Data Privacy Monitor - Commentary on Data Privacy, Security and Social Media Subjects

Co-authored by: Jonathan Nowakowski

Recognizing the reality that many investors likely get more information from Facebook and Twitter than a corporate 10-K and that most public companies have a robust social media presence, the U.S. Securities and Exchange Commission (“SEC”) recently weighed in on the use of social media by public companies to disclose material nonpublic information to the general public. The SEC’s guidance was prompted by its investigation of Netflix and its CEO Reed Hastings, specifically Hastings’ post of material nonpublic information on his personal Facebook page in July 2012 concerning Netflix monthly viewing numbers. In its April 2, 2013, report and investigation of whether the post violated the SEC’s corporate disclosure rules and regulations (“April Netflix Report”), the SEC decided not to pursue an enforcement action against Netflix or Hastings and used the incident as an important teaching moment for public companies that may want to use social media to communicate material nonpublic information.

On July 3, 2012, Hastings posted the following message to his personal Facebook page with over 200,000 followers:

“Congrats to Ted Sarados, and his amazing content licensing team. Netflix monthly viewing exceeded 1 billion hours for the first time ever in June. When House of Cards and Arrested Development debut, we’ll blow those records away. Keep going, Ted, we need even more!”

While the congratulatory post may have seemed harmless at the time, Netflix did not file a Form 8-K with the SEC, issue a formal press release, or post the information on Netflix’s webpage – the typical avenues for announcing material nonpublic information. Neither had Netflix previously alerted investors that Hasting’s Facebook page would be used to disclose material information about the company. Hasting’s Facebook post caught the SEC’s eye and in December 2012, the SEC notified Netflix and Hastings that it was considering an enforcement action against them for possibly violating Regulation Fair Disclosure (“Reg FD”).

A quick overview of Reg FD and the SEC’s Reg FD company website guidance: Reg FD requires that the disclosure of material nonpublic corporate information should be distributed in a broad and non-exclusionary manner to the public. Information is considered nonpublic if it has not been disseminated in a manner available to the public generally. Information is considered material if it is reasonably foreseeable that an investor would trade on the basis of that information. Reg FD was adopted to address the concern that issuers were selectively “disclosing important nonpublic information, such as advance warning of earnings results, to securities analysts or selected institutional investors before making full disclosure of the same information to the general public.” Public companies typically comply with Reg FD by disclosing material nonpublic information in SEC filings, through press releases, on the company website, or some combination of all three.

In August 2008, the SEC provided guidance on the disclosure of material nonpublic information via company websites, blogs, and other “push” technologies. 2008 Commission Guidance on the Use of Company Websites, Rel. No. 34-58288 (Aug. 7, 2008), (“2008 Guidance”). The 2008 Guidance explained that whether a company’s website or blog is a “recognized channel of distribution” passing muster under Reg FD depends on the “steps that the company has taken to alert the market to its website and its disclosure practices, as well as the use by investors and the market of the company’s website.” The 2008 Guidance non-exhaustive list of factors for companies to consider include, but are not limited to:

• whether and how the company lets investors and the market know that the company has a website and that they should look at the company’s website for information;
• whether the company has made investors and markets aware that it will post important information on its website and whether it has a pattern of doing so;
• whether the company’s website is designed to lead investors and the market efficiently to information about the company;
• the extent to which information posted on the website is regularly picked up by the market and media, and is reported;
• the steps taken by the company to make its website accessible; and
• the nature of the information being disclosed.

With respect to Hasting’s Facebook post, the SEC ultimately decided not to pursue enforcement proceedings against Netflix or Hastings, namely because the agency concluded that there was a great deal of uncertainty concerning how Reg FD applied to public disclosures via social media. In the April Netflix Report, the SEC made clear that the 2008 Guidance “provide[s] a relevant framework for applying Regulation FD to evolving social media channels of distribution” and applies with “equal force” to the use of social media to disclose material information. Accordingly, moving forward the SEC “expects issuers to examine rigorously the factors indicating whether a particular [social media] channel is a ‘recognized channel of distribution for communicating with their investors.” The SEC also emphasized that the “steps taken to alert the market about which forms of communication a company intends to use for the dissemination of material, nonpublic information, including social media channels … are critical to the fair and efficient disclosure of information.”

