Social Media Week Part VI – Social Media and CCO 3.0

I conclude this exploration of the uses of social media in doing compliance by exploring why the compliance function is uniquely suited to using social media tools. Long gone are the days when Chief Compliance Officers (CCO) or compliance practitioners were lawyers housed in the Legal Department or the General Counsel’s (GC’s) office writing policies and procedures and then putting on eight hour training programs on same. Donna Boehme has written passionately about CCO 2.0 and the structural change to separate the CCO role from that of the GC because of the differences in focus of a CCO and GC. Simply put, a GC and legal department is there to protect the company while the CCO and compliance function exists to solve problems before the company needs protections from them.

Freed of the constraints to write policies and procedures by lawyers for lawyers, the profession has moved to integrating compliance directly into the fabric of the company. I often say that a Foreign Corrupt Practices (FCPA) compliance program is a business solution to a legal problem. The problem is how to comply with the FCPA and other anti-corruption regimes. The solution is to burn compliance into the DNA of your company so that it is not only owned by the business unit but also acted on by the business unit in its day-to-day operations.

I think this means that we are now moving to CCO 3.0 where a CCO or compliance practitioner is putting compliance into the forefront of how a company does business. The example of safety comes to mind when every corporation I ever worked at made clear that safety was everyone’s responsibility, literally from the shop floor to top of the company. I once heard of a Executive Vice President (EVP) of a major oil and gas operating company, while touring a contractor’s facility, stop the tour to point out that a contractor carry two bags of trash down a set of stairs was an unsafe practice and required the employee to carry one bag at a time so she could hold the handrail while descending the stairs. That is the level of the awareness of safety now.

The evolution of compliance is just as dramatic. Moreover, the compliance function should be on the cutting edge of moving it forward within your company. The important thing to remember about social media tools is precisely that; they are tools that a CCO, compliance practitioner or any company can use to communicate with their employee base. Put another way, social media is but one part of the communication ecosystem which can be used to market the message of compliance.

Last week I wrote that there are still many companies who do not allow their employees access to the most popular and useful social media tools at work or even on company computers. While these companies always claim it is due to security issues, the reality is that they simply do not trust or even respect their employees. In such a company, management is much more concerned about what employees might say about an organization than trusting that they not only want to do the right thing but will execute such a strategy when provided the opportunity to do so, through the mechanism of social media. This means that companies which trust and respect their employees do not have to worry about employees releasing confidential data through social media channels because there are plenty of other ways that employees can release confidential information if they were so inclined. Indeed think of the Dodd-Frank Whistleblower provision and how many employees who report to the Securities and Exchange Commission (SEC) reported or tried to report internally before going to the SEC. Simply put if a company does not trust and respect its employee base, communicating the message of compliance throughout an organization will be more difficult but that is clearly not the signal senior management is sending to its employees.

The compliance function must engage with its customer base, AKA the employees in a company. Charlene Li, in her recent work “The Engaged Leader”, said in the introduction “In order to be truly effective today, leaders in business and society must change how they engage, and in particular how they establish and maintain relationships with their followers via digital channels.” The same is true for the compliance function. She believes that technology has changed the dynamic between leaders and their followers. In The Engaged Leader she explains:

• Why leaders need to master a new way of developing relationships, which begins by stepping out of traditional hierarchies
• How to listen at scale, share to shape, and engage to transform
• The art of making this transformative mind shift
• The science of applying the right tools to meet your strategic goals

Li believes that “This transformation is not optional. Those who choose not to make this change will be abandoned for those who inspire people to follow them.” In an interview for the podcast HBR Ideacast, entitled ““Social Media Savvy CEO” is no Oxymoron”, Li further expounded on these views. She asked why a leader would be afraid to engage with those in his or her corporation? But more than simply engagement, she asked why would a leader want to cut themself off from the best source of information for them and available to them; their employee base, through social media. After all, every company strives to have an active engagement with their customer base so why not have it with employees.

Now change out Li’s language from ‘leaders’ and insert ‘CCOs or compliance practitioners’. I think it is even more critical for the CCO or compliance practitioner because doing compliance is something that should occur in the business units. Yes a CCO can put those policies and procedures in place but it is the folks in the field who must implement them going forward. If social media can be a tool to help facilitate doing compliance why not embrace it for communications, training, input, problem identification or resolution?

Yet there is another reason for the compliance function to embrace social media going forward. One of my favorite thought leaders around innovation in the legal arena is Professor David Orozco. In a blog post, entitled “Innovation in the Legal Sector”, he said, “Innovation is a big deal. It’s been a big deal ever since customers rewarded differentiation and punished companies that failed to maintain their creative edge.” The same is equally, if not more so, applicable to the compliance arena. The Department of Justice (DOJ) has consistently made clear that FCPA compliance programs should be evolving and using the newest and best tools available. That sounds suspiciously like social media to me. So if these tools are available to you and at a very reasonable cost (i.e. free) why not consider using them. If you are afraid of information getting out of your company, why not consider using the social media concepts behind your firewall in your company intranet system?

Finally, even if you cannot use some of the publicly available tools discussed earlier, there is no reason that you cannot incorporate the concepts into your compliance program. By that I mean you can use the communication ideas inside of your company for your compliance program. You can create the equivalent of a Tweet-Up where the CCO or others answer questions that employees submit. Similarly, you can live stream a Q&A session using the concepts articulated by Meerkat and Periscope for social media live streaming. Pinning compliance reminders or other information in some type of internal company bulletin board is using the basic concept of Pinterest. I am sure that you can accomplish the same by using SharePoint. Why not create an internal compliance reminder video series using the same tools that a millennial would use to create a Facebook post?

