Privacy and social media in the workplace

Revised: August 2019

What is social media?

Social media such as Facebook, Twitter Instagram and LinkedIn, are Internet-based services that provide individuals a way to interact with each other online. Some organizations may allow employees to access and use their personal social media accounts in the workplace during normal work hours or break-times. Other organizations might develop their own, internal social media to help employees work collaboratively — regardless of their physical location. Some organizations may establish official, external social media accounts to communicate with customers, business partners or the media.  

Using social media in the workplace

The use of social media in the workplace raises privacy implications for both employees and employers. Organizations should develop policies on the appropriate use of social media in the workplace.

Privacy implications for employees

Most individuals view their personal social media pages as private. However, employees should be aware that any of the information or communications posted on their social media can potentially be accessed by:

• current or potential employers;
• recruitment agencies;
• co-workers;
• the employer’s competitors;
• government and law enforcement agencies;
• others outside the employee’s trusted network.

Depending on the privacy settings set by the individual user, personal information and communications posted on a social media site can be read by unintended people. 

Monitoring employee social media

• Employees should know that, subject to existing workplace policies and rules, some organizations monitor their employees’ social media.
• Employees should be aware that when using social media in a workplace context — including a social media account hosted by their employer — that their personal information can be collected, used and disclosed by the employer. This could include off-duty comments and postings on social media about workplace issues or that may otherwise reflect on the employer.
• Employers should view tracking existing employees through personal or work-based social media as a collection of personal information that may be subject to applicable privacy legislation in their jurisdiction.

Implications for staffing and recruitment

Many employers and recruitment agencies use Internet search engines and read personal social media, websites and blogs to learn more about job applicants – and existing employees.  During the staffing process, this practice may become a problem if it substitutes for more formal and thorough reference checks.

• Employees should know that social media information may seem transitory and informal, but once personal information is posted online it gains permanence — and can be circulated and searched by others.
• Employers and recruiters should be aware that social media pages, even if publicly available, can contain inaccurate, distorted or out of date personal information about job applicants, and should therefore be cautious about relying on that information.
• Employers and recruiters should also guard against using personal information gathered from social media — or any other online source — in a discriminatory manner against a job candidate or an existing employee.

Consequences of inappropriate disclosure on social media

Employers and employees should be aware of the potential damages to individuals and the corporation through inappropriate disclosures of personal or confidential business information on social media. The possible consequences of an improper or unintended disclosure may be:

• a defamation lawsuit;
• copyright, patent or trademark infringement claims,
• a privacy or human rights complaint;
• a workplace grievance under a collective agreement or unfair labour practice complaint;
• criminal charges with respect to obscene or hate materials;
• damage to the employer’s reputation and business interests.

Legal responsibility for damages from an inappropriate disclosure could potentially rest with individual employees, management or the organization as a whole.

Employers: Develop and communicate a clear policy on social media

While many employers have guidelines and codes of conduct for e-mail and Internet use, social media poses different privacy challenges which should be specifically addressed in conjunction with these other workplace rules.  Clear rules and policies drafted specifically on the use of social media should be communicated to all employees.

The policy should generally establish best practices and outline expectations for acceptable use of social media in the workplace, set out the consequences of misuse, and address any workplace privacy issues.

Specifically, the policy should address:

• whether the organization permits the use of personal or employer-hosted social media in the workplace;
• if social media accounts  are permissible, in what context and for what purposes may they be used?
• whether the employer monitors social media sites;
• what legislation applies to the collection, use or disclosure of personal information in the workplace;
• what other rules may apply to the use of social media in the workplace (collective agreements; other relevant legislation);
• the consequences of non-compliance with the policy and,
• any other existing policies about the proper use of electronic networks with respect to employee privacy and handling confidential information.

Determine what data should not be disclosed

Employers should inform employees in plain language why it’s important to keep some personal and corporate information – about themselves, their co-workers, clients and the organization – confidential or undisclosed. Similarly, employers need to exercise judgment and abide by applicable privacy and other legislation if they decide to collect, use or disclose personal information from social media sources.  A privacy-friendly workplace calls for fair use of information by all parties.

A word on jurisdiction

In Canada, the Privacy Act deals with the collection, use and disclosure of personal information (including employee information) in the federal public sector. Both the OPC and Treasury Board Secretariat have produced guidance that may be helpful to understanding the use of social media in the workplace. Every province and territory has some form of public sector privacy legislation and an oversight authority.  

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s private sector privacy legislation. In the employment context, PIPEDA only applies to federal works, undertaking or businesses (FWUBs) in respect of their treatment of personal information of employees and applicants for employment with FWUBs.