Privacy and Ethics For Social Media In Investigations
From the Experts
It begins with a name—perhaps an employee alleged to have been involved in misconduct or a suspected whistleblower. Regardless of the origin of identity, if the person is relevant to a company’s internal investigation, whatever information that can be provided is power for the company, the power to make informed decisions.
Thus, the initial instinct of those conducting such investigations is to find all relevant information. Often, such individuals will have made a direct record of their employment history on LinkedIn and potentially pontificated about life, work, thoughts and deeds on Facebook. Although Twitter can, at times, be unintelligible, those tweets are additional 140-character insights into that person’s potential knowledge. All it takes to find out is some quick and inexpensive Internet browsing.
Despite the allure of such a fast gathering process of candid information, counsel conducting internal investigations should curb their impulse to freely access and use social media accounts. Although the business world and legal profession are still catching up with recent technology, change is quickly being promulgated in the form of statutes, professional rules and website policies that limit such access. Investigative counsel would be well served to consult with ethics professionals about these developing rules and policies prior to the initiation of any such investigative process.
Employee Usernames and Passwords
Using a person’s username and password to a social media site, often available due to the person’s use of company computer systems, allows access to the greatest level of detailed information. This access not only reveals information hidden from the public by privacy settings, but will also allow access into private messages the individual may have sent or received.
Over the last 18 months, however, 36 states have introduced or enacted legislation that prevent employers from requesting access to employees’ full profiles. As one example, Illinois amended its Right to Privacy in the Workplace Act by making it unlawful:
“. . . for any employer to request or require any employee or prospective employee to provide any password or other related account information in order to gain access to [their] . . . account or profile on a social networking website.”
In addition to the state’s enforcement rights, employees and prospective employees can file suit for a violation and may receive actual damages, costs and attorneys’ fees. Illinois’s law does not make an exemption for internal investigations, as has some of the state legislation. See Cal. Lab. Code § 980(c) (allowing employer access to social media accounts “where reasonably believed to be relevant to an investigation . . . provided that the social media is used solely for purposes of that investigation or a related proceeding”). Additionally, the surreptitious use of such usernames and passwords, without the consent of that person, raises concerns under the Computer Fraud and Abuse Act and potential ethical violations.
Similar to the amalgamation of state data breach laws, each state has different standards and exemptions for employers’ access to social media. Thus, at the start of an investigation, the state laws for any relevant employees should be carefully scrutinized if employers want to access, with consent, any employee’s full profiles, and more often than not, such access will not be available in an internal investigation and should be avoided accordingly.
For some of the main social media sites, such as Facebook and LinkedIn, certain information from an individual may be hidden from the public but available to others who have asked that individual to be “friends” or “connections.”
Further, directly applicable to lawyers are the professional ethics opinions that indicate that such practices can violate ethical rules. The Professional Ethics Committee of the New York State Bar released an ethics opinion that said that although lawyers can use their real name to contact an unrepresented party through social media, lawyers “and their agents” cannot do so “under false pretenses to obtain evidence.” Along a similar vein, the Philadelphia Bar Association’s Professional Guidance Committee issued an opinion that the same ethical rules are violated where a third party, at the request of an attorney, sends a request to connect to a witness unknown to him without telling the person the nature of the request, in order for the lawyer to ultimately gain access to that person’s profile information.
Publicly Available Information
Based on the roadblocks outlined above, investigative counsel might decide to view only the information made public on social media by the subject. Unfortunately, this, too, is not so simple.
For example, LinkedIn offers a service that enables users to see who has viewed one’s profile in the preceding 90 days. For an investigation witness represented by counsel or who might not understand the investigation, the notification that a profile was viewed could again implicate or violate professional rules. There are potential workarounds—LinkedIn users can set their account settings to stay anonymous as to whose profiles they have viewed—but this again requires close diligence from investigative counsel in doing such searching.