Think all of this sounds far-fetched? Think again. In this month’s issue of the Compliance Week magazine, Guest Columnist Raphael Richmond, the CCO at Ford Motor Company, in an article entitled “Compliance? There Should Be an App for That!”, detailed how the company has created an app for iPhone and Android devices that “allows users to access compliance information quickly, including brief, easy-to-understand policy summaries and answers to frequently asked questions (FAQs). The app also has a “Can I … ?” tab that acts as a quick decision tree for finding specific answers to commonly asked questions. Topics in our app address a range of compliance issues, from anti-bribery guidance to Ford’s approach to gifts and favors, meals, travel, and social events. Individuals can also report a suspected violation directly from the app to the Corporate Compliance Office.” It will certainly be exciting to see how Ford develops this tool going forward.

I often say that as a CCO or compliance practitioner you are only limited by your imagination. The use of social media in your compliance function is one that is crying out for imaginative usages. As we move to CCO 3.0, the compliance function will need to avail itself of all the tools it can to communicate the message of compliance. The DOJ currently requires companies that enter into Deferred Prosecution Agreements (DPAs) to keep abreast of technological innovations in compliance. How long do you think it will take for the DOJ to start asking how much compliance communication you have both up and down the chain? If you are not using a social media tool or even a social media technique you may already be behind the 8-ball and you certainly will be left behind in the marketplace of ideas going forward.

I hope that you have enjoyed this six-part series on the use of social media in your compliance program as much as I have enjoyed researching it, writing and posting it. If you are currently using social media tools, concepts or techniques in your compliance program please contact me, as I would appreciate the opportunity to learn more about what your organization is up to in that realm. Also, please remember that I am compiling a list of questions that you would like to be explored or answered on the use of social media in your compliance program. So if you have any questions email them to me, at tfox@tfoxlaw.com, and I will answer them within the next couple of weeks in my next Mailbag Episode on my podcast, the FCPA Compliance and Ethics Report.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Social Media Week Part V – Tools and Apps for the Compliance Practitioner

To conclude this week’s posts, I wanted to list some of the more prevalent social media tools, explain what they are and how you might use them in a compliance program. (As usual I got carried away so this series will conclude on Monday of next week.) You need to remember that your compliance customer base are your employees. The younger the work force, the more tech savvy they will be and the more adapted to communicating through social media. According to Social Media Examiner’s 2015 Social Media Marketing Industry Report, the top two social networks for marketing are Facebook and LinkedIn. The three social media tools that hold the top spot for social media planning are LinkedIn, YouTube and Twitter. Marketers report that video streaming is becoming increasingly important tools for markets and that is currently encompassed in Meerkat and Periscope. Finally, I would add that Pinterest is another hot social media app.

Facebook

If you do not know what Facebook is at this point, you may have just transported down from a Borg Cube or perhaps you are a Vulcan looking for First Contact. This is the world’s most ubiquitous social media tool. It combines both personal and business applications. For the compliance practitioner, think about the business uses of Facebook. You can open a Facebook page for your compliance function and share an unlimited amount of information. Equally importantly, you can be responsive when employees comment on your posts, it allows you to interact with them and demonstrate that compliance is listening and responsive. The more regularly you post, the more opportunity you have for connecting with your employee base and building trust.

YouTube 

Much like Facebook, YouTube is one of the most ubiquitous social media tools around. It allows you to upload video and audio recordings for unlimited play. For the compliance practitioner, why not consider creating a YouTube channel for your company’s compliance program. You can put together full training on specific issues or you can create short videos. For an example of short videos, you can check out the training videos I have on my website Advanced Compliance Solutions. If there is any information that you wish to put into a visual format, YouTube is one of the best solutions available to you.

LinkedIn

LinkedIn is almost as ubiquitous as Facebook and YouTube. As with Facebook, you can set up a business site or even a private compliance group for your organization. Your employees are the best place to start adding followers, as they are not only your target audience but they are also your biggest advocates. You can encourage employees to add their compliance profile to their personal profiles. By doing so, they automatically become followers and can like, comment on, and share your company updates to help expand your viral reach. As with Facebook, LinkedIn provides you a platform to communicate with your employee base. It has a chat function that can be used to solicit feedback and comments going forward. You can also tie in with or ‘link to’ other groups and people that can facilitate not only creating but also expanding your culture of compliance.

Twitter

Earlier this week, I wrote about how you can use Twitter to capture information from the marketplace of ideas. However Twitter can also be used for communicating with your employee base. Tweets are publicly visible by default, but senders can restrict message delivery to just their followers. Users can tweet via the Twitter website, compatible external applications or by Short Message Service (SMS) available in certain countries. Retweeting is when users forward a tweet via Twitter. Both tweets and retweets can be tracked to see which ones are most popular. Finally, through the use of hashtags (#) users can group posts to Twitter together by topic.

I believe that Twitter is one of the most powerful tools (and completely underused tools) that is available to the compliance function. If employees follow their company’s name through a hashtag, they can see what trending topics other employees are discussing. Compliance practitioners can help lead that internal discussion through the same technique. Moreover, if the Chief Compliance Officer (CCO) or compliance function regularly monitors Twitter they can keep abreast of any communications and those can be used as a backup communication channel, in case the company hotline or other reporting system is not immediately available or even convenient.