The April Nextflix Report encourages companies to consider using periodic reports, press releases, and corporate websites to identify specific social media platforms that the company intends to use as well as the types of information it plans to disclose through social media. Further, while the SEC did not go so far as to endorse Facebook and Twitter as recognized channels of distribution in the April Netflix Report, by referencing them as general examples of social media platforms, coupled with each having one billion and 200 million users respectively, it is likely that the SEC would view both social media platforms as recognized channels of distribution so long as the public was adequately alerted of that intended use. Notably, the April Netflix Report found that personal social media sites of company employees – regardless of the amount of followers – would not ordinarily be assumed to be a proper channel for distribution without adequate notice that they will be used for that purpose.

Regulators are increasingly turning a critical eye toward companies' use of social media from everything from advertising to financial disclosures. The April Netflix Report is the latest example of regulators wrestling with the new reality of social media as an information source for the general public and companies increasingly relying on this medium to communicate to investors and consumers. Public companies looking to social media as a possible means to disclose nonpublic material information should take heed of the SEC's April Netflix Report and carefully consider the following steps:

• revisit and review the company’s existing Reg. FD policy;
• evaluate the selected social media platform(s) applying the 2008 Guidance factors summarized above;
• formulate a plan to alert the public of the social media platforms it intends to use and for what purpose through, among other things, its corporate website, periodic reports filed with the SEC and through formal press releases, and do so over an extended period of time with a specific date given for when the company will begin posting material information via the social media platform(s) that the company ultimately chooses;
• develop a coordinated plan to use designated social media platforms as part of the company’s investor communications along with more traditional venues such as SEC filings, press releases and the company’s website;
• review and revise electronic communications policies and train employees on the potential consequences of disclosing material nonpublic information on social media;
• coordinate legal, compliance, and investor relations departments to work together to implement and enforce electronic communications policies as well as review all social media content before it is posted; and
• ensure compliance with the laundry list of potentially applicable securities laws, which are beyond the scope of this blog, e.g., compliance with antifraud and proxy solicitation regulations, among others.

 The April Netflix Report and 2008 Guidance are available here and here, respectively.

Following up on my post explaining that Facebook's updated Data Use Policy could lead to them sharing user data with ad agencies, I had the chance to speak with Colin O'Keefe of LXBN on the subject. In the interview, I break down the changes and offer my thoughts on how this compares to Google's policies. 

Co-authored by: Cory Fox

Recently, the Federation of State Medical Boards (“the Federation”) released its Model Policy Guidelines for the Appropriate Use of Social Media and Social Networking in Medical Practice (“Guidelines”). The Guidelines are intended to address how physicians can utilize social media to facilitate patient care while still maintaining the privacy and confidentiality of patient information and the appropriate level of professionalism.

Social media usage, such as Facebook, Twitter, LinkedIn and blogging, has increased amongst healthcare providers. One survey indicates that 87% of physicians use social media websites for personal use and 67% use social media for professional purposes. Another study indicates that 35% of physicians have received friend requests from patients or their family members, and 16%of physicians have visited an online profile of a patient or a family member. The expanded use of social media raises challenging questions for healthcare providers, such as the extent to which physicians can share their work experiences online without violating the privacy and confidentiality of their patients and how to clearly delineate appropriate boundaries of professionalism. An analysis of physician blogs found that nearly 17% included enough information about patients to identify them. The Guidelines state that 92% of state medical boards have reported violations of online professionalism, including Internet use for inappropriate contact with patients, inappropriate prescribing, and misrepresentation of credentials or clinical outcomes. This conduct has serious consequences for physicians, with 44% of disciplinary actions from inappropriate Internet use resulting in medical license revocation.

To address these issues, the Guidelines recommend that physicians abide by the following standards when using social media:

• Candor: Physicians should disclose any information that could influence patients’ understanding or use of the information, products or services on any website offering health care services or information;
• Privacy: Physicians should prevent the unauthorized access to, or use of, patient and personal data and to assure that any de-identified data cannot be linked back to the user or patient; and
• Integrity: Physicians should ensure that the information contained on their websites is truthful, up-to-date, and supported by relevant clinical evidence when necessary.

