Business Gold Mine or Liability Landmine?

August, 2011

Sponsored by:

Business Gold Mine or Liability Landmine?SOCIAL MEDIA

Sponsored by:2 Social Media Whitepaper | Advisen Ltd.

W H I T E P A P E R | August, 2011

Executive summary

Social networking is a ubiquitous part of life in the 21st century. Facebook, the 800 pound

gorilla of social media, now boasts nearly 700 million members worldwide, more than twice

the population of the United States.1 In March, Twitter announced it had added an average

of 460,000 new accounts per day for the prior month, and was averaging 200

million tweets per day.2

Companies across the world are recognizing the power of social media and

are rushing to create Facebook pages and amass followers on Twitter. Some

companies are using the enormous volume of personal information compiled

by popular social networking sites to customize and target marketing messages

to well-defined demographic segments. Many firms use social networking web-

sites to research job candidates and some to monitor employee activities.

Online social networking can be a powerful tool for organizations of all types,

but it also presents a bewildering and rapidly evolving web of liability expo-

sures. Potential sources of liability range from copyright infringement to invasion of privacy

to consumer fraud law violations.

It is clear that companies need social networking guidelines to minimize risk. However, many

loss control measures are difficult to implement, monitor and enforce. They may even cause

friction with employees and even undermine the business benefits of social networking.

Decisions as to how to manage exposures necessarily involve risk-versus-reward tradeoffs.

Insurance protection has increasingly become an essential part of an overall plan to manage

risk, with coverage for many social media exposures available through cyber liability policies.

Business Gold Mine or Liability Landmine?SOCIAL MEDIA

Online social network-

ing can be a powerful

tool for organizations

of all types, but it also

presents a bewildering

and rapidly evolving

web of liability

exposures.

3 Social Media Whitepaper | Advisen Ltd. Sponsored by:

social media business gold mine or liability landmineW H I T E P A P E R | August, 2011

Tapping into the Social Media Phenomenon

“It is time for companies to embrace, not fear, emerging media. There is no other way to

remain competitive,” concludes public relations firm Burson-Marsteller in a recent review of

corporate social media usage.3

Even those increasingly rare people who do not directly participate in online social network-

ing can hardly escape its influence. Social media has become a preferred way for entertainers

to develop rapport with their audiences and politicians to communicate with their support-

ers. Sara Palin’s tweets have become a regular part of the news cycle, and former Speaker

of the House Newt Gingrich – hardly the face of the Facebook generation – announced his

candidacy for the president of the United States on Twitter with a link to a YouTube video.

Revolutions are fomented via Twitter and breaking news is transmitted across the globe in

real time on Facebook. Some of the most powerful images of the Tohoku earthquake and

tsunami that were broadcast on television news programs were amateur videos taken from

Facebook pages.

Facebook, YouTube, Twitter, and LinkedIn are among the largest and best known social

networking websites, but hundreds of other sites serve smaller, generally more narrowly fo-

cused, audiences. Many social media sites permit members to construct a profile of personal

information and to create a list of other members with whom they share a connection. They

then can navigate their list of connections as well as the lists of others. Members often post

messages, or upload photographs, music or videos, to be shared either publically or within

their network of contacts.

Businesses of all types have discovered that social media can be effective for launching new

products, building brand loyalty, identifying prospects and communicating with customers. It

also can facilitate business-to-business activities. A recent survey of more than 3,300 mar-

keters by Social Media Examiner found that 90 percent of respondents consider social media

important to their business, with 88 percent saying that the principal benefit is generating

more business exposure.4 PR firm Burson-Marsteller found that nearly 80 percent of the 100

largest companies in the Fortune 500 list use Twitter, Facebook, YouTube or corporate blogs

to communicate with customers and other stakeholders.5

Many companies are content with establishing a presence on social networking websites,

such as creating a Twitter account or a page on Facebook. Others seek to leverage the

enormous troves of personal information about members compiled by social media website

Facebook, YouTube,

Twitter, and LinkedIn

are among the largest

and best known social

networking websites,

but hundreds of other

sites serve smaller,

generally more narrowly

focused, audiences



owners. Facebook, for example, offers advertisers the ability to direct messages to audiences

according to factors such as location, age and interests.

