fear of limitations being imposed Crisis management can be reactive, not anticipatory The following table illustrates a number of multi-layered and interconnected factors, all of which are relevant to social media governance. It can feel difficult to tackle and control these factors, which is why planning is essential Social media governance 3

5 Table 1: Factors relating to enterprise use of social media 2.3 Attitudes to social media People within your business will have a range of attitudes to social media Effective social media governance needs to take these into account Harvard Business Review 1 analysed the range of business leader attitudes and classified them into six categories: Folly: Fearful: Social media considered to be a source of entertainment with little or no business value. Where this attitude prevails, advocates should emphasise direct business value tied to established goals for the organisation. Social media seen as a threat to productivity and intellectual capital, privacy, authority, compliance and many other areas. The approach here may be to at least discourage and at most prohibit use of social media. Advocates in such an organisation must focus on low-risk initiatives (even if the higher risk opportunities offer greater value). 1 See for the Harvard Business Review blog post by Anthony J Bradley and Mark P McDonald, authors of The Social Organization, How to Use Social Media to Tap the Collective Genius of Your Customers and Employees Social media governance 4

6 Flippant: Formulating: Forging: Fusing: Social media not taken seriously. Characterised by a technologycentric approach where it is hoped business value will simply emerge. This is not usually successful. The suggested approach here is to identify how the social media technology can be used to deliver value to the community and the company. Social media is seen as a source of potential value. There is an understanding of the need to be strategic. Build on this positive attitude and emphasise the broader strategic value across the business, to grab the attention of business leaders. Where this attitude prevails, the majority of the company is developing social media competence and it is assembling, nurturing and gaining business value from communities. Suggestions to optimise this approach are to recognise successes, advocate continued evolution and to maintain grassroots social media efforts. This is still the relatively rare and most advanced approach to social media. It results in community collaboration being treated as an integral part of the business and being ingrained in how people think and work. The Harvard Business team classified this as a description of the truly social organisation. 2.4 The role for legal Social media activity often has legal implications, but the connection is not always made at the appropriate time Engaging with the business shouldn t mean being the last port of call Education is key assist the business to understand the legal flipside to the decisions they make Social media governance 5

7 Table 2: The relationship between business and legal aspects of social media Social media governance 6

8 3 Social media crises 3.1 Introduction The huge benefit of social media is also its greatest risk factor: direct communication between large and flexible communities. When something goes wrong for a brand, social media usually accelerates the issues generated. This is now affectionately known as a social media crisis The risk for business is real. A simple Google search will reveal many varying examples of social media crises which have impacted on share price, brand value and consumer behaviour 3.2 Causes of crisis We reviewed a huge range of different crises and distilled the causes into three categories, each with different elements: Deliberate attacks from third parties - Campaign groups for some reason a campaign is initiated against your brand, often for breach of their ethical principles e.g. Greenpeace vs Nestle, PETA vs DKNY - Disaffected employees there are many examples on YouTube of employees venting spleen. A notable example from an ex Google employee went viral last year - Hacking there are those who take delight in gaining unauthorised access to a brand s account. Fox News suffered with this in 2011 when it suddenly started posting reports of Obama s assassination Mistakes by the company itself Life - Posting errors confusing a company account for a corporate account or someone without suitable authority taking over an account in good faith. - Lack of due diligence failure to check social networks for use of proposed brand names. - Crassness, bad taste, being unfunny the mass social media community can be a rather ethical place when it comes to brands in particular. Any lack of taste, crass or inappropriate posting is likely to be pounced upon. See Kenneth Cole s odd apparent trivialisation of the Egypt uprising. - Natural disasters (or rumours of one) ever since the Hudson River crash (news and pictures of which first broke on Twitter), we accept that major Social media governance 7