The Guidelines use these principles to provide guidance on the appropriate use of social media and social networking in the following contexts:

• Professionalism: Physicians should:
  • Use separate personal and professional social networking sites, profiles, and e-mail accounts and ensure separation between the two;
  • Report any unprofessional behavior to the proper authorities; and
  • Observe the same standards of ethical conduct online that would normally be observed offline.
• Medical Board Sanctions and Disciplinary Findings: State medical boards have the authority to discipline for inappropriate online conduct, including:
  • Inappropriate communication with patients;
  • Use of the internet for unprofessional behavior;
  • Misrepresentation of credentials;
  • Violations of patient confidentiality;
  • Failure to reveal conflicts of interest;
  • Derogatory remarks regarding a patient;
  • Depiction of intoxication; and
  • The use of discriminatory language or practices.
• Interacting with Patients: Physicians should refrain from interacting with past or current patients on personal social networking sites like Facebook, and never discuss information pertaining to the physician-patient relationship on personal social networking sites.
• Privacy/Confidentiality: Patient privacy and confidentiality must be protected at all times, especially on social networking sites. Physicians can discuss their clinical experiences but should refrain from including details that may identify a patient.
• Disclosure: Physicians may write online about their experience as healthcare professionals, but they must reveal existing conflicts of interest and be honest about their credentials as physicians.
• Posting Content: Physicians must realize that any information they post online can be disseminated without their consent to a huge audience. The content posted can often be taken out of context and remain online forever.
• Discussion of Medicine Online: While professional social networking sites designed specifically for physicians can be useful forums for medical discussion, physicians must ensure that the information exchanged on these sites remains confidential and that non-physicians do not rely on the online discussion as medical advice.

The Guidelines recommend that all healthcare providers implement policies and procedures addressing social media and social networking usage in accordance with these recommendations.

Editor's Note: This post is a joint submission to BakerHostetler's Media Law Bytes & Pieces blog.

Since June 2011, the Acting General Counsel (GC) of the National Labor Relations Board has issued three reports outlining the position of his office on the applicability of the National Labor Relations Act (NLRA) to employee policies that set rules for permissible social media use. The positions taken by the GC were considered by some to have been overprotective of employees and advanced without considering the unique issues associated with social media (e.g. the GC's contention that a provision prohibiting disclosure of confidential information was unlawful). Other than identifying the social media policy of one retailer that was deemed acceptable, the three GC reports focused mostly on identifying what provisions were unlawful rather than providing guidance on creating a compliant policy. Review our prior coverage of the GC reports.

The GC's reports caused some employers to modify their social media policies while others waited to see if the GC's arguments were accepted by the NLRB. Until the NLRB issued a decision in the Costco Wholesale Corp. matter on September 7, 2012, however, the NLRB had not addressed any of the positions taken by the GC in a published decision. In the Costco decision, the NLRB found that provisions in an employment agreement that regulated employee use of social media violated the NLRA. The decision has been widely reported as adopting much of the reasoning from the GC reports. Although such reports may be overstated, like the GC, the NLRB's analysis in Costco applied precedent developed to address traditional workplace rules to find broad rules directed at defining impermissible use of social media to be unlawful instead of developing standards specific to the unique nature of social media. Specifically, the NLRB found that the following employee rules that often appear in social media policies violated the NLRA because they could reasonably be seen as chilling employees' exercise of their rights under Section 7: (1) a prohibition on electronically posting statements that damage the company or any person's reputation; (2) prohibiting unauthorized posting, removal or alteration of material on company property; and (3) prohibiting discussing, disclosing or sharing private employee matters or confidential information.

One area where the NLRB and the GC may differ is over the impact of including a "savings" clause. Some social media policies contain a provision stating that the policy will not be construed or applied in a manner that would violate the NLRA. The GC contends that this type of "savings" clause does not save overly broad provisions from violating the NLRA. But the NLRB noted the absence of such a provision as part of its basis for finding policy language to be unlawful.