Meerkat and Periscope

Two of the newest and perhaps coolest tools a CCO or compliance practitioner can utilize in the realm of social media are Meerkat and Periscope. Both tools allow you to tell a compliance story in real time, throughout your organization and beyond through the capture and broadcast of video, live through your smartphone. They are both live streaming apps that enable you to create a video and open the portal to anyone who wants to use it. Anybody in your Twitter community can click on that link and watch whatever you’re showing on your phone. The big piece is the mobile aspect. It is as simple as a basic tweet and hitting the “stream” button.

This is one of the more exciting new social media tools I see for the compliance practitioner. You could start a compliance campaign along the lines a campaign that the company Hootsuite initiated called “Follow the Sun” using Periscope. They decided to let their employees showcase what they called #HootsuiteLife. They gave access to different people in every company office around the globe. Throughout the day, it would “Follow the Sun,” and people in different offices would log into the Hootsuite account and walk around and show off their culture, interviewing their friends, etc. They talk about the importance of culture and now they are proving it. The number of inbound applications drastically increased after people got that sneak peek into their company. You could do the same for your worldwide compliance team.

You can live stream video training around the globe. Moreover, if you use either of these tools in conjunction with internal podcasting or other messaging you can create those all important “Compliance Reminders” which were so prominently mentioned in the Morgan Stanley Foreign Corrupt Practices Act (FCPA) Declination. The videos that you create with both of these tools can be saved and stored so a record of what you have created can be documented going forward.

Pinterest

According to Pinterest for Dummies, this tool is an online bulletin board, a visual take on the social bookmarking site, where the content shared is driven entirely by visuals. In fact, you cannot share something on Pinterest unless an image is involved. When you share something on Pinterest, each bookmark is called a pin. When you share someone else’s pin, it’s called a repin. Your group pins together by topic onto various boards, aka pinboards, in your profile. Each board mimics a real-life pinboard. You can share images you find online, or you can directly upload images. Using the “Pin It” button, you can share directly in your browser from any web page. You can also share your pins on Twitter and Facebook.

Although a relatively new social media tool, I find it to be one of the more interesting ones for use by the compliance function as it compliments many of the other tools I discussed above. You can set up your compliance account for your organization and pin items, lists, or other visual information that can be viewed and used by employees. In addition to the enumerated items, you can pin such things as a link, a website, graphics or other forms of information. If you think of it as an online bulletin board, you can consider all of the compliance information that you can post for your customer base and the interactions they can have back with you.

All of these tools can help you as CCO or a compliance practitioner to engage with your customer base. On Monday, I will conclude with some final thoughts on why the compliance function should use social media tools available to them.

Once again please remember that I am compiling a list of questions that you would like to be explored or answered on the use of social media in your compliance program. So if you have any questions email them to me, at tfox@tfoxlaw.com, and I will answer them within the next couple of weeks in my next Mailbag Episode on my podcast, the FCPA Compliance and Ethics Report.

 

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

 

© Thomas R. Fox, 2015

Social Media Week Part IV – Telling a Story About Honey

I continue my exploration of the use of social media in doing compliance by taking a look at a very innovative social media solution to a difficult compliance issue around, of all things, honey. This example shows how creative thinking by a lawyer, in the field of import compliance, led to the development of a software application, using some of the concepts that I discussed earlier in the week around social media. Once again demonstrating the maxim that lawyers (and compliance practitioners) are only limited by their imagination, the use of this software tool demonstrates the power of what social media can bring to your compliance program.

This innovation contrasts with a reader’s comment earlier this week when I began my series on the use of social media in doing compliance. The comment was that this reader’s company, while actively using social media to reach, communicate with and receive information back from its customer base; did not allow employees to access Facebook, Twitter, Pinterest, Snapchat and a whole host of other social media sites on company purchased computers. While the company’s stated reason was security, the true reason is that they simply did not trust their employees not to “waste time” by accessing such sites during work hours.

Such corporate attitudes, while clearly from the time of the dinosaurs, unfortunately still exist. Companies need to understand that social media is a tool which can and should be used affirmatively. Like any tool, it can be abused but if you cannot trust your employees not to goof off (1) they probably should not be your employees and (2) the company is a lousy manager; so there is lots of opportunity for growth. It reminds of when I was working for a corporation back in 2004 and they did not want employees to have company issued cell phones, because you know they might use them for personal use. The bottom line is that social media is here to stay. Millennials and others are only going to communicate through that medium so if companies want to stay relevant, not only with products and services but also with their employee base, they need to understand that social media is an important and significant tool of the future. But enough of my mini-Howard Sklar rant.

Gar Hurst, a partner in the law firm of Givens and Johnston PLLC in Houston, faced an issue around US anti-dumping laws for honey that originated in China. The US Government applies anti-dumping trade sanctions to goods from a particular country. They do this when a domestic interest group alleges and proves, at least theoretically, that the producers in a foreign country are selling their goods into the US market at below fair-market value. By doing this, they are harming the US domestic industry. The dumping duties, which can result from this, can easily be 100, 200, even up to 500 % of import duties. To get around the anti-dumping laws, importers would ship Chinese originated honey to Indonesia, Vietnam or some other country and pass it off as originating from one of those locations.