9 disaster events may break on social networks. Dealing with false rumours can be just as important. Qantas found this out when a piece of fuselage was found on the ground. Reports of a massive air crash went viral and the share price started to fall. In fact there had been no accident and the social media crisis response was required to effectively quash the rumours. - Brand issues: any brand can experience an issue e.g. a product recall, a service breakdown etc. There is now very much an expectation from the community to address any such issue on social media networks. 3.3 What brands can lack in a crisis For the report, entitled Social Business Readiness: How Advanced Companies Prepare Internally, Altimeter Group analysed 50 social media crises that have occurred since 2001 and found that those reaching mainstream media have risen steadily through the past decade, with just one-two incidents per year in the first five years and a total of 10 social media crises last year alone. The report also sheds light on exactly how social media crises arise and how companies can avoid them In a report, Altimeter Group analysed 50 worldwide social media crises since Not surprisingly there has been a steady increase through the decade. Some common themes emerged for the elements lacking within these organisations, summarised as: Table 3: Internal requirements lacked by companies which experienced a social media crisis ( ) Social media governance 8

10 3.4 Tips to avoid a crisis Social media policy: for all employees within a business Education programme: make the policy real and ensure everyone is aware of it. Anyone on a social network who states who they work for is in some way representing the brand Legal audit: keep a check on the platform terms and associated contracts e.g. with agencies, community managers, moderators etc. Strategy: know what the social media programme for the business is designed to achieve and ensure the engagement with the community is present Security: passwords and access to be controlled to avoid hacking, inappropriate posting and ensuring access to accounts in a crisis Moderation: keep your community safe and manage any risks before they have chance to go viral Escalation procedure: ensure all relevant individuals know who to escalate a crisis to and how Crisis rehearsal: make sure the system and the proposed responses work Social media governance 9

11 4 Planning for governance 4.1 Understand the social media matrix A social media matrix aims to identify which areas of the business have a particular interest in social media, and some of the issues relating to them By identifying the components of your business matrix, you focus on addressing areas which present the greatest risk Table 4: A social media matrix 4.2 Objectives The aim of social media governance is to enable you to manage social media risk in a structured, disciplined and effective way Social media governance can also empower the business to use social media channels more effectively and with confidence Social media governance 10

12 Think about which aspects of the social media matrix are particularly relevant to your business, and develop tailored objectives in relation to these Below are some examples of issues to assist you with your planning Table 5: Examples of objectives for social media governance 4.3 Plan a roadmap Social media governance cannot be achieved overnight Use the information you have gained to plan your roadmap to governance Remember to continue to engage with stakeholders throughout Think about: Social media governance 11

13 Audit Policy Remediation Education Monitoring Review Understand what your business is currently doing in relation to social media, by identifying what accounts have been set up, and who controls them (the audit checklist which can be found on page 25 might help you) Draw up a policy about how your company uses social media for business purposes (you should also think about informing your employees about their use of social media; the template employee social media policy on page 18 is relevant to this exercise) If there are aspects of your business social media use which need remedying, address these points Communicate your activities and your social media policies to the business Monitor for developments; social media is an area which never stands still, and policies may need to be revised in light of new platforms or practices Schedule a periodic review (every six months perhaps) in which you revisit your social media governance practices. This could include repeating the audit phase at regular intervals Table 6: Roadmap for social media governance Social media governance 12

14 5 Social media governance: tips for in-house counsel The basis of our partnership strategy and our partnership approach: we build the social technology. They provide the music. - Mark Zuckerberg 5.1 Introduction Corporate use of social media has rapidly become commonplace across most industries, proving there is no shortage of companies willing to provide the soundtrack to Zuckerberg s vision. Nor is it limited to the global consumer brands; from sewerage treatment companies to funeral homes, businesses are flocking to Facebook and other social media platforms. Yet in the flurry to establish themselves as influencers online and engage directly with their customers, businesses often neglect the question of social media governance. Planning and implementing a governance strategy is important to ensure a cohesive approach across the business, identify risks and take steps to minimise them, and to manage crisis situations. What we are seeing is that this aspect is often overlooked because the evolution and management of social media within a business can be driven by opportunity rather than risk. This can leave in-house counsel fielding the consequences of decisions rather than making them. Yet in our experience, the in-house counsel has a role to play in effective social media governance and can help protect their company as it socialises its brand, without diminishing the opportunity. We outline some tips for in-house counsel regarding social media governance. These should assist you to identify and communicate your role in your business social media strategy. 5.2 Get the attention of the business A common theme we are hearing is that the business does not see social media as an area that requires legal input. The use of social media by businesses is still in its infancy, relative to other sales and communication channels. Yet there are already examples of where companies have made catastrophic mistakes. Despite this, many companies still hold the view that it won t happen to us. Although scare tactics can seem unsophisticated, using examples of where others have gone wrong can be an effective way to capture the attention of the business. The goal in doing so is to illustrate where the risks lie in poorly-thought out social media strategies. Social media governance 13

