Privacy and Social Media

transcript

Social Media, Employee Privacy Interests and

Employer Business InterestsVictoria L. Herring

December 2011

Social Media? Anti-Social Media?

One-way delivery of information

memos, letters, brochures, ads

versus

two-way ‘street’, interaction between parties; collaboration

blogs, networks, social sites

Examples of Social Media

Facebook and LinkedIn

Twitter

Digg, Delicious and StumbleUpon

YouTube and SlideShare

Flickr, Picasa, Instagram

“...And thus, is great teaching in action. Great teachers are now syndicators (sp?) of content. Great teachers share. Great

teachers teach us all.”

Types of Social Media Sites

Sharing of all sorts of things

News & Articles [blogs, news aggregators]

Information [chat rooms, IMs, texts]

Images [Flickr, Picasa, Google Images, iReporter]

Knowledge [Wikipedia]

Privacy Rights Clearinghousewww.privacyrights.org

Categories of Social Media

Personal

Status Update

Location

Content-sharing

Shared Interest

Social Media as Evidence

Relationships

Location

Activities

Lack of emotional distress, damage

Reputation

Billing practices

Copyright or Trademark Use

Employment actions

Dangers from use of Social Media

Misunderstandingssarcasm, parody, joking

Divulging information broader than intended

failure to properly set privacy settingsfailure to understand what is or is not private

Permanent recordassuming fleeting nature of what is saidmisunderstanding electronic media

Internet Archive: www.archive.org

“Wayback Machine”

May 8, 1998, Apple.com10

Employee Privacy Interests

Legal Protections for Employees

Federal Constitution

Federal Statutes

State Statutes

Common Law Recognition

lst Amendment Rights:Free SpeechPetition the GovernmentPeaceable AssemblyFree Press

Other Rights?

Distinction between Government and Private Employment

Constitutional Provisions limit intrusion upon employee’s privacy by government

Statutory provisions may affect private employer’s ‘right’ to intrude on its employees

Federal StatutesElectronic Communications Privacy Act of 1986,

amending the Wiretapping Act

FACTA: Fair & Accurate Credit Transaction Act of

2003, amending the Fair Credit Reporting Act

[FCRA]

Health Insurance Portability & Accountability Act of 1996 [“HIPAA”], 42 U.S.C. § 1302(d) & regulations

no private right of action under HIPAA, go thru HHS & Department of Justice

National Labor Relations Act

NLRB interprets to protect employees:

surveillance cameras

meetings regarding discipline

free speech if a matter of employment concern

Software to Monitor

“a computer monitoring tool that records what your employee, roommate or child does on your computer”

Methods of Monitoring

Telephone

Computer [keystroke monitoring]

Mail, eMail,

Voicemail

Video surveillance

Social Media

Cautions re Monitoring

Depends on application of EPCA, Federal and State* Laws, Employer policies and assurances.

Telephone

Computer [keystroke monitoring]

Mail, eMail [not private if employer’s terminal]

Voicemail, IMs

Video surveillance

Social Media

*Note: Iowa differs from California, etc.

Monitoring with Social Media

Government EmployeesO’Connor v. Ortega [1987]: 4th Amendment applies == the question is whether the employee

has a reasonable expectation of privacy in area searched

whether employer’s search of area was reasonable under circumstances: “context”

operational realities of the workplace may make expectation of privacy unreasonable

tested on case-by-case basis: depends on context and balance of legitimate expectation of privacy with employer need for supervision, control and efficient operation of workplace

O’Connor v. Ortega

O’Connorpublic employee’s reasonable expectation is

qualified, subject to the ‘operational realities’ of the

workplace

policy in existence?

keys to the office?

work-based need for

investigation?

consent given?

other factors, Quon

City of Ontario, California v. Quon, 6/17/2010

Police official sent text messages. Department had computer policy on personal use of email, not of text messages although treated them the same.

Messages reviewed, many personal and some sexually explicit - Quon was disciplined for violation of department rules.

