Social Networking Sites: Savvy Screening Tool or Legal Trap?

Social networking sites (e.g., Facebook, MySpace, LinkedIn, Twitter, etc.) are fast becoming a popular tool for employers seeking information about job applicants. It has been reported that the number of employers currently using social media during the recruitment and hiring process has more than doubled in the past two years. According to the same source, 45 percent of employers currently use social networking sites to screen potential job candidates and 35 percent of those employers have rejected an applicant because of information they discovered, such as inappropriate pictures, information regarding alcohol or drug use, and postings in which the applicant “bad-mouthed” a former employer, bragged about prior acts of misconduct or made discriminatory remarks.

The incentives for an employer to use a social networking site are clear: It is fast, free and easy. There can be little doubt that social networking sites contain a potential treasure trove of information about an applicant’s character. Employers want the best fit for the organization and the particular position, and online information may help in making that determination. However, employers should be aware that online profiles often contain inaccurate information and information that may be easily taken out of context or misunderstood. An individual may have little control over the information on his or her “wall” or message board.
 

Just as important, employers should be mindful that they may learn things about applicants that cannot legally be used to make hiring decisions, even though the information is publicly available. For example, employers all know that it is illegal to make a hiring decision based on an individual’s race, religion, disability, sexual orientation, or other protected characteristic. In fact, in New York, an employer cannot ask an applicant for those types of information. But it is nearly impossible to visit a job applicant’s MySpace or Facebook page without also accessing those types of information. For example, in addition to the general information contained in an individual’s Facebook profile, which may list gender, marital status, religion, and age, an individual’s profile picture will reveal his/her ethnicity and, if not already disclosed in the profile, the individual’s sex. Most of this information will be revealed even if the individual takes advantage of the sites’ privacy features that limit who can become a “friend” or a member of the individual’s network.

In addition, most Facebook users post pictures of their family and friends on their pages, which may reveal a lot about their personal lives. This too can present an employer with information it may not want to have. For example, an employer might find pictures of a job applicant’s baby shower on her Facebook page. Of course, an employer cannot legally refuse to hire the applicant because she is pregnant, but once it has the information it has increased the risk of having to defend such a claim.

In addition to containing information about an applicant’s membership in classifications protected under the equal employment opportunity laws, an individual’s union activity or affiliation may also be readily discoverable. In addition to general “union organizing” pages, many unions have developed Facebook pages. In using social media screening, an employer might discover that a particular job applicant is a “fan” of a union that has been attempting to organize the company at which the applicant has applied. It would be unlawful for an employer to discriminate against an applicant based on such union activity or affiliation.

And employers cannot assume that their online searches will remain secret. Today, electronic discovery is sought in most discrimination lawsuits and may include records of online searches of social networking sites

So what can employers do to minimize the risk that this valuable tool will lead to liability? At a minimum, employers who use online searches should develop a fair and uniform policy and procedure for online searches. Employers should determine if social networking checks will be conducted, for what job categories or positions, the scope of such searches, and the types of information to be obtained and documented. The policy should also address the time during the hiring process when such screening will occur, preferably later in the hiring process to limit the number of applicants affected. Most importantly, the individual conducting the screening should not be a decisionmaker, should report only relevant information, and should not record or report any information which an employer could not lawfully solicit on an employment application. If using a third-party to conduct such screening, compliance with federal and state fair credit reporting obligations is required.

As with all steps in the hiring process, the information obtained and relied upon should be documented and retained with other hiring records. By using a policy to define the criteria or information to be sought in the screening, employers can more easily manage the documentation task by retaining only information which meets the designated search criteria. Finally, once it has been determined what job categories or positions will be subject to screening, employers should be consistent in conducting searches only when filling those positions.
 

Dealing with Employee Use of Social Networking Sites

Being at work apparently poses no obstacle to checking the Facebook or MySpace status of friends and keeping up-to-date with the continuous “tweets” on Twitter.  According to a recent study  conducted by Nucleus Research, 61% of all employees access their Facebook profiles at work. While the length of time employees are plugged-in varies from one to 120 minutes per employee per day, according to the same study employers lose an average of 15 minutes of productivity per day from each social networking employee.

What is an employer to do?

An employer can prohibit accessing social networking sites during working hours.  But this approach may have its own detrimental side effects on employee productivity.  According to one university study, employees who surf the Internet at work, including accessing Facebook and YouTube, are 9% more productive than their non-Internet surfing counterparts.  A ban on employee access to social networking sites can also limit the potential benefits an employer might receive from such sites.  For example, the networking site LinkedIn can serve as a valuable tool for businesses looking to build relationships with potential clients/customers.  And, as one researcher has noted, sites like Facebook can assist employees in building relationships with professional acquaintances which can benefit their employers in the long run.

 Monitoring employees’ use of Twitter, Facebook, MySpace, and other social networking sites is another option.  But monitoring employee use of such sites raises several legal issues, including, in particular, whether an employer that accesses an employee’s social networking page without the employee’s consent violates federal law.

Social networking sites offer subscribers a variety of protections to keep their posts private or semi-private.  If a subscriber sets his profile to “private/friends only,” he can reasonably expect that his employer will not have access to his profile posts or pictures unless he accepts the employer as a Facebook “friend.”  But picture this scenario: Co-workers engage in a dialogue critical of their employer on a MySpace page that can only be accessed by individuals invited and authorized by the page creator to view it.  The employer then terminates these employees after learning about the page and its posts from an authorized viewer. Legal? According to the court in Pietrylo v. Hillstone Restaurant Group d/b/a/ Houston’s, (D.N.J. 2008) , the answer to that question depends, in part, on whether the employer violated a federal statute, the Stored Communications Act (“SCA”) (18 U.S.C. § 2701 et seq.).

The SCA applies to communications stored on Internet sites (such as Facebook, MySpace, Twitter, etc.). It imposes criminal penalties on individuals who gain unauthorized access to such stored communications. Employers can run afoul of the SCA by covertly monitoring their employees’ private social networking postings by, for example, using spyware to track keystrokes to gain log-in information. But the Act’s protections extend beyond such covert measures. “Unauthorized access” also encompasses situations where authorized access is exceeded.  The Act excepts from liability “conduct authorized … by a user of that service with respect to a communication of or intended for that user.”  So long as the information is freely provided by someone who is authorized to and has accessed the private website, the Act permits an authorized user to allow a third party to gain access to the same information the authorized user has access to.

In Pietrylo, the employer gained access to an employee’s password-protected, “by invitation only,” MySpace page when an invited member of the page (also an employee) showed it to a manager at a dinner party. The manager thereafter asked the invited member for her log-in name and password, and used that information to repeatedly access the page and its postings. The court held that a jury could find this means of access not “authorized” under the SCA, if the invited member’s consent was given under duress (the invited member thought that she could get in trouble with the company if she did not provide the information). The jury ultimately returned a verdict against the employer, and found that the employer had, in fact, gained unauthorized access to the MySpace page in violation of the SCA.

The Pietrylo decision and verdict does not mean that every request for log-in information will violate the SCA. Had the invited member in Pietrylo freely given the employer her log-in information, the employer would likely have faced no liability. But whether consent is freely given will often be a difficult question to answer, so employers should be cautious when making requests.

Moreover, the potential legal issues raised by accessing a social networking site do not end with the question of authorized access. Once access is lawfully gained, the issue then becomes, what, if anything, employers can do with the information that is discovered. For an overview discussion of those potential legal issues, see Employers: ‘Keep out!’ Beware intruding in employee web sites by Louis P. DiLorenzo.