15 Remember: Social Media is like sky-diving the fact that risk exists is not a reason not to do it, but it is sensible to take precautions. 5.3 Engage with the stakeholders By its very nature, social media is a game of many players and is relevant to many aspects of a business including marketing, legal, HR and IT. No one needs to be left out of the conversation and everyone has something to contribute. If in-house counsel can help to facilitate discussion between these stakeholders, a company s social media strategy is likely to be more cohesive. Remember: many parts of the business may feel they have a vested interest in social media the company s strategy should reflect the objectives of these stakeholders. 5.4 Plan for the worst, aim for the best Picture this: You re in-house counsel for a food manufacturer. It is 9pm on a Friday night and your phone rings; it is a colleague telling you that they have seen a conversation on Twitter which alleges that your most successful product contains a harmful substance. The message has been re-tweeted extensively and someone has started a #hate conversation about your company. 5.5 Is this the best time to decide on your crisis management strategy? Planning for a crisis does not need to be complicated, but you need to ensure that it is done in advance. Simple details like ensuring there is a list of contact names and responsibilities and a decision-making matrix, as well as access to the relevant administration account and password, can help to contain an incident. This is particularly important if you outsource the generation or moderation of your content to an agency or other third party; they need to know exactly who to call and when. Your contract with them also needs to specify clearly where the obligations lie in such a situation. Remember: a social media crisis can rapidly get out of control it is vital to plan ahead. 5.6 Develop a roadmap Social media governance is an evolutionary process. Initially, your focus may be on information-gathering and centralising control of accounts and passwords, implementing broad guidelines and defining responsibilities. Further down the line, education and moderation will become more of a priority. Social media governance 14

16 Plan your roadmap to governance and communicate it to the business. By demonstrating the steps involved, senior management can gain an understanding that social media governance is an on-going process. Remember: social media governance is a tool to minimise risk, but also to communicate the benefits of social media across the business. The steps on your roadmap should seek to achieve both objectives. 5.7 Use the right resources Think about what can be achieved internally. For example, do you have sufficient head count to ensure that content is being produced and moderated appropriately? In some cases, engaging a suitably qualified external agency to assist your company to produce, manage and moderate content, may be a cost-effective and advantageous option. For example, you may be able to structure the contractual arrangement to pass risk regarding IPR infringements and other liability onto the agency. Remember: inaccurate or defamatory social media content can prove catastrophic; if you are outsourcing the generation and moderation of your social media content, make sure obligations are clearly defined and the party you are using is sufficiently experienced to manage the task. 5.8 Be aware of the contractual and regulatory landscape Social media is an area abundant in contract and privacy terms. As with any other third party contracts, the in-house lawyer should be involved in the review and acceptance of these. Examples can include: Terms and conditions relating to social media platforms themselves (Facebook, Twitter, etc ) If you use technology platforms for consolidating and managing content, agreements in place with the supplier/s Contract/s with moderation agencies Terms relating to use of Community Managers These tips were first published in our KL Bytes newsletter. Other historic editions of our newsletters can be found on our website: Social media governance 15

17 6 Kemp Little s social media team Our team works alongside social media providers and users in relation to the commercial, privacy, data, advertising, intellectual property, employment and corporate issues that arise in this dynamic sector. Our experience in this area includes: Brand protection Digital content Employment - Social media policies - Taking action against employees for inappropriate use of social media - Monitoring employees social media usage - Social media and discrimination issues - The relationship between social media sites and restrictive covenants Social media governance 16

18 Software development, production, implementation and support Privacy (cookies, personal data opt-in, informed consent and international data transfers) Advertising and marketing use regulation and policy Rights in data (particularly with regard to analytics) Third party providers - Agreements relating to social media marketing and moderation services - Terms and conditions with social media platform providers - Arrangements with analysis partners Reputation management defamation, PR, escalation Further information about our expertise and links to past events and materials can be found on our website, Social media governance 17