Under O’Connor, Quon had reasonable expectation of privacy. The question was whether the search was reasonable.

Criteria for justifying search = a work related purpose, not excessively intrusive, among others

Must be provided a copy of his or her personnel file, under

Section 91B, Iowa Code

ADA & ICRA Protections ref. medical information; see

ADA § 12112(d)(3)(B) & 29 CFR § 1630.14(b)(1)

Electronic Communications Privacy Act [ECPA];

digital privacy protections, outstripped by

technology

Private Employee Rights

Some Courts have recognized email as protected by the ECPA, and others have not

ECPA: email over 6 months old ‘abandoned’ versus continual existence in the ‘cloud’

May depend upon employer adoption of policies and notice to employees of what they can expect, or not, in terms of personal privacy

General view: employer ownership of place of employment and Iowa view of ‘at will’ employment combine to limit expectation of personal privacy in the private workplace

especially if policy or other notice provided

Unionized Employees

Brewers & Maltsters, Local No. 6, D.C. Cir. 2005 [NLRB]:

secretive installation of hidden surveillance cameras in workplace violated NLRA because their use was a subject of bargaining

Two or more Employees

NLRB applies to employees engaged in “concerted activity”, regardless of whether unionized

NLRB v. American Medical Response of Connecticut, Inc., NLRB No. 34-CA-12576; postings on Facebook which are protected, concerted activity cannot be used to discipline or fire employees

NLRB v. American Medical Response

NLRA gives employees rights to complain about pay, safety and other working conditions.

AMR: employee who called her supervisor a “scumbag” [and worse] on Facebook from home computer could not be fired - postings were made in online discussion among employees about supervisory action, provoked by unlawful denial of union representation.

NLRB v. American Medical Response

NLRB: employee posting on Facebook engaged in protected concerted activity

AMR policy/firing interfered with employees’ right to engage in concerted activities

cannot ban discussion of wages, employment conditions

cannot have an overly broad policy

Huffington Post: “Fired over Facebook, 13 Posts

that Got People CANNED”surfing FB while home ‘sick’

FB posted photos caused firing of professional football cheerleader

13 crew members on Virgin Atlantic participated in FB discussion; references to passengers & bringing company into disrepute

fired for a derogatory, mocking FB group that mocked customers

high school teacher for FB photos with wine, beer & expletive

posting of video derogatory of employer; exposing patient confidential information [HIPPA violation]

TSA Agent - anti-Muslim, racist FB comments

Doctor fired after posting information about a trauma patient on FB page, even if did not reveal name

State police officer fired because of FB photos and comments about being drunk

Professor fired after posting about a failing student; teacher fired for joking about drowning her students

[search, Huffington Post, “fired over Facebook”; not all firings were upheld]

12/13/11 10:05 AM100155.strip.zoom.gif 1,000×311 pixels

of 1http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/100000/00000/0000/100/100155/100155.strip.zoom.gif

Watch what you Say

Wiretapping & Eavesdropping

“Get a good night’s sleep, and don’t

bug anybody without asking me.”

Richard M. Nixon to re-election campaign manager Clark MacGregor, recorded on tape [Christian Science Monitor, 8/14/80]

Eavesdrip is an Anglo-Saxon word, and refers to the wide overhanging eaves used to prevent rain from falling close to a house's foundation. The eavesdrip provided "a sheltered place where one could hide to listen clandestinely to conversation within the house." W. MORRIS & M. MORRIS, MORRIS DICTIONARY OF WORD AND PHRASE ORIGINS,

198 (1977)

Dilbert by Scott Adams, from http://www.spybusters.com/History_Cartoons.html

Eavesdropping

Iowa Code § 727.8: Electronic and Mechanical eavesdropping - a misdemeanor

Any person, other than a participant or listener to communication, without right or authority who taps into or connects a device to any telephone or other communication wireor who by any electronic or mechanical means listens to, records, intercepts a communication

Can We Tape?State v. Philpott, 702 N.W.2d 500 (Iowa 2005), illegal to tape while not present.