The problem that Hurst’s client faced was how to prove the honey did not originate from China. In an interview, Hurst said, “We were working with a Southeast Asian honey producer. They were in this situation where Customs was essentially treating them as though they were a Chinese producer. We’ve provided them documents. We’ve provided them invoices. We’ve provided them production docs. We’ve provided them all sorts of documents but there was nothing that we could give them documentary that they didn’t believed could be fake. That was the problem, documents on their face are just a form of testimonial evidence. Meaning, somebody somewhere said, this stuff is actually from the Philippines. It’s only as good as the word of the person who wrote it on. We needed something that would get beyond that problem.”

So using awareness around communications through a smart phone, Hurst and his team came up with an idea “that with the explosion of smartphone technology which is in the hands of basically everybody in the United States and soon to be everyone in the world, these devices basically allow a person to take a picture that is geo-tagged and time and date stamped and then upload that picture to a database in the cloud. Effectively, that’s what we did.” As Hurst explained the process which they came up it was amazingly simply, “We basically created an app that resided on Android phone that they could then go around and document the collection of all these various barrels of honey and its processing. Every time they take a picture, it would be time and date stamped with geo-tagging as well. You know when and where a picture of a particular barrel of honey which we would label with some special labels so you could identify it when and where that was taken.” The product they came up with is called CoVouch.

From there the information is uploaded into a secure database that Hurst and his team created in the cloud. His firm then took all of the evidence they had documented that the honey originated in Indonesia, not China, and presented it to the US Customs service to show his client had not sourced its honey in China. In version 2.0 Hurst and his development team are creating a searchable database which US Customs can use to make spot checks and other determinations.

Recognizing the level of technical sophistication of honey farmers in Asia, CoVouch is amazingly simply to use. It takes pictures, puts time stamps on them and puts geo-tags that show the location where the picture was taken and with glued or pasted on bar codes, you can trace the shipment of honey throughout its journey. But it does so in a way that tells a story. Hurst said, “you’re telling the story but the provenance, if you will, of one imported barrel of honey and how did it get to where it’s at. It’s different. Yeah, that’s right. That’s exactly what we’re trying to do and trying to do it in a way that is easy enough so that, as you put it, a fairly, uneducated farmer in Indonesia can do it and a busy Customs agent in the United States can review it.”

Such a software system uses the concepts around social media to make a honey farmer a provider of documents evidence, through photographs, to meet US anti-dumping laws. But I see the application as a much broader tool that could be used by anyone who needs to verify information on delivery, delivery amounts, delivery times and delivery locations. This could be a field hand who is delivering chemicals even West Africa and does not know how to speak English. Hurst pointed to uses around whether something might be eligible for special import or export regulations due to NAFTA, whether restricted trade goods, such as those used in the oilfield industry, worked their way into Iran and even applicability under the Buy American Act around the US content in goods.

For the anti-corruption compliance practitioner, you could use such a tool to not only receive information, and more importantly photographic evidence, but you could also deliver information. But the key is that you are only limited by your imagination. CoVouch could be a tool that you use internally for delivery of information and receipt of information inside your company.

Tomorrow I will end my weeklong exploration of the use of social media in your compliance program by discussing some of the more common social media applications and how you might use them.

Once again please remember that I am compiling a list of questions that you would like to be explored or answered on the use of social media in your compliance program. So if you have any questions email them to me, at tfox@tfoxlaw.com, and I will answer them within the next couple of weeks in my next Mailbag Episode on my podcast, the FCPA Compliance and Ethics Report.

To check out the CoVouch website, click here.

To listen to my podcast with Gar Hurst, go to the FCPA Compliance and Ethics Report, Episode 181, by clicking here.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Social Media Week Part III – Twitter and Innovation in Your Compliance Program

I continue my exploration of the use of social media in your Foreign Corrupt Practices Act (FCPA) compliance program today. One of the ways that Chief Compliance Officers (CCOs) and compliance practitioners can communicate about their compliance programs is through the use of the social media tool Twitter. In an article in the Summer issue of the MIT Sloan Management Review, entitled “How Twitter Users Can Generate Better Ideas”, authors Salvatore Parise, Eoin Whelan and Steve Todd postulated that “New research suggests that employees with a diverse Twitter network – one that exposes them to people and ideas they don’t already know – tend to generate better ideas.” Their research led them to three interesting findings: (1) “Overall, employees who used Twitter had better ideas than those who didn’t.”; (2) In particular, there was a link between the amount of diversity in employees’ “Twitter networks and the quality of their ideas.”; and (3) Twitter users who combined idea scouting and idea connecting were the most innovative.

I do not think the first point is too controversial or even insightful as it simply confirms that persons who tend have greater curiosity tend to be more innovative. The logic is fairly straightforward, as the authors note, “Good ideas emerge when new information received is combined with what a person already knows.” In today’s digitally connected world, the amount of information in almost any area is significant. What the authors were able to conclude is that through the use of Twitter, “the potential for accessing a divergent set of ideas is greater.”

However it was the third finding that I thought could positively impact the compliance profession, the role of the Idea Scout and the Idea Connector. An idea scout is “an employee who looks outside the organization to bring in new ideas. An idea connector, meanwhile, is someone who can assimilate the external ideas and find opportunities within the organization to implement these new concepts.” For the compliance practitioner, the ability to “identify, assimilate and exploit new [compliance] ideas” is the key takeaway. However to improve your compliance innovation, “you need to maintain a diverse network while also developing your assimilation and exploitation skills.”