19 Schedule 1: Template employee social media policy How to use this policy The policy below would typically be included in a staff handbook or on the company intranet. Employees attention should be drawn to the policy regularly and training should be given both as part of any induction process but also at regular intervals during employment. It should be used in conjunction with the company s disciplinary policy in the event that employees are found to have been misusing social media. Policy Contents 1 Policy Statement 2 Who is covered by the policy? 3 Scope and purpose of the policy 4 Personnel responsible for implementing the policy 5 Compliance with related policies and agreements 6 Personal use of social media 7 Monitoring 8 Business use of social media 9 Recruitment 10 Responsible use of social media 11 Monitoring and review of this policy Social media governance 18

20 POLICY STATEMENT We recognise that the internet provides unique opportunities to participate in interactive discussions and share information on particular topics using a wide variety of social media, such as Facebook, Twitter, blogs and wikis. However, employees' use of social media can pose risks to our confidential and proprietary information, and reputation, and can jeopardise our compliance with legal obligations. To minimise these risks, to avoid loss of productivity and to ensure that our IT resources and communications systems are used only for appropriate business purposes, we expect employees to adhere to this policy. This policy does not form part of any employee's contract of employment and it may be amended at any time. WHO IS COVERED BY THE POLICY? This policy covers all individuals working at all levels and grades, including senior managers, officers, directors, employees, consultants, contractors, trainees, homeworkers, part-time and fixed-term employees, casual and agency staff [and volunteers] (collectively referred to as staff in this policy). Third parties who have access to our electronic communication systems and equipment are also required to comply with this policy. SCOPE AND PURPOSE OF THE POLICY This policy deals with the use of all forms of social media, including Facebook, LinkedIn, Twitter, Wikipedia, all other social networking sites, and all other internet postings, including blogs. It applies to the use of social media for both business and personal purposes, whether during office hours or otherwise. The policy applies regardless of whether the social media is accessed using our IT facilities and equipment or equipment belonging to members of staff. Breach of this policy may result in disciplinary action up to and including dismissal. Disciplinary action may be taken regardless of whether the breach is committed during working hours, and regardless of whether our equipment or facilities are used for the purpose of committing the breach. Any member of staff suspected of committing a breach of this policy will be required to co-operate with our investigation, which may involve handing over relevant passwords and login details. Staff may be required to remove internet postings which are deemed to constitute a breach of this policy. Failure to comply with such a request may in itself result in disciplinary action. Social media governance 19

21 PERSONNEL RESPONSIBLE FOR IMPLEMENTING THE POLICY [Our board of directors (the board) OR [COMMITTEE] OR [POSITION]] has overall responsibility for the effective operation of this policy, but has delegated day-to-day responsibility for its operation to [the Head of the IT Department OR [POSITION]]. Responsibility for monitoring and reviewing the operation of this policy and making recommendations for change to minimise risks also lies with [the Head of the IT Department OR [POSITION]]. All managers have a specific responsibility for operating within the boundaries of this policy, ensuring that all staff understand the standards of behaviour expected of them and taking action when behaviour falls below its requirements. [Managers will be given training in order to do this.] All staff are responsible for the success of this policy and should ensure that they take the time to read and understand it. Any misuse of social media should be reported to [the Head of the IT Department OR [POSITION]]. Questions regarding the content or application of this policy should be directed to [the Head of the IT Department OR [POSITION]]. COMPLIANCE WITH RELATED POLICIES AND AGREEMENTS Social media should never be used in a way that breaches any of our other policies. If an internet post would breach any of our policies in another forum, it will also breach them in an online forum. For example, employees are prohibited from using social media to: [breach our Electronic information and communications systems policy;] [breach our obligations with respect to the rules of relevant regulatory bodies;] breach any obligations they may have relating to confidentiality; [breach our Disciplinary Rules;] defame or disparage the organisation or its affiliates, customers, clients, business partners, suppliers, vendors or other stakeholders; [harass or bully other staff in any way OR breach our anti-harassment and bullying policy]; [unlawfully discriminate against other staff or third parties OR breach our equal opportunities policy]; breach our data protection policy (for example, never disclose personal information about a colleague online); Social media governance 20