A common use of social media is to screen job applicants. A 2010 survey commissioned by

Microsoft found that 79 percent of recruiters and hiring managers in the US have reviewed

online information posted to social networking sites and blogs to screen job candidates.6

While still a popular way to screen applicants, the effectiveness of the practice is diminishing

over time as social media sites beef up user privacy options.

Some employers also monitor employee activities outside working hours through social me-

dia. Employers often attempt to control what employees say about the company on social

media sites. On occasion employers have been accused of monitoring other aspects of em-

ployees’ personal lives, and in some cases taking job-related actions as a result.

A growing number of companies employ aspects of social media on their own websites. While

the phrase “social media” may most readily bring to mind mammoth social networking web-

sites such as Facebook, MySpace, LinkedIn and Twitter, blogs and message boards also are

forms of social media. These can be powerful tools for interacting with customers and build-

ing online communities, but they also expose the company to the headaches of managing

sometimes inappropriate content posted to the site by visitors, and can create unexpected

liability exposures.

Liability Issues

The social media liability landscape is undergoing rapid evolution. In some cases, legal prin-

ciples from the brick and mortar world port easily into the digital world of social media. In

other cases, however, established legal principles and precedents are inadequate for the ul-

tra-fast, fluid, borderless, highly transparent and near ubiquitous social media environment.

Companies attempting to manage their social media exposures frequently are confronted

with the fact that social networking tends to be far more freewheeling and informal, with

fewer checks and balances, than traditional marketing and communication channels. The

opportunities for oversights, errors, and purely boneheaded behavior increase exponentially.

The speed at which images and words can be cut, pasted and redistributed by anonymous

sources magnifies the risk of multimillion dollar lawsuits.

The opportunities for

oversights, errors, and

purely boneheaded

behavior increase

exponentially.



The opportunities for stumbling into trouble seem almost limitless, but many of the most

significant exposures fall into the following categories:

» Media-related liability exposures such as copyright and trademark infringement

and defamation;

» Consumer fraud and deceptive business practices;

» Violation of data security and privacy laws;

» Violation of employment laws; and

» Security laws violations.

Media-related exposures. Publishing anything on the Internet opens a company to the

same exposures faced by professional media companies such as newspaper publishers and

broadcasters. These exposures include defamation, invasion of privacy, copyright infringe-

ment, false advertising and trade libel.

Defamation and its commercial cousin, trade libel (or commercial disparagement), have

emerged as hot issues in social media liability. Most of the litigation to date, however, has

involved individuals rather than businesses as defendants. In one well-publicized case, mu-

sician Courtney Love was sued by clothes designer Dawn Simorangkir for defamation, inva-

sion of privacy and infliction of emotional distress for “an extensive rant” on Twitter about

how she was billed for custom clothing. The suit was the first to raise the issue of whether

a public figure’s comments in social media should be held to the same libel laws that apply

to professional news organizations or should be granted the more liberal standards afforded

an op-ed piece or a letter to the editor. Love settled out of court for $430,000, so the issue

was never adjudicated.

Copyright infringement is rampant on social networking websites, and companies must take-

care that their representatives are not among the infringers. In an incident that received wide

news coverage, the Republican National Committee settled a lawsuit alleging that the orga-

nization used a segment of Jackson Browne’s song “Running on Empty” without permission

in a YouTube video promoting presidential candidate John McCain. Senator McCain also was

named in the suit, though he claims to have had no hand in producing the video and did not

even know of its existence until the suit was filed.

Businesses that employ elements of social media on their own websites, such as blogs and

message boards, are exposed to allegations of copyright infringement and defamation. Many

Copyright infringement

is rampant on social

networking websites,

and companies must

take care that their

representatives are not

among the infringers.



blogs, for example, quote from news articles. However, news organizations usually are op-

posed to even snippets of unlicensed stories appearing in blogs and other types of social

media, and many have become more aggressive about policing the blogosphere. Nearly one

thousand publishers now have joined The Associated Press’ News Licensing Group which

launches in July. The organization will track and police the use of content from member news

organizations.