In the wake of Costco, employers should review their employee handbooks and social media policies to look for issues. We have listed below the specific policy language that was found to violate the NLRA and the NLRB's supporting rationale. When revising or implementing new social media policies, we recommend that employers consider the following:

1. Include an introductory paragraph that provides an explanation of the nature of issues and business risks unique to social media that the policy is designed to address to provide context for the prohibitions that will follow;
2. Create separate segments of the policy for different forms of social media use (e.g. personal use, employer-owned) so the prohibitions can be appropriately tailored;
3. Provide examples of prohibited conduct associated with actions not protected by the NLRA (e.g. prohibiting "verbal abuse" or "abusive and profane language"); and
4. Include a "savings" clause stating that protected activity is excluded from the scope of the policy.

For more tips on crafting a social media policy, see the following BakerHostetler publications:

• "You Are What They Tweet: Why Clear Social Media Policies are Becoming More Critical to Employers in This Tech Age"
• "What Can Management Do to Protect the Organization from Inappropriate Use of Social Media?"
• "Holy Tweet! - #AngryWrkr2012 : What Can an Employer Do When a Disgruntled Employee Takes to the Web to Air His Work Grievances?"

Below is a list of the specific policy language and the NLRB's explanation for why it was unlawful:

• "Any communication transmitted, stored, or displayed electronically must comply with the policies outlined in the Costco Employee Agreement. Employees should be aware that statements posted electronically (such as online message boards or discussion groups) that damage the Company, defame any individual or damage any person's reputation, or violate the policies outlined in the Costco Employee Agreement, may be subject to discipline, up to and including termination of employment."
  
  The NLRB found that this "broad prohibition against making statements that 'damage the Company, defame any individual or damage any person's reputation' clearly encompasses concerted communications protecting [Costco's] treatment of its employees." The Board was particularly critical of Costco's failure to explicitly exclude from its policy protected activity under the NLRA. Without any exclusion, the Board found that employees would reasonably conclude that the restriction applies to protected communications, such as those critical of Costco.
• "Sensitive information such as membership, payroll, confidential financial, credit card numbers, social security numbers, or employee personal health information may not be shared, transmitted, or stored for personal or public use without prior management approval. Additionally, unauthorized removal of confidential material from Company premise[s] is prohibited."
  
  NLRB found that the prohibition against sharing "payroll" information violated the Act. It rejected Costco's argument that the term "payroll" referred only to the "confidential business information component of payroll" (which Costco did not want to share with its competitors). Instead, the NLRB found that the term payroll reasonably referred to the wages and working conditions of its employees, and therefore, violated the Act.
• "All Costco employees shall refrain from discussing private matters of members and other employees. This includes topics such as, but not limited to, sick calls, leaves of absences, FMLA call outs, ADA accommodations, workers' comp injuries, personal health information, etc."
  
  The NLRB found that this rule explicitly prohibits protected activity. "Private matters" as defined by the rule, such as sick calls and accommodations, are terms and conditions of employment. Costco's explicit prohibition of employees discussing these matters with anyone -- which the NLRB found would include other employees or union representatives -- is overly broad. The NLRB was not persuaded by Costco's argument that the rule simply tried to avoid the disclosure of medical issues. Instead, the NLRB found that if Costco "intended to prohibit only discussion of private medical information in its files, it could have easily done so."
• Cause for termination of employment for "Unauthorized posting, distribution, removal, or alteration of any material on Company property."
  
  The NLRB found that this rule explicitly prohibits protected activity. It rejected Costco's argument that the rule intended to permit distribution in non-working areas during nonworking time.
• "In the course of our business, we collect from our members and employees a substantial amount of personal information (such as name, address, phone number, e-mail address, social security number, membership numbers and credit card numbers). All of this information must be held strictly confidential and cannot be disclosed to any third party for any reason, unless (1) we have the person's prior consent or (2) a special exception is allowed that has been approved by the legal department."
  