22 breach any other laws or ethical standards (for example, never use social media in a false or misleading way, such as by claiming to be someone other than yourself or by making misleading statements). Staff should never provide references for other individuals on social or professional networking sites, as such references, positive and negative, can be attributed to the organisation and create legal liability for both the author of the reference and the organisation. Employees who breach any of the above policies will be subject to disciplinary action up to and including termination of employment. PERSONAL USE OF SOCIAL MEDIA [Personal use of social media is never permitted during working time or by means of our computers, networks and other IT resources and communications systems.] OR [We recognise that employees may work long hours and occasionally may desire to use social media for personal activities at the office or by means of our computers, networks and other IT resources and communications systems. We authorise such occasional use so long as it does not involve unprofessional or inappropriate content and does not interfere with your employment responsibilities or productivity. While using social media at work, circulating chain letters or other spam is never permitted. Circulating or posting commercial, personal, religious or political solicitations, or promotion of outside organisations unrelated to the organisation's business are also prohibited.] MONITORING The contents of our IT resources and communications systems are our property. Therefore, staff should have no expectation of privacy in any message, files, data, document, facsimile, telephone conversation, social media post conversation or message, or any other kind of information or communications transmitted to, received or printed from, or stored or recorded on our electronic information and communications systems. We reserve the right to monitor, intercept and review, without further notice, staff activities using our IT resources and communications systems, including but not limited to social media postings and activities, to ensure that our rules are being complied with and for legitimate business purposes and you consent to such monitoring by [your acknowledgement of this policy and] your use of such resources and systems. This might include, without limitation, the monitoring, interception, accessing, recording, disclosing, inspecting, reviewing, retrieving and printing of transactions, messages, communications, postings, log-ins, recordings and other Social media governance 21

23 uses of the systems as well as keystroke capturing and other network monitoring technologies. We may store copies of such data or communications for a period of time after they are created, and may delete such copies from time to time without notice. Do not use our IT resources and communications systems for any matter that you wish to be kept private or confidential from the organisation. [For further information, please refer to our [Electronic information and communications systems policy].] BUSINESS USE OF SOCIAL MEDIA If your duties require you to speak on behalf of the organisation in a social media environment, you must still seek approval for such communication from [your manager OR [DEPARTMENT NAME]], who may require you to undergo training before you do so and impose certain requirements and restrictions with regard to your activities. Likewise, if you are contacted for comments about the organisation for publication anywhere, including in any social media outlet, direct the inquiry to [DEPARTMENT NAME] and do not respond without written approval. The use of social media for business purposes is subject to the remainder of this policy.] RECRUITMENT We may use internet searches to perform due diligence on candidates in the course of recruitment. Where we do this, we will act in accordance with our data protection and equal opportunities obligations. OR We do not permit the use of internet searches for recruitment purposes. RESPONSIBLE USE OF SOCIAL MEDIA The following sections of the policy provide staff with common-sense guidelines and recommendations for using social media responsibly and safely. Protecting our business reputation: Staff must not post disparaging or defamatory statements about: - our organisation; - our clients; Social media governance 22

24 - suppliers and vendors; and - other affiliates and stakeholders, but staff should also avoid social media communications that might be misconstrued in a way that could damage our business reputation, even indirectly. Staff should make it clear in social media postings that they are speaking on their own behalf. Write in the first person and use a personal address when communicating via social media. Staff are personally responsible for what they communicate in social media. Remember that what you publish might be available to be read by the masses (including the organisation itself, future employers and social acquaintances) for a long time. Keep this in mind before you post content. If you disclose your affiliation as an employee of our organisation, you must also state that your views do not represent those of your employer. For example, you could state, "the views in this posting do not represent the views of my employer". You should also ensure that your profile and any content you post are consistent with the professional image you present to clients and colleagues. Avoid posting comments about sensitive business-related topics, such as our performance. Even if you make it clear that your views on such topics do not represent those of the organisation, your comments could still damage our reputation. If you are uncertain or concerned about the appropriateness of any statement or posting, refrain from making the communication until you discuss it with [your manager OR [DEPARTMENT NAME]]. If you see content in social media that disparages or reflects poorly on our organisation or our stakeholders, you should contact [your manager OR [DEPARTMENT NAME]]. All staff are responsible for protecting our business reputation. RESPECTING INTELLECTUAL PROPERTY AND CONFIDENTIAL INFORMATION Staff should not do anything to jeopardise our valuable trade secrets and other confidential information and intellectual property through the use of social media. In addition, staff should avoid misappropriating or infringing the intellectual property of other companies and individuals, which can create liability for the organisation, as well as the individual author. Do not use our logos, brand names, slogans or other trademarks, or post any of our confidential or proprietary information without prior written permission. Social media governance 23