Outside contributors to interactive blogs and message boards often post copyrighted mate-

rial, or may make defamatory statements. In most cases, website operators are shielded from

liability by The Digital Millennium Copyright Act (DMCA) and the Communications Decency

Act (CDA). Protections under the DMCA and the CDA, however, have limitations. In order

to qualify for protection under the DMCA, for example, mechanisms must be in place to

respond to a copyright owner’s request for removal of infringing content. The site owner also

must not receive financial benefits directly attributable to infringing activity.

In a small, but closely watched case, Rodale, Inc., publisher of Runner’s World magazine,

threatened to sue LetsRun.com, a website operated by twin brothers Robert and Weldon

Johnson, for a 900-word Runners’ World article posted by a participant on LetsRun.com’s

community message board. The Johnsons removed the Runner’s World content from Lets-

Run.com, but Rodale again threatened legal action for a link on the message board to the

same article which, according to Rodale’s attorney, was “stripped of all Rodale ads and navi-

gational information and aids.” According to the Johnsons’ reply, the link was to Rodale’s

own printer-friendly version of the article that had indeed been “stripped of all Rodale ads

and navigational information and aids” – by Rodale. Rodale eventually backed down.

Consumer fraud and deceptive business practices. Social media can be a powerful tool

for promoting a company’s products and services, but without proper precautions it can open

a company up to allegations of consumer fraud and deceptive business practices.

The FTC routinely monitors cyberspace for company employees and agents masquerading as

independent third parties who are attempting to influence consumers. The FTC now surveys

blogs, Facebook, Twitter, and other websites for violations of rules aimed at infusing greater

transparency into the online marketplace. McDonald’s is just one of many companies to run

afoul of FTC rules. In 2006 it was discovered that a pair of blogs allegedly run by McDonald’s

devotees who seemed obsessed with the company’s Monopoly game were in fact “flogs” (fake

blogs) created and operated by the fast food giant.

The FTC routinely

monitors cyberspace

for company em-

ployees and agents

masquerading as

independent third

parties who are

attempting to influ-

ence consumers



Not only might the FTC bring enforcement actions for bogus blogs and reviews, companies

may also be targeted in class-action lawsuits by consumers and subject to legal action by

state attorneys general for violation of state consumer fraud laws. In 2009, the New York

State Attorney General’s office charged Lifestyle Lift, a chain of cosmetic surgery centers,

with posting fake consumer reviews on the Internet. The company agreed to pay $300,000 in

penalties and costs. According to the AG’s office, Lifestyle Lift employees created accounts

on Internet message boards and posed as satisfied customers.

In the Lifestyle Lift case, the company was accused of directing employees to pose as satis-

fied customers. But even well-intentioned employees who are genuinely enthusiastic about

their employers’ products can cause problems. FTC guidelines indicate that employees who

choose to favorably comment on their employers’ products or services on social media may

subject their employers to liability, especially if misleading statements result in injury to

consumers. This exposure will be examined in greater detail in the next report in this series,

Social Media: Employers’ Liability for the Activities of their Employees.

Violation of privacy laws. The major social media websites, and Facebook in particular,

have been magnets for suits alleging violations of privacy laws. At issue are who owns the

vast amount of personal information posted on these sites, who is permitted access to it, and

how it can be used. Thus far, lawsuits challenging this type of commercial use of personal

information have been directed towards the social network sites themselves, but new theories

of liability may someday drag advertisers into this litigation as well.

Efforts to monitor and control negative statements about a company by employees can result

in allegations of privacy law violations. In one significant case, Pietrylo v. Hillstone Restau-

rant Group, an employer was found liable after a manager infiltrated an online group estab-

lished by employees to vent grievances about the company. The site’s creators were fired for

violation of company policy involving “professionalism and a positive attitude.” They sued

and won a jury verdict that was upheld on appeal. At issue was how the site was infiltrated: a

manager requested, and was given, an employee/member’s log-in ID and password. The em-

ployee later testified that she felt pressured to give the manager her log in information, and

that she felt she would have gotten into trouble had she refused to do so. A jury concluded

that the manager had not been authorized to enter the site and returned a verdict in favor of

the plaintiffs on two counts: violation of the federal Stored Communications Act and viola-

tion of the New Jersey Wire Tapping & Electronic Surveillance.

