Surfing, Shopping and Blogging: Regulation of Employee Social Media Use Legal Issues in Higher Education University of Vermont October 17, 2011 Barbara A. Lee Rutgers University and Edwards Angell Palmer & Dodge, LLP Introduction Gilbert Gottfried, the voice of the Aflac duck, was dismissed after making disparaging comments about the earthquake and tsunami in Japan on his Twitter account. A waitress was fired for posting a critical comment about her restaurant employer on her Facebook page. Several public school teachers have been terminated for posting controversial pictures of themselves on their Facebook pages and then allowing their students (and their parents) to view the pictures. Other teachers have been disciplined or fired for complaining about their students on social media sites. And these events happened after work hours. A survey of employees found that 20 percent admitted to using social media for personal purposes during work hours. The reality is probably much higher, unless the employer blocks access to social media, as 25 percent of employers apparently have. 1 The U.S. Supreme Court recently ruled in a case in which police officers used their pagers to exchange sexually explicit messages with their girlfriends (but not their wives), saying that discipline for misuse of such 1 Jon Brodkin, One in four businesses block access to Facebook, social networking sites. Network World, July 8, 2008, available at http://www.networkworld.com/news/2008/071508-employees-social-networking.html. 1
equipment, supported by reading the text messages without the officers permission, did not violate the Fourth Amendment s prohibition of unreasonable searches. 2 Electronic communications and social media have an enormous impact on every aspect of a college s operations, from student recruitment to communication to students, faculty and staff to teaching and research. Legal problems can arise when employees use social media and electronic communications in ways that expose the college to potential litigation; other legal problems may occur when the college uses information gathered from social media or electronic communications to discipline, dismiss, or refuse to hire an employee. Several of these legal issues are discussed below. Social Media and Privacy Although e-mail and social media use has burgeoned in recent years, the law has not kept up with changes brought by technology. One major issue that can have legal implications is the employee s privacy rights, particularly if the employee works at a public college or university. The Fourth Amendment of the U.S. Constitution protects individuals from government seizure of property, which could include e-mail or other communications, without probable cause. Employees at both public and private colleges have a common law right of privacy in personal information. There are methods for reducing an employee s expectation of privacy, as well as for ensuring that claims of invasion of privacy are appropriately defended. The college should (and probably does) have an acceptable use policy that delineates how employees may use the employer s equipment (computers, handheld devices, etc.) and information systems (access to 2 City of Ontario v. Quon, 130 S. Ct. 2619 (2010). 2
the internet and e-mail). That policy should be reviewed by the college s counsel to make it clear that employees have no expectation of privacy in their communications that use the college s e-mail system or the college s computers or other hardware. It should also make it clear that, if employees use the college s internet system and/or computer equipment to access their personal e-mail account, the college s monitoring systems will pick up those communications and will store them as well. The acceptable use policy MUST be written in layperson s terms so that it is clear and understandable. A New Jersey company lost a lawsuit when the court ruled that its acceptable use policy did not sufficiently warn employees that the company could monitor their personal e- mail messages if company equipment or systems were used. In Stengart v. Loving Care Agency, 3 an employee used a company-owned laptop to communicate with her attorney on her personal e-mail account about her prospective discrimination lawsuit against the company. When she resigned and turned in the laptop, even though she had deleted messages from her personal e-mail account, the company s IT specialist was able to retrieve those messages. The court ruled that the language of the company s acceptable use policy, which said that messages using the company s media systems were subject to the company s policy, was insufficiently clear to provide notice to the employee that her messages could be retrieved. With respect to social media, anything that is posted on an individual s Facebook page is public information unless the poster specifies that only friends can access the information, and tweets on Twitter are also public information for anyone with a Twitter account. Even if information on an individual s Facebook page is limited to friends, those friends can share the private information with their own friends. In some cases, colleges ask applicants for 3 http://www.networkworld.com/news/2008/071508- employees- social- networking.html (N.J. 2010). 3
employment to provide their Facebook password so that they can view the page. This requirement, while not illegal in itself, could lead to legal problems if the applicant is not hired because of information on the Facebook page that is linked to race, gender, political affiliation, or a host of other matters that are not relevant to the applicant s qualifications for the position and are protected by law. On the other hand, employers who know that employees are misusing their computer and information systems may be liable for civil or criminal violations by their employees. In Doe v. XYC Corporation, 4 an employee was using the company s computer to create, upload and download child pornography, which is a felony. The supervisor and information technology director knew that he was visiting pornographic websites, but hesitated to discipline him because they mistakenly thought he had a right to privacy in his use of the company s computer. Company policy explicitly prohibited this type of misuse of the company s equipment and systems, and stated that employee use would be monitored. After police found pictures of child pornography in the company s trash, the employee was arrested and his wife sued the employer because the employee had been uploading pictures of her daughter onto child pornography sites using the company s computer and internet access. The court ruled that the company could be liable to the wife for negligence, saying an employer who is on notice that one of its employees is using a workplace computer to access pornography, possibly child pornography, has a duty to investigate the employee's activities and to take prompt and effective action to stop the unauthorized activity, lest it result in harm to innocent third-parties. No privacy interest of the employee stands in the way of this duty on the part of the employer. 4 887 A.2d 1156 (N.J. App. Div. 2005). 4
