Social media in the workplace: What do employers need to know?
With the continual advent of new forms of social media, employers need to stay on top of their game to try to prevent misuse of social media by employees. The increasing popularity of social media app "BeReal" has recently been under the spotlight. BeReal is an app which invites users to share photos with their friends at a particular time each day. Every day at a different time users are notified simultaneously to capture and share a photo within two minutes. The premise is that friends share "real" photos of their lives in real time, intended to be an antidote to much of the filtered, choreographed, "fake" pictures on other forms of social media.
So, why is this a workplace issue? Quite simply, if individuals take photos of themselves at work, with computer screens in the background or papers on their desk they may inadvertently be sharing confidential information. In this alert we consider the top tips for employers to deal with this risk from an employment law perspective.
What should employers do to help protect their business against misuse of social media?
Social media policies
The first step is ensuring that the company has a robust social media policy in place. Ideally this should set clear guidelines about employees' use of social media both inside and outside the workplace. This should include:
- awareness of company reputation and not posting anything that may bring the company into disrepute, this extends to use of private social media accounts and any content which could cause potential reputational damage to the company;
- protection of company confidential information, intellectual property assets and privileged information;
- protection of third-party confidentiality and privacy;
- appropriate use of company resources and guidelines on using social media during working hours;
- guidance on what is appropriate use of social media including prohibition on harassment, bullying, discrimination; and
- consideration of how the social media policy interacts with other policies, such as disciplinary, internet usage and equal opportunity policies.
Education and training
Employers should also provide education and training to their workforces on such policies to ensure the policies do not simply gather dust but are actively understood and used. This includes educating employees about the risks associated with disclosing or misusing the company's confidential information – such as by inadvertently including it in a photo posted on BeReal or other social media account. It will also be worth reminding employees that confidential information isn't just the "top secret" company affairs but can be construed rather broadly. The same can be said about "personal data" and what may constitute a breach of data protection obligations.
Employees will have an implied term of confidentiality during the employment relationship, which will often be bolstered by express contractual confidentiality provisions in an employment contract. Disclosure of confidential information by employees on social media, would result in a breach of confidentiality obligations which can cause serious damage to businesses and result in disciplinary sanctions for employees. It's worth adding that disclosure of third-party information may also mean the company is in breach of its confidentiality obligations and data protection obligations with respect to a third party.
What action can employers take against employees if they accidentally disclose confidential information?
Disclosure of company confidential information on social media needs to be dealt with promptly and seriously. The social media policy may set out the consequences of any such action or refer to the company disciplinary policy. Such a disciplinary process is likely to involve: preliminary disciplinary meeting with the employee to gather information about what has happened; carrying out any necessary investigation; allowing the employee the chance to put their side of the story across at a disciplinary hearing; and deciding on an appropriate disciplinary sanction (e.g. anything from a verbal warning up to dismissal depending on the specific facts and circumstances).
In regulated sectors employers may also need to report the incident to their regulator and be prepared to show the protections they have in place and how they will prevent it happening again. If the inadvertent disclosure of confidential information is also a data breach, employers will need to take the necessary steps to deal with such data protection implications.
Takeaway for employers
As social media apps continue to be launched, it's worth revisiting and reviewing social media policies, so they remain current as well as rolling out refresher training to ensure the workforce is up to speed with the risks and best practice guidelines. In this article we've focused on the employment law implications, but our specialist data privacy team can assist you with any queries in relation to possible data protection implications.
If you have any questions on the topic covered in this alert or on any other employment law issue please contact Paul Reeves, Leanne Raven or your usual Stephenson Harwood contact.