25 [To protect yourself and the organisation against liability for copyright infringement, where appropriate, reference sources of particular information you post or upload and cite them accurately. If you have any questions about whether a particular post or upload might violate anyone's copyright or trade mark, ask [the legal department OR [POSITION]] before making the communication.] [You are not permitted to add business contacts made during the course of your employment to personal social networking accounts, such as Facebook accounts or LinkedIn accounts. OR The contact details of business contacts made during the course of your employment are regarded as our confidential information, and as such you will be required to delete all such details from your personal social networking accounts, such as Facebook accounts or LinkedIn accounts, on termination of employment.] RESPECTING COLLEAGUES, CLIENTS, PARTNERS AND SUPPLIERS Do not post anything that your colleagues or our customers, clients, business partners, suppliers, vendors or other stakeholders would find offensive, including discriminatory comments, insults or obscenity. Do not post anything related to your colleagues or our customers, clients, business partners, suppliers, vendors or other stakeholders without their written permission. MONITORING AND REVIEW OF THIS POLICY [The Head of the IT Department OR [POSITION]] [in conjunction with the [[COMMITTEE] AND/OR board]] shall be responsible for reviewing this policy [FREQUENCY] to ensure that it meets legal requirements and reflects best practice. [[The Head of the IT Department OR [POSITION]] has responsibility for ensuring that any person who may be involved with administration or investigations carried out under this policy receives regular and appropriate training to assist them with these duties.] Staff are invited to comment on this policy and suggest ways in which it might be improved by contacting [POSITION]. Social media governance 24

26 Schedule 2: Checklists Audit checklist Action Done? What social media accounts are in use? - By which parts of the business? - Who holds the logins and passwords? - Who authorised the creation of the accounts? - Who is contributing to these accounts? Are accounts being moderated? - In-house? - By an external company? - What moderation guidelines are being applied? Contracts audit for any third parties creating and disseminating content (compliance provisions in particular) Contracts audit for platforms check for intellectual property or other issues (especially compliance as a corporate user) Data Action Done? What data is collected in connection with your social media accounts? - Facebook page - Facebook applications Social media governance 25

27 - Facebook Connect - Twitter API - Other Who holds copies of this data? What is the data being used for? Has the data been combined with your internal CRM system? Is your use of data in accordance with the Platform s Terms & Conditions? Have you passed data on to third parties? Crisis management Action Done? What would constitute a crisis for your business? Do you know how to recognise that a crisis is occurring/has occurred? Have you prepared a crisis escalation process identifying individuals, responsibilities, 24 hour contact details and deputies? Do the relevant individuals have access to and know about the crisis escalation process? Do you know what to do if a crisis escalates beyond your control? Are you aware of the security aspects to your social media accounts, and your options should hacking (or some other breach of IT security) occur? Brand management Action Done? Social media governance 26

28 Is your branding being used consistently in relation to your accounts? - Account names - Logos/profile pictures - Business units Have your brand guidelines been updated to cover social media activities? Have you satisfied yourself that no third party branding is being used on your accounts, or if it is being used, it is not infringing on that party s rights? Have you checked for any conflict between your use of social media and any applicable trade mark or other intellectual property licences? Employee use of social media Action Done? Do you have a social media policy, setting out the company s expectations of employees? Do you draw the policy to employees attention regularly? Have you trained staff on the appropriate use of social media (including training human resources (or other staff) on effective monitoring and enforcement of the company s policy)? Does your standard contract of employment contain: - Terms preventing disparagement of the company/its clients/customers - Terms restricting the use of confidential and proprietary information - Adequate post-termination restrictive covenants Social media governance 27