Acceptable use policies are essential to avoid invasion of privacy claims and to enable the college to respond appropriately to allegations of misuse. An interesting issue involves the use by faculty of college computer systems and e-mail programs. Employees of public colleges in states with open public records laws have, in some cases, found that their e-mails have been requested under these laws. Contrary to the belief of many faculty members, academic freedom may not protect faculty from this disclosure, unless there is a specific exemption in the open public records law for faculty work product (such as research results or unpublished manuscripts) or the college determines that it will not release communications deemed to be private. 5 Faculty at private colleges have greater protection, but e-mail and other communications could be required to be turned over if they are relevant to litigation against the college (or the faculty member). Finally, employees may inadvertently or deliberately disclose confidential information in e-mails or on social media sites, which could threaten a pending patent, violate the Family Educational Rights and Privacy Act, or disclose trade secrets. They may also post messages that are offensive on the basis of protected characteristics such as race, gender, sexual orientation, etc., leading to discrimination or harassment claims. They may blog about the college in a way that either demeans the college or its competitors a potential violation of the Federal Trade Commission regulations on fairness in business practices. They may demean other employees, students, or outsiders which could lead to defamation lawsuits. But employer use of social media can lead to litigation as well. 5 Sara Hebel, Wisconsin-Madison to Release Professor s E-Mails but Withhold Those Said to be Private. Chronicle of Higher Education, April 1, 2011, available at http://chronicle.com/article/wisconsin-madison-to- Release/126994/. 5
Using Social Media to Investigate Applicants According to the Equal Employment Opportunity Commission, 75 percent of corporate recruiters do online research to screen applicants, and 70 percent of recruiters have rejected candidates on the basis of online information. 6 Over one third had rejected an applicant based upon information found in social media. Applicants were rejected on the basis of provocative or inappropriate photographs, evidence of excessive drinking or drug use, criticism by the applicant of a current or former employer in social media postings, evidence of poor communication skills (grammar, spelling), discriminatory comments, evidence that the applicant lied about his or her qualifications, and the sharing of an employer s confidential information. Because of the potential for discrimination claims if employers use social media to screen applicants, some employers separate the responsibilities for screening from those for hiring. For example, the screener, whether it be a staff member or an external background checking service, can remove all references to race, age, gender, and other protected characteristics from the screening report. It is a best practice to keep a written record of the scrubbed screening information and a written rationale for the college s decision not to hire the individual. And having a written policy, on how screening will be done, and following it carefully, should help defend against litigation. If the college uses an outside vendor to perform part or all of the screening or background checks, it is also important to have the applicant sign a form allowing the check to be done, and given a statement of the applicant s rights, in compliance with the Fair Credit Reporting Act. 6 Jennifer Preston, Social Media History Becomes a New Job Hurdle. New York Times, July 21, 2011, B1, B4. 6
Social Media and Employee Discipline Social media can be helpful or harmful to a college s attempt to deal with employee misconduct or performance problems. The prevalence of social media means that employees might engage in prohibited conduct while away from work, but the effect of that conduct may disrupt the working relationships and, perhaps, create legal liability for the college. It is classic sexual harassment law that sexual harassment off work time or away from the workplace by a peer or supervisor that is a result of the work relationship can be a reason to discipline the harasser. The translation of this law to the use of social media to harass a peer or subordinate is not perfect, however. Since the medium of social media is primarily words (and to a lesser extent pictures, including videos), first amendment concerns may arise in public colleges and universities. The recent decision of the U.S. Supreme Court in Snyder v. Phelps, 7 in which the Court ruled that the first amendment protected offensive picketing at military funerals, suggests that some forms of verbal harassment, particularly if conducted away from work and not on work time, might be difficult to punish. On the other hand, the law treats electronicallygenerated speech pretty much the way it treats speech in general. Much would depend upon to whom the speech was directed, the nature of the relationship between the poster and the target (supervisor? peer? member of the public?) and the effect on the efficient operation of the college. Employees who disclose confidential information on social networking sites may be disciplined if the same actions would ordinarily be grounds for discipline. For example, a faculty member who displayed a picture of students without their permission on a Facebook page, or who discussed students by name in a blog, or even who referred to a student in a way 7 131 S. Ct. 1297 (2011). 7