For the compliance practitioner, Twitter can be “described as a ‘gateway to solution options’ and a way to obtain different perspectives and to challenge one’s current thinking.” Interestingly the authors found that “It’s not the number of people you follow on Twitter that matters; it’s the diversity within your Twitter network.” The authors go on to state, “Diversity of employee’s Twitter network is conductive to innovation.” Typically an Idea Scout will “identify external ideas from experts and resources on Twitter.” Clearly the compliance practitioner can take advantage of experts with the anti-corruption compliance field but there is perhaps an equally rich source of innovation from those outside this arena.

An interesting approach was what the authors called the “breadcrumb” approach to finding innovation leaders and thought-provokers. It entailed a “period of “listening” to colleagues and industry leaders who are on the platform – including what they are tweeting about, who they are following and replying to on the platform, who is being retweeted often”. So with most good leadership techniques the first key is to listen.

Equally important to this Idea Scout is the Idea Connector, who is putting the disparate strands from Twitter’s 140 character tweets together. For the compliance function, this will be someone who identifies compliance best practices or other information from Twitter ideas, can then put them together and direct the information to the relevant company stakeholders. Finally, such a person can “Curate Twitter ideas and matches them with company resources needed to implement them.”

Here the authors listed a variety of ways an Idea Connector can use Twitter. One user said, “I try to sift through all the Twitter content from my network and look for trends and relationships between topics. I put my analysis and interpretation on it. I feel that’s where my value-add is.” Another method is to focus on analytics and one user “filtered specific subsets of the topic for different stakeholders” at his company. Another method was to create “social dashboards or company blogs based on the insight” received thought Twitter. Interesting, one of the key requirements for successfully mining Twitter was in finding ways to share its content “since many employees, especially baby-boomers don’t use the platform themselves.” Conversely by mining information from Twitter and presenting it, this can allow these ‘technologically challenged’ older employees to ascertain how they can target millennial’s.

But as much as these concepts can move a CCO or compliance practitioner to innovation in a compliance program, it can also foster additional information through the following of your own employees. It is well known that Twitter can facilitate greater communication to and between the compliance function and its customer base, aka the company employees. However the authors also point to the use of Twitter to enable this same type of innovation because it “is different than email and other forms of information sources in that it enables continuous engagement”.

Twitter was created to allow people to connect with one and other and communicate about their activities. However the marketing potential was immediately seen and used by many companies. Now a deeper understanding of its use and benefits has developed. For the compliance practitioner one thing you want to consider is to align your Twitter and great social media strategy with your compliance strategy; match your Twitter strategy to your compliance strategy.

Twitter can be powerful tool for the compliance practitioner. It is one of the only tools that can work both inbound for you to obtain information and insight and in an outbound manner as well; where you are able to communicate with your compliance customer base, your employees. You should work to incorporate one or more of the techniques listed herein to help you burn compliance into the DNA fabric of your organization.

Once again please remember that I am compiling a list of questions that you would like to be explored or answered on the use of social media in your compliance program. So if you have any questions email them to me, at tfox@tfoxlaw.com, and I will answer them within the next couple of weeks in my next Mailbag Episode on my podcast, The FCPA Compliance and Ethics Report.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Social Media Week Part I – Using Social Media In Your Compliance Program

Welcome to Part I of Social Media Week. I recently did a webinar, hosted by The Network, on the use of social media in your Foreign Corrupt Practices Act (FCPA) compliance program. The response was as great as almost any other webinar in which I have participated. Based upon the overwhelming feedback, this week I will post a series of blogs on the use of social media in your compliance program. In Part I, I begin with a discussion of why you should integrate social media into your compliance program.

I have been studying the business side of social media for some time now as a way to help understand how I might more effectively and more creatively bring the message of doing compliance to my readers and podcast listeners. This led me to think about the message of compliance inside of a corporation and how it is distributed. In a compliance program, a large portion of your consumers/customers are your employees. Social media presents some excellent mechanisms to communicate the message of compliance going forward. Many of the applications that we use in our personal communication are free or available at very low cost. So why not take advantage of them and use those same communication tools in your internal compliance marketing efforts going forward.

On the Social Media Examiner site, which brands itself as “Your Guide to the Social Media Jungle”, is a podcast entitled “Social Sharing: How to Inspire Fans to Share Your Stories”, hosted by Michael Stelzner, Chief Executive Officer (CEO) and Founder of the site. In the podcast Stelzner interviews Simon Mainwaring, author of “We First: How Brands and Consumers Use Social Media to Build a Better World”, who said that to allow them to market successfully there are three key components, (1) Let your employees know what you stand for; (2) Celebrate their efforts; and (3) Give them a tool kit of different ways to participate. I think each of these concepts can play a key role for the compliance practitioner in internally marketing their compliance program.

Let Your Employees Know What You Stand For

In the FCPA Guidance, the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) said that the basis of any anti-corruption compliance program is the Code of Conduct as it is “often the foundation upon which an effective compliance program is built. As DOJ has repeatedly noted in its charging documents, the most effective codes are clear, concise, and accessible to all employees and to those conducting business on the company’s behalf.” That well known @CodeMavencc, Catherine Choe, has said that she believes “Two of the primary goals of any Code are first, to document and clarify minimum expectations of acceptable behavior at a company, and second, to encourage employees to speak up when they have questions or witness misconduct.”

But more than the Code of Conduct, does your company really communicate that it stands for compliance? Obviously formal anti-corruption training under the FCPA is important but I think that more is required to reinforce that your company has a culture of compliance throughout the organization. In other words, are you communicating what you stand for and not simply the rules and regulations of a compliance program?