The major social

media websites, and

Facebook in par-

ticular, have been

magnets for suits

alleging violations

of privacy laws



Other state and federal laws that could trip up employers that are overly aggressive in moni-

toring or attempting to control employee communication through social media include the

Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, various wiretap-

ping laws, and common law invasion of privacy theories.

Violation of employment laws. Social media offers employers unprecedented access to

the details about the personal lives of job applicants and employees, but it also creates

new opportunities to run afoul of state and federal laws intended to protect workers. For

example, in researching a job candidate, an employer may discover an applicant’s religion or

sexual preference, or find out that the applicant is pregnant or disabled. If the candidate is

rejected, the employer may be sued for discrimination. Even if the reason for rejection had

nothing to do with those attributes, often it is difficult to prove that discrimination was not

involved. Irrespective of outcome, the time and money required to deal with a lawsuit can

be considerable.

Employers are understandably concerned about statements made about a company by em-

ployees in social media. Many companies have social media policies that prohibit certain

types of comments about the company, its products, other employees and customers, as well

as the disclosure of sensitive information. However, recent cases have shown that companies

sometimes go too far in attempting to control employees’ communications and may violate

state or federal labor laws. In the first social media case to attract the attention of the Na-

tional Labor Relations Board (NLRB), a Connecticut-based ambulance company, American

Medical Response of Connecticut, allegedly fired an employee in violation of federal labor

law for criticizing her boss on Facebook. The criticism violated the company’s written social

media policy. According to the NLRB, because federal labor law allows employees to openly

discuss working conditions, wages and other work-related topics, and since she made the

Facebook comments on her own computer and during her personal time, the employee’s

words constituted protected speech. American Medical Response of Connecticut settled the

suit in April for an undisclosed amount and agreed to revise its social media policy.

More recently, the NLRB issued complaints against two employers for firing employees based

on their Facebook postings. In one case, the NLRB issued a complaint against a Chicago-

area car dealership that terminated a sales employee because of Facebook postings that

criticized the dealership. The salesperson complained about substandard food and drinks

served at a dealership event promoting a new BMW model. In the other case, five employees

of Hispanics United of Buffalo, a nonprofit that provides social services to low-income cli-

ents, engaged in a Facebook discussion that criticized the organization’s working conditions,

staffing and workload. All five employees were terminated, ostensibly because the postings

Many companies have

social media policies

that prohibit certain

types of comments

about the company,

its products, other

employees and cus-

tomers, as well as the

disclosure of sensitive

information



harassed an employee referenced in the initial posting. In both cases, the NLRB maintained

that the postings were protected concerted activity because employees were discussing con-

ditions of employment.

Securities laws violations. In 2008 the Securities and Exchange Commission (SEC) issued

an interpretive release concerning dissemination of information to investors through compa-

ny websites. The release also contains guidance on “interactive web sites,” a phrase which

the SEC used in the context of social media applications on a company’s own website such

as blogs and electronic shareholder forums. The SEC views these means of interaction with

stakeholders favorably, but warned that, “since all communications made by or on behalf of

a company are subject to the antifraud provisions of the federal securities laws, companies

should consider taking steps to put into place controls and procedures to monitor statements

made by or on behalf of the company on these types of electronic forums.”7

While the SEC did not address third-party social networking services like Facebook and Twit-

ter, clearly the same issues apply. In addition to potential run-ins with the SEC, companies

need to be concerned about private securities lawsuits alleging fraud as a result of erroneous

or misleading information disseminated through social media.

Companies also should take care that company blogs, message boards, etc., or messages

posted by company employees in other public forums, do not expose the company to charges

of market manipulation or false rumors. They should assure that all outlets for discussion and

dispersal of information are being properly and lawfully used.