that made the student personally identifiable (such as complaining about the starting quarterback) in a tweet could potentially be disciplined. Those who discuss confidential research projects, violate confidentiality requirements during searches, or defame their colleagues (or students) could also potentially be disciplined particularly, in public institutions, if the message were not a matter of public concern. But there are exceptions. Recently the National Labor Relations Board (NLRB), which regulates collective bargaining in the private sector, issued a complaint against a company (not a college) that had dismissed an employee who complained about her supervisor on her Facebook page. The NLRB asserted that the employee had been engaging in protected concerted activity under Section 7 of the National Labor Relations Act, particularly because co-workers responded to her posting and she subsequently posted additional criticisms of both him and the company. The NLRB s general counsel commented: This is a fairly straightforward case under the National Labor Relations Act whether it takes place on Facebook or at the water cooler, it was employees talking jointly about working conditions, in this case about their supervisor, and they have a right to do that. 8 The case was later settled. But individual employee grievances are not protected under Section 7, and discipline for that type of comment on social media would not violate the law. Comments that disparage clients (or students) would typically not be protected under Section 7, or under a public employee collective bargaining law with a similar provision. And in Pietrylo v. Hillstone Restaurant Group, 9 employees accused the company of violating the federal Stored Communications Act, which prohibits disclosure of personal 8 Steven Greenhouse, Labor Board Says Rights Apply on Net, New York Times, November 9, 2010. 9 2008 U.S. Dist. LEXIS 108834 (D.N.J. 2008). 8
electronic messages without permission of the sender of the message, as well as invasion of privacy and wrongful discharge. Two wait staff at one of the company s restaurants began a MySpace group for employees to vent about any BS we deal with at work. The chat group included profanity toward company managers and sexual remarks. A member of the chat group informed a manager of the website and showed him the page. Another manager asked that employee for the password to the chat group; she provided it, but claimed in the litigation that she had felt coerced to do so. The managers fired the employees who had created the webpage. The company moved for summary judgment, but the trial court granted the motion only on the wrongful discharge claim, leaving the claims concerning the Stored Communications Act and the invasion for a jury to determine. A jury found that the company had violated the Stored Communications Act because the individual who provided the password did not do it voluntarily. 10 Social media are used by employers to investigate other types of employee misconduct. For example, the Family and Medical Leave Act protects only those employees with a serious health condition (or family leave responsibilities) that prevent the employee from working fulltime. Employers may discipline or dismiss employees whose Facebook postings or tweets indicate that they have gone on vacation, taken a second job, or otherwise behaved in ways inconsistent with their claim that they cannot work because of health problems or their family responsibilities. Employees who cannot work because of a job-related injury may receive worker s compensation benefits. Although stories are legion about video monitoring of employees who, 10 Employees may also be found liable for violations of the Stored Communications Act or the Electronic Communications Privacy Act. See, for example, United States v. Szymuszkiewicz, 622 F.3d 701 (7 th Cir. 2010)(employee forwarded supervisor s email to his email account without her permission). 9
while on worker s compensation, are repairing their roof or shoveling snow, Facebook postings or tweets may be a simpler way to ascertain whether an employee receiving worker s compensation benefits is actually deserving of them. Similarly, an employee who has been accommodated for a disability, and whose postings, blogging, or tweets indicate that the disability is either nonexistent or less serious than reported, may be a candidate for discipline or dismissal. Although not an employment case, one particularly interesting example of an employee caught in a lie via her Facebook page occurred during a products liability case against Steelcase, a manufacturer of office furniture. Kathleen Romano sued Steelcase in a products liability claim after she fell from her office chair. She claimed that she had serious back and neck injuries, pain, and progressive loss of enjoyment of her life. Steelcase located her Facebook and My Space pages online, and asked for access to the private portions of these websites. She refused, and the defendant, Steelcase, subpoenaed that information. The defendant noted that Ms. Romano had posted pictures of herself outside her home, smiling, which contradicted her claim that she spent much of her time in bed. Her daughter s Facebook page indicated that the family had recently travelled to Florida, contradicting the plaintiff s assertion that she could not travel as a result of the injury. The judge granted the motion to disclose the private portions of the plaintiff s social media pages. Strategies for Minimizing Liability and Problems Although social media is seemingly ubiquitous, the law related to social media is still developing. Good policies that are carefully followed are essential to avoid litigation and ensuing liability. Thoughtful use and referral to social media are also critical. When to have a 10
thick skin and when to pursue violations of a college s acceptable use and social media policies are judgment calls, not legal principles. But the following suggestions may help: Develop a policy on social networks For college-sponsored pages/websites For employee s use of social media At work On nonwork time (especially for managers and supervisors) Specify whether employees are permitted to use college equipment and internet access for personal purposes (acceptable use policy); if you plan to monitor their use of college equipment and internet access, say so. State clearly that employees have no right of privacy in communications that use the company s equipment or data systems, including internet access. This includes the use of the company s internet access from a personally-owned computer or other device (e.g. BlackBerry or iphone). Have them sign a copy of the policy. Develop an internal policy for recruiters or hiring authorities re: what kind of information will be reviewed on social networks; ensure that only job-related information is used. Monitor the college s social media pages for examples of harassment of fellow employees, misuse of confidential college information, etc. Respond promptly to complaints by employees of harassing or defamatory material on personal social media sites. In such cases, evaluate when the posting was done, at what time, what the relationship is between the parties (Work? Personal?) 11
Use caution when considering discipline of an employee for posting content on a personal social network site if done on non-work time. Be careful to draw a strong relationship between the alleged misconduct and the business interests of the college. Train employees, and especially supervisors, on the college s social media policy. Ensure that managers understand that monitoring employee adherence to the policy is part of their job. 12