Celebrate Their Efforts

Once again the FCPA Guidance speaks to the need to incentivize employees in the company realm. The Guidance states, “DOJ and SEC recognize that positive incentives can also drive compliant behavior. These incentives can take many Guiding Principles of Enforcement forms such as personnel evaluations and promotions, rewards for improving and developing a company’s compliance program, and rewards for ethics and compliance leadership. Some organizations, for example, have made adherence to compliance a significant metric for management’s bonuses so that compliance becomes an integral part of management’s everyday concern.” But more than simply incentives, it is important to “[M]ake integrity, ethics and compliance part of the promotion, compensation and evaluation processes as well.”

Mainwaring’s concept means going beyond incentivizing. To me his word ‘celebrate’ means a more public display of success. Financial rewards may be given in private, such as a portion of an employee’s discretionary bonus credited to doing business ethically and in compliance with the FCPA. While it is certainly true those employees who are promoted for doing business ethically and in compliance are very visible and are public displays of an effective compliance program. I think that a company can take this concept even further through a celebration to help create, foster and acknowledge the culture of compliance for its day-to-day operations. Bobby Butler, at Universal Weather and Aviation, Inc., has spoken about how his company celebrated compliance through the event of Compliance Week. He said that he and his team attended this event and used it as a springboard to internally publicize their compliance program. Their efforts included three separate prongs: they were hosting inter-company events to highlight the company’s compliance program; providing employees with a Brochure highlighting the company’s compliance philosophy and circulating a Booklet which provided information on the company’s compliance hotline and Compliance Department personnel.

Give Your Employees a Tool Kit For Compliance

Obviously a key component of any effective compliance program is an internal reporting mechanism. The FCPA Guidance states, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The Guidance goes on to also discuss the use of an ombudsman to address employee concerns about compliance and ethics. I do not think that many companies have fully explored the use of an ombudsman but it is certainly one way to help employees with their compliance concerns. Interestingly, in an interview in the Wall Street Journal (WSJ) with Sean McKessy, Chief of the SEC’s Office of the Whistleblower, he stated, “What I hear is that companies are generally investing more in internal compliance as a result of our whistleblower program so that if they have an employee who sees something, they’ll feel incentivized to report it internally and not necessarily come to us.”

Two of the newest and perhaps coolest tools a Chief Compliance Officer (CCO) or compliance practitioner can utilize in the realm of social media are Meerkat and Periscope. Both tools allow you to tell a compliance story in real time, throughout your organization and beyond. They are both live streaming apps that enable you to create a video and open the portal to anyone who wants to use it. Anybody in your Twitter community can click on that link and watch whatever you’re showing on your phone. The big piece is the mobile aspect. It’s as simple as a basic tweet and hitting the “stream” button.

However, there are a wide variety of social media tools available that you can incorporate into your compliance program. Apps like Pinterest, Snapchat, Instagram and others may seem like tools that are solely suited to personal use. However their application is much broader. Over the next week, I will be exploring some of these apps and tools and how they might be used in doing compliance. As with many ideas in the compliance space, a CCO or compliance practitioner is only limited by their imagination. For these apps, they can be most useful when you tell the story of compliance in your company. Hootsuite did a campaign called “Follow the Sun” using Periscope. They decided to let their employees showcase what they called #HootsuiteLife. They gave access to different people in every company office around the globe. Throughout the day, it would “Follow the Sun,” and people in different offices would log into the Hootsuite account and walk around and show off their culture, interviewing their friends, etc. They talk about the importance of culture and now they are proving it. The number of inbound applications drastically increased after people got that sneak peek into their company.

Yet there are other tools available, at no cost, and can be downloaded onto a mobile device such as a smartphone or iPad. These include the O’Melveny & Myers LLP Foreign Corrupt Practices Act Handbook; which concentrates solely on the FCPA and is primarily a new vehicle to distribute content it already makes available upon request. This content includes O’Melveny’s FCPA Handbook and In-House Counsel’s Guide to Conducting Internal Investigations. In addition, the app features five resource sections that serve as an interactive, illustrative directory with titles ranging from ‘O’Melveny Authored Client Alerts’ to ‘DOJ Opinion Releases’.

Another approach is found in the Latham & Watkins LLP’s AB&C Laws app which takes an international approach to anti-corruption and anti-bribery laws, with the content focused on organizing and easing access to statutes and regulatory guidance according to specific fields of interest, from legislative frameworks to extra-territorial application to enforcement and potential penalties. It also includes official guidance such as steps (where available) that can be taken to reduce the risk of liability for bribery and corruption.

There is much to be learned by the CCO and compliance practitioner from the disciplines of marketing and social media. These concepts are useful to companies in getting their sales pitches out and can be of great help to you, the CCO or compliance practitioner, in collaborating and marketing throughout your company. I hope you will follow this week’s Use of Social Media series as I will endeavor to provide to you not only with a discussion of some new tools which you can incorporate into your compliance program going forward but also a different way to think about who your customers are and how you are reaching them with your message of doing compliance.

Finally, I am compiling a list of questions that you would like to be explored or answered on the use of social media in your compliance program. So if you have any questions email them to me, at tfox@tfoxlaw.com, and I will answer them within the next couple of weeks in my next Mailbag Episode on my podcast, The FCPA Compliance and Ethics Report.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Navigating Social Media And Legal Ethics[1]

Ed. Note-today we have a post from our colleague, Michelle Sherman, a frequent commentator on social media issues.