Loss Prevention

A growing number of companies have social media policies, but often they are focused exclu-

sively on unofficial employee use of social networking websites. Employee social media poli-

cies are important, but they address only a limited range of liability exposures. Companies

increasingly use social media for marketing and for communicating with investors and other

stakeholders. Policies should encompass all aspects of a company’s involvement in social

media, including:

» Maintain control over the creation of social media channels. Burson-Marsteller

found that companies engaged on Twitter, Facebook and YouTube tended to have mul-

tiple accounts: each active company reviewed in their survey had 4.2 Twitter accounts,

2.1 Facebook pages, and 1.6 YouTube channels. The PR firm found that for companies

with multiple Twitter accounts, typically one was a primary corporate account while

Companies also

should take care that

company blogs, mes-

sage boards, etc., or

messages posted by

company employees in

other public forums,

do not expose the

company to charges of

market manipulation

or false rumors



other accounts often “were started and managed by a local market office, represented

a research or special-interest division at the company or was related to a corporate spon-

sorship event the company was engaged in.” Researchers often found it difficult to de-

termine which Twitter account was the primary corporate account — if there was one.8

Enterprising divisions or branch offices should be applauded for their initiatives to

grow business or advance other aspects of an organization’s agenda, but compa-

nies need to control the messages delivered to stakeholders. No company Twit-

ter accounts, Facebook pages, YouTube channels or other similar social media

accounts or memberships should be permitted without official approval and cen-

tralized company guidance. Additionally, each account should be clearly identi-

fied such that there is no confusion as to which is the primary corporate account.

Some organizations have what sports network ESPN calls “forward-facing talent,” –

analysts, reporters, columnists, etc. – who may have their own blogs, Twitter accounts

or Facebook pages. These forums may be clearly identified as belonging to the indi-

vidual, not the employer, but forward-facing talent often is perceived as representing

his or her employer despite strong disclaimers. As a result, some organizations treat

these blogs, etc., as if they were official outlets of the company, and limit what this

class of employee is allowed to discuss in these forums.

» Provide training to employees designated to represent the company through

social media channels. Companies should designate employees who are autho-

rized to represent the organization through social networking. Other employees should

be informed that they are not authorized to speak on behalf of the company. Au-

thorized company representatives should have training to assure they professionally

represent the company and that they avoid such things as defamation, trade libel,

copyright infringement, consumer fraud, and disclosure of non-public information.

Some employers may tolerate, or even encourage, business networking through so-

cial media such as LinkedIn. These forums can be powerful tools for cultivating a

network of sales prospects, communicating with clients, and staying abreast of the

latest developments within one’s business community. Companies should be aware

of – and have veto power over – all employees using LinkedIn or similar social media

for company-related purposes. Written social media guidelines are essential, and

training similar to that provided to employees contributing to official company social

networking outlets is advisable.

Some organizations

have what sports

network ESPN calls

“forward-facing

talent,” – analysts,

reporters, columnists,

etc. – who may have

their own blogs,

Twitter accounts or

Facebook pages



» Identify the types of information that require legal review before being re-

leased. Some companies require legal review of all communication with stakehold-

ers. However, that may not be practical or desirable for social media, where a greater

degree of personalization, spontaneity and timeliness are expected. Certain types of

information nonetheless will always require input from a lawyer before being released.

Examples include financial disclosures; discussions about competitors or their prod-

ucts; and information about the company’s own products, especially if making claims

about their safety, security or performance relative to other products.

» Develop procedures and standards for using social media to research job can-

didates. Employment law experts advise that posting and adhering to objective job

criteria is a first step in avoiding allegations of discrimination from rejected candidates.

It is far more defensible to reject a candidate who doesn’t have the requisite number

of years of experience, for example, than it is to reject one who fails the “good people

skills” criterion. Nonetheless, most hiring decisions are at least partially subjective,

and having knowledge of such things as candidates’ sexual orientation or disabilities,

which may come to light when reviewing social media activities, can lead to trouble.

The Catch-22 for employers is that it could be alleged they were negligent if they

failed to review all available information about a candidate, and something easily

discoverable becomes a factor in subsequent injury caused by the employee. Since it

is advisable that employers review social media for red flags, but problematic if they

discover in the process that the candidate belongs to a protected group, some em-

ployers are using third party services to conduct social media reviews. These services

produce a report that highlights both positive and negative attributes, but does not

include sensitive information that could be the basis of discrimination allegations.