Iowa Code Ch. 808B: Interception of Communications - a felony

Unless as specifically authorized under Chapter 808B

willfully intercepts or endeavors to intercept a wire, oral or electronic communication; uses or endeavors to use an electronic, mechanical or other device to intercept any oral communication

willfully discloses contents or uses them knowing it was

obtained in violation of Ch. 808B.2, although some

exceptions for communications carrier employees and

parties to communication, or prior consent given

Section 808B.7: contents of intercepted

communication shall not be received in evidence “if

the disclosure of that information would be in

violation of this chapter”.

Section 808B.8: person whose communication is

intercepted, disclosed or used has a cause of action

against any person who does that, for injunction

and damages

Can we Use the Information?Genetic Nondiscrimination Act of 2008 [GINA]; illegal to use or discriminate because of

‘genetic information’

“Genetic Information” broadly defined [disease/disorder in family]

Exceptions for inadvertent disclosure, etc.

Example: Employee fired a week after mentioning that her mother had died of Huntington’s disease and she had 50% chance of developing it.

in context of social media: mention of such on blog, FB, etc. in casual conversation which is then known to employer - Q whether ‘inadvertent’ or not?

1986 Electronic Communications Privacy Act [ECPA], 18 U.S.C. § 2510 et. seq.

prohibits interception of wire, oral or electronic communicationsECPA added prohibition against interception or accessing electronic communicationsWarrant requires to obtain emails stored up to 180 days, not afterward

U.S. v. Warshak, 6th Circuit; 4th Amendment & ECPA: A warrant is required for searches within the 6 months. There is a reasonable expectation of privacy for emails stored on 3rd party servers.

United States v. Jones, U.S.S.Ct., decided Jan 2012: GPS Satellite monitoring of vehicle’s movements is a “search” and violates the 4th Amendment to the U.S. Constitution.

-- Earlier cases [Karo, Knotts] in U.S.S.Ct. had allowed use of a monitoring device while moving in public or if limited in extent.

EmailWritten [computer]

message packetized

INTERNET

PacketsRouted

Packet Reassembled

& Copied

Re-packetized

MessageStored Reassembled

Received at Mailserver

Retrieved & Read

Life of an Email

PostWritten

Upload to

web INTERNET

PacketsRouted Re-assembled, re-packetized

Posting stored on

ServerReassembled

Public or

Private Access?

Retrieved & Readand stored forever

Life of a Posting

Library of Congress is creating an Twitter archive of all public tweets since

2006 -

Employer’s Protections

Theory of At Will Employment

Policies governing appropriate use of employer’s facilities, including communications and computer equipment

Handbook

separate policy

signed receipt

Handbooks and Manuals

retention policies

destruction policies and procedures

FACTA - FTC regulations on proper disposition of records & handling of employee misconduct investigations

Ownership of Social Media Writings

non-compete agreementsnon-solicitation agreementsintellectual property agreementsconfidentiality agreementsseverance agreements

non-compete agreements and non-solicitation agreements -

Amway Global v. Woodward, E.D. Mich. 9/30/10, blog post can be evidence of solicitation

TEKSystems v. Hammernik, 2010, complaint alleges violation of Noncompete and nonsolicit agreements based on Defendant’s LinkedIn profile.

intellectual property/trade secretsSasqua Group, Inc. v. Courtney, E.D. N.Y. 2010, employer failure to treat information truly secret meant customer list not such in today’s Internet society

Risk to Employers: Failing to treat social media abuse differently from harassment

Kiesau v. Bantz, 686 N.W.2d 164 [Iowa 2004]: emailed photoshopped image resulted in $150,000 judgment plus possibility of more for failure to properly supervise

Some online resources particularly helpful:

Privacy Rights Clearinghouse, www.privacyrights.org

Electronic Privacy Information Center www.epic.org

Thank you.

Victoria L. Herring