If you cannot do it offline, you probably cannot do it online.  This is a good way to think about social media and legal ethics. We know that attorneys are not allowed to communicate with a represented party on the other side of a legal action, so it should not be surprising that trying to “friend” a party on Facebook in order to see all of their Facebook activity is not allowed by the ABA or the assorted state bar rules of professional responsibility. Cal. Rules of Professional Conduct, Rule 2-100. It is also unethical to direct someone to “friend” the other party. Some state bars have also extended this rule to unrepresented parties and witnesses. Namely, it is fine to look at their public social media presence, but attorneys cannot “friend” them or arrange for it to be done on their behalf.

A. Maintain The Confidentiality Of Your Client Communications.

Another bright line is that attorneys cannot disclose confidential information about their clients on social media. Cal. Rules of Professional Conduct, Rule 3-100. In fact, many companies prefer for their outside counsel not to publicize their courtroom wins for their clients out of concern that it will invite similar actions to be filed against the company. Companies have media relations departments to tell their story for them so attorneys should coordinate any press releases of their own with their clients. This is something to keep in mind when an attorney writes her LinkedIn profile, or posts about her work day on Facebook or Twitter.

Preserving the confidentiality of attorney-client communications, and not waiving the attorney work product protection means attorneys need to think carefully about how they post status updates on LinkedIn, and the “conversations” they are having on LinkedIn discussion groups, or on listservs. Even if a listserv is treated as a private forum for qualifying members to confer about legal issues, it does not mean that a court will treat those discussions as privileged or confidential. A plaintiff’s attorney in an employment discrimination case learned this the hard way when he was trying to quash a document subpoena seeking his writings on a listserv. In Muniz v. United Parcel Service, Inc., CV 09-1987 (N.D. Cal.), the plaintiff’s attorney allegedly made posts on the listserv in which he accused the judge of being “defense-biased”, and described the defense counsel as aggressively defending the case to the point of absurdity. Professor Georgene M. Vairo, a professor at Loyola Law School, was reported in a January 18, 2011 Los Angeles Daily Journal article, as saying that the fact that the attorney’s writings appeared on a confidential listserv does not mean work product privilege applies to them. “Given the way social media is, even when you try to keep things private, can you really have an expectation of privacy?” Vairo said.

B. Make Social Media Part Of Your Litigation Strategy.

Yet, attorneys may fall short of their duty to zealously represent their clients if they ignore social media entirely. It is a rich resource for discovery about the other side, witnesses and even prospective jurors. In Johnson v. McCullough, the Missouri Supreme Court discussed how trial attorneys should take advantage of technological advances and research prospective jurors. Thereby, hopefully avoiding the need for a motion for new trial because it is discovered much later that a juror was deliberately concealing his bias on voir dire in order to remain on the jury.

However, this research and monitoring of jurors during the case comes with some bright line rules as well.

1. Do Not Have “Contact” With Jurors Through Social Media.

Again, offline rules provide a bright line for social media contact with jurors. A study done by Reuters Legal using data from Westlaw online found that tweets from people describing themselves as prospective or sitting jurors appeared at the rate of one nearly every three minutes. Increasingly, parties are filing motions for new trials or to overturn a verdict based on juror misconduct on the Internet. In a criminal case in Camarillo, California, a juror posted a cell phone picture of the murder weapon on the Internet, and invited people on his blog to ask him questions about the case.

Thus, attorneys and courts have good reason to be concerned about what jurors are saying on social media. Courts are tackling the problem by instructing the jury not to discuss the case anywhere including on social media. However, just as jurors still talk about pending trials with their friends and family despite the court’s admonitions, jurors are sometimes ignoring (or forgetting) the court’s admonitions and posting on social media. Consequently, attorneys should have someone monitoring the jury during voir dire, trial and deliberations.

This monitoring needs to be done so it does not result in “contact” with the jurors. Cal. Rules of Professional Conduct, Rule 5-320. Friending jurors, or following them on Twitter, is taking it too far. On the other hand, attorneys can monitor the public posts of jurors on Facebook and Twitter without jurors realizing it.

2. Bring Jury Misconduct To The Court’s Attention.

Now assume the plaintiff’s attorney learns from social media that a juror intentionally failed to disclose she was prejudiced against the defendant manufacturer in the case, because the juror had been a victim of a similar industrial accident. The juror is someone that the attorney thought was sympathetic to his client’s case and the last thing he wants to do is lose the juror. This is the ethical question that is likely to come up for attorneys, and the answer is the same as other offline misconduct of jurors. As an officer of the court, the attorney is required to bring it to the attention of the court.

C. Avoid The Unintentional Creation Of An Attorney-Client Relationship.

Attorneys are using blogs and social media to try and develop business. A February 2012 survey by ALM Legal Intelligence, “Social Media ROI for Law Firms” found that of the law firms that are using social media and blogs – 85 percent and 70 percent respectively of the responding law firms – almost 50 percent of those firms are receiving leads from their efforts. In doing so, law firms are understandably concerned about not creating an inadvertent attorney-client relationship when someone comments on a blog or tries to engage one of their attorneys about the specifics of their particular legal issue.