  In striking this provision, the NLRB found that Costco's definition of "confidential" was overbroad because it included employees' names, addresses, phone numbers and email addresses, which they otherwise have a protected right to share with others, such as unions. Costco's provision did not distinguish between information obtained in the normal course of work versus information obtained from Costco's private or confidential files. The NLRB further criticized the provision because it failed to distinguish between information obtained by employees from contact with or discussion with other employees.

Authorship Credit: Ellen J. Shadur

The advent of social media and the prevalence of mobile communications devices challenge employers seeking to prevent unlawful conduct in the workplace.  Employees are no longer constrained by the need for physical proximity, or lack of access to a bulletin board, a telephone landline, or a fax machine.  Bullying and harassment, misappropriation of an employer’s trade secret or proprietary information, or  disclosures that run afoul of securities or consumer protection laws, all may take place “away” from the workplace, and without the need for or use of workplace computers or equipment controlled by the employer.

Legitimate concerns about the power of these new media may drive some employers to monitor employee postings or comments via Facebook or Twitter.  In so doing, employers may unwittingly run afoul of the National Labor Relations Act (the "Act").

The Act protects the rights of employees to engage in concerted activities “for the purpose of collective bargaining or other mutual aid or protection . . . ."  The Act further protects the rights of employees to engage in protected concerted activity free from unlawful surveillance by their employers.  This is true whether or not employees are represented by a union or seek to be.  Employees communicating with each other to address a shared concern related to their employment, or trying to encourage concerted activity on a matter related to their employment, may be engaging in activity protected by the Act.

Recent decisions of the National Labor Relations Board (the “Board”) make clear that employers must tread carefully when it comes to monitoring or intercepting employees’ communications via the Internet or social media.  Employers do not have unfettered rights to act upon everything they see.  While the Board’s positions are evolving, the cases do provide some guidance.

Friending – Employees sometimes “friend” their supervisors or otherwise include supervisors in their social network.  Information obtained in this way is fair game for the employer; NLRB decisions have concluded that an employee who “friends” a supervisor is inviting observation by the employer.  See Advice Memorandum dated July 28, 2011 regarding Buel, Inc., Case 11-CA-22936 (summarized in January 24, 2012 Report of the Acting General Counsel Concerning Social Media Cases).  The same may not be true, however, where the supervisor is acting at the direction of the employer.  Thus, employers should not encourage supervisors to seek out employees as social media contacts, such as Facebook friends.   See Id., relying on Donaldson Bros. Ready Mix, Inc. and International Union of Operating Engineers, Local 400 AFL-CIO, 341 NLRB 958, 961 (2004).

Trolling – Employers should not encourage or suffer supervisors to troll employee sites on social media sites such as Facebook or to follow employee Tweets for the sole purpose of monitoring concerted activity by employees. This, too, could be viewed as unlawful surveillance.  Id.

Use of proxies – Creation of an impression of surveillance is also unlawful interference with employees’ rights under the Act.  An impression of surveillance is created where an employer makes a statement from which an employee would reasonably assume that his or her concerted activity was under surveillance. See Target Corporation and United Food & Commercial Workers Local 1500 2012 WL 1830340 (NLRB Div. of Judges, May 18, 2012).  Thus, by way of example, a supervisor may not use employee proxies to collect information and then fail to disclose where the information came from.   Id.  (Employer found to have violated the Act where supervisor told employee that employer was aware of protected activity but would not disclose how employer learned of the conduct).  Employers should not, therefore, encourage non-supervisory employees to do by proxy what employers may not do themselves, nor should they encourage anonymous “tipping” about employee gripes or complaints.

What’s an employer to do?

The bad news for employers is that decisions addressing surveillance have not yet begun to grapple with the power of the Internet and social media.  The good news is that the rules for employers are not more complicated or different simply because employees have new means of communicating with each other.  Thus, employers may use the same tools that have always worked to encourage good employee behavior without employers having to resort to unlawful surveillance.  Following are two examples:

• Policies that clearly proscribe communications or conduct in a way that does not run afoul of employee rights under the Act.  The Acting General Counsel’s reports on social media cases make clear that such policies must clearly define the context, or need, giving rise to the proscription, and the policy must be narrowly tailored for that context.  By way of example, a policy against unlawful harassment that proscribes “offensive” conduct will pass muster even though a stand-alone policy with the same language would be overly broad and violate the Act.
• Policies encouraging employees to bring complaints or concerns to their supervisors, and allowing employers to use these policies to evaluate employee behavior.  In a recent decision of the Second Circuit Court of Appeals, the employer used such a practice to show that its decision to terminate a union activist employee did not constitute unlawful retaliation under Section 8(a)(3) of the Act.  See N.L.R.B. v. Starbucks Corp, --- F.3d --- , 2012 WL 1624276 (C.A.2) (May 10, 2012) (employee termination lawful where based on noted deficiencies in “communicating changes in partner attitude (concerns, compliments, complaints) to management”).

In conclusion, employers should avoid the temptation to use social media to monitor employee communications in ways that would be proscribed for other, more traditional types of concerted activity.  The tried and true – well-written, thoughtful policies and good management practices, are still the best means of preventing unlawful employee behavior.

Authorship Credit: Tarsha Luke

The recent termination of a top executive of a publicly traded company is another example of some of the perils of mixing personal and workplace social media. The chief financial officer for a women's clothing retailer, Francesca's Holdings, was dismissed for disseminating non-public corporate information to his Twitter followers. After a company board meeting he tweeted about the company's earnings. Using the handle "@theoldcfo," he wrote: "Board meeting. Good numbers=Happy Board." Subsequently, the company's stock jumped fifteen percent. Strictly enforcing its social media policy, the Houston-based company decided to fire its CFO for that tweet, in addition to a series of other posts he sent from his social media accounts since 2010.

This case sheds light on the legal consequences relating to the use of social media in the workplace. Employee Internet posts not only implicate the financial rules of the Securities and Exchange Commission, as was the case for Francesca's, but they can also create compliance issues under the regulations of other agencies, including:

• Financial Industry Regulatory Authority (FINRA),
• Federal Trade Commission (FTC),
• Food and Drug Administration (FDA) and
• National Labor Relations Board (NLRB), Office of the General Counsel.

Furthermore, rogue social media use can put company trade secrets and client confidences in jeopardy. This is why it is increasingly important for all companies, not just publicly traded companies, to have a social media policy. A good social media policy should address both employee behavior on company-affiliated media, as well as employee behavior that can be traced back and imputed to the company.

Below are some considerations for creating and implementing a social media policy:

• Almost anything written on the web can be easily traced back to its author, and ultimately the place where he works. This is because online information is backed up repeatedly and often and posts in one forum are usually replicated in other forums through trackbacks, reposts or references. Therefore, social media policies should be applicable to all types of workers including employees, temporary or seasonal workers, independent contractors or anyone with access to a company computer.
• Companies with employee-generated content on company-branded websites, blogs, wikis or other social networking sites should have formal procedures to review what its employees post on its behalf. When possible, it is best practice to treat all employees' posts on company-branded sites as if they were being published in more traditional media.
• Nevertheless, a company cannot prevent an employee from using the company's name or trademark for non-commercial purposes on his or her own time to complain about wages, terms and conditions of employment, working conditions or other protected employee rights under Section 7 of the National Labor Relations Act (NLRA).
• An employer should avoid using vague language in its social media policy, such as "appropriate," "inappropriate" or "professional." Terms should be defined either by using examples or by using language that carves out an exception for employee rights protected under the NLRA.
• A company should be careful about asking an employee or prospective employee to provide usernames and passwords to personal social networking websites, without first weighing the business concerns of doing so. In addition to potentially facing serious public relations concerns for chosing to implement such a policy, there soon may be legal liability for requesting private social media passwords. Maryland enacted a law prohibiting employers from asking for social media passwords, which will take effect on October 1, 2012. Other states are also rapidly following suit, including Illinois, California, Minnesota, Michigan, Massachusetts, and Ohio. Furthermore, the federal government is also interested in this topic. Two U.S. Senators have asked the Department of Justice and the U.S. Equal Employment Opportunity Commission to look into the issue.

For more information and guidance on this issue, see a recent article published by Labor and Employment Partner Dan Guttman titled: "What Can Management Do to Protect the Organization From Inappropriate Use of Social Media?"