» Incorporate social media into an enterprise risk management framework. So-

cial media can touch many parts of an organization and can result in financial, repu-

tational and regulatory risks. Areas involved with social media, or which should be

providing input into social media policies, include marketing, human resources, in-

vestor relations, corporate communications, risk management and the general coun-

sel’s office. Companies with enterprise risk management (ERM) frameworks in place

may be able to more easily accommodate the multidisciplinary, cross-departmental

requirements of managing social media exposures.

The Catch-22 for em-

ployers is that it could

be alleged they were

negligent if they failed

to review all available

information about a

candidate, and some-

thing easily discover-

able becomes a factor in

subsequent injury caused

by the employee



Insurance

Despite companies’ best efforts to manage their social media exposure, lawsuits can happen.

Insurance coverage is essential.

Coverage for some social media exposures may be available under traditional Commercial

General Liability policies, but most likely for limited circumstances. The insurance industry

has responded in recent years to social media and other online exposures by introducing

specialized cyber liability policies. In addition to coverage for some social media activities,

cyber liability policies cover other risks associated with doing business digitally such as data

security. Social media-related exposures typically covered by a cyber liability policy include

defamation, trade libel, invasion of privacy, copyright infringement, plagiarism, and infringe-

ment of title, slogan, trademark, trade name, trade dress, service mark or service name.

Cyber liability policies provide broad coverage, but they usually do not address the full range

of social media exposures. Insurance buyers should work with their brokers to assure their di-

rectors & officers liability (D&O) policies and employment practices liability insurance (EPLI)

policies will respond to social media claims brought by, as applicable, shareholders, competi-

tors, regulators and employees. Professionals offering advice throught blogs and other social

media channels should assure they have appropriate errors & omissions insurance.

Employee-related Exposures

This report addresses risks to companies for their own activities as concerns social media. Of

equal, or perhaps even greater, concern is the unsupervised activities of employees that can

have adverse effects on companies. Exposures include:

» Disclosure of privileged or confidential information;

» Defamation and trade libel;

» Harassment of other employees;

» Violation of consumer fraud laws; and

» Other activities that denigrate or embarrass the company, other employees, customers or

business partners.

Even if a company is not active in social media, it needs to be concerned about the social

networking activities of its employees. All companies should have social media policies and

have appropriate insurance coverage. The next report in this series, Social Media: Employ-

ers’ Liability for the Activities of their Employees, will look in detail at these exposures and

outline practical steps for managing the risks.

NOTES:1 “Audience Growth on Facebook: Top 25 Country Markets,” Inside Facebook, http://gold.insidenetwork.com/facebook/

2 “#numbers,” twitter blog, http://blog.twitter.com/2011/03/numbers.html

3 The Global Social Media Check-up: Insights from the Burson-Marsteller Evidence-Based Communications Group, Burson-Marsteller. p.2

4 Michael A. Stelzner, 2011 Social Media Marketing Industry Report: How Marketers are Using Social Media to Grow Their Businesses, Social Media Exam-iner, p. 5 (http://marketingwhitepapers.s3.amazonaws.com/SocialMediaMarketin-gReport2011.pdf)

5 The Global Social Media Check-up: Insights from the Burson-Marsteller Evidence-Based Communications Group, Burson-Marsteller. p.4

6 “Social Media Being Used to Screen Job Applicants,” Oh My Gov!, April 1, 2010 (http://ohmygov.com/blogs/general_news/archive/2010/04/01/social-media-being-used-to-discriminate-against-job-appli-cants.aspx)

7 SECURITIES AND EXCHANGE COMMIS-SION 17 CFR Parts 241 and 271 [Release Nos. 34-58288, IC-28351; File No. S7-23-08] COMMISSION GUIDANCE ON THE USE OF COMPANY WEB SITES p. 43

8 Burson-Marsteller p. 9

Documents

Business Gold Mine or Liability Landmine?