These are legitimate legal concerns. In addressing an analogous situation, the State Bar of California issued a formal opinion for attorneys who have call in radio shows on legal issues. The State Bar recommended that the attorney radio host: (1) remind callers that they are speaking on a public forum so nothing they are saying is confidential; and (2) encourage callers to seek advice from an attorney about their specific problem. Formal Opinion No. 2003-164. It is also recommended that the law firm pre-screen comments before they are posted on the blog site to edit posts that may potentially create a problem. Also, do not answer fact specific questions – rephrase the question to a broader legal issue that may be of interest to the broader audience to whom you are writing or speaking. And, finally, keep your responses in the public forum so there is no expectation of a confidential attorney-client relationship.

[1] 4851-4734-3630, v.  1

———————————————————————————————————————————————————————-
Michelle Sherman practices at Slater Hersey & Lieberman LLP. She can be reached at Msherman@slaterhersey.com. Follow Michelle on Twitter: @MShermanEsq

———————————————————————————————————————————————————————-

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. 

Facebook’s Settlement With The FTC Is A Wake Up Call For Businesses To Review And Update Their Website Privacy Policy And Agreements

Ed. Note-there are many forms of compliance convergence. Today we have a guest post from Michelle Sherman, a frequent contributor on compliance and  social media issues. 

The Federal Trade Commission (“FTC”) is working hard to make sure consumers are not being misled about how websites and social networking sites are using their personal information.  Companies that do not follow their own privacy policies are finding themselves the subject of FTC complaints.  It is therefore even more important for businesses to review and update their “privacy policy,” “terms of use,” and other legal agreements on their websites.  This review should also include any company apps.

1.         When Businesses Do Not Comply With The Terms Of Their Website Privacy Policy, Then They May Be In Violation Of Section 5(a) Of The FTC Act

The recent consent decrees that the FTC entered into with Facebook, Google and online advertiser ScanScout highlight the need for businesses to make sure they are acting in accordance with their privacy policies.  Businesses are well advised to take the following actions:

(1) Ensure that the published policies on their websites for terms of use and privacy reflect what information the businesses are collecting from consumers, and that the disclosures are clearly stated without unnecessary and lengthy legalese;

(2) Examine how the businesses are using personal information or anticipate using it, and that these uses are being fully disclosed to consumers; and

(3) Take reasonable measures to safeguard consumer information.  Because of the risks of cyberhacking, it is also worthwhile to conduct an audit on how consumer information is being safeguarded, and what information is being stored and for how long a period.  The FTC settled a complaint against Twitter for its alleged failure to take reasonable safeguards to protect users’ accounts against hackers.

In all of these complaints, the FTC alleged that the respondents made false or misleading representations about their privacy policies in violation of Section 5(a) of the FTC Act.  The FTC Act prohibits unfair or deceptive acts or practices.  15 U.S.C. § 45(a).

The consent decrees entered into by Facebook, Google and ScanScout in order to avoid more costly litigation and possibly stiffer penalties are similar in some key respects, and include some terms that will increase their costs of doing business.  As is sometimes the case with the FTC, the FTC conditioned the settlements on these businesses agreeing to change their business practices in ways that may place them at a competitive disadvantage to their competitors because some of the additional privacy measures they must now take are not required under current law.

2.         Lessons To Be Learned From The FTC Settlements With Facebook And Others

It is instructive to know how these businesses allegedly violated the terms of their privacy policies with users because the same may be true for many companies.

(a)  Facebook Complaint

In its complaint against Facebook, the FTC alleged:

(1) Facebook told its users that third-party apps that users installed – such as Farmville by Zynga– would have access only to user information that they needed to operate.  In fact, the apps could access nearly all of the users’ personal data.

(2) Facebook told users that they could restrict sharing of data to limited audiences – for example, with “Friends Only.”  In fact, selecting “Friends Only” did not prevent their information from being shared with the third-party applications their friends used.

(3) Facebook promised users it would not share their personal information with advertisers.  Facebook did according to the FTC.

(4) Facebook claimed that when users deactivated or deleted their accounts, their photos and videos would be inaccessible, when in fact Facebook allowed access to the content according to the FTC.

(5) Facebook also claimed that it complied with the U.S. – EU Safe Harbor Framework that governs data transfer between the U.S. and the European Union, but it did not.

(b)        Google Complaint

Google is also faulted for making use of its users’ data in ways that was contrary to what Google was telling users about the launching of Google’s Buzz social network through its Gmail web-based email product.  The FTC alleged that “Google led Gmail users to believe that they could choose whether or not they wanted to join the [Buzz] network, [but] the options for declining or leaving the social network were ineffective.”  Google was apparently trying to immediately ramp up its social network in order to compete with Facebook.  The Buzz launch ended up being a public relations nightmare for Google with thousands of consumers reportedly complaining that they were concerned about public disclosures of their email contacts from which Google tried to create immediate Buzz connections for users.  In some cases, use of the emails disclosed ex-spouses, therapists, employers or competitors.

According to the FTC, Google breached its privacy policy when it launched Buzz, its social networking site, because Google’s policy told Gmail users that “[w]hen you sign up for a particular service that requires registration, we ask you to provide personal information.  If we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use.”  According to the FTC, Google used Gmail users’ information for a different purpose without telling them by starting a social networking site with the information.

            (c)  Online Advertiser ScanScout Complaint

The FTC is not just pursuing these actions against social media behemoths such as Facebook and Google.  In November 2011, the FTC reached a settlement with an online advertiser ScanScout.  ScanScout is an advertising network that places video ads on websites for advertisers.  ScanScout collects information about consumers’ online activities (aka behavioral advertising) in order to post video ads targeted to the people visiting the website.  In ScanScout, the FTC alleged that there was a discrepancy between the online service and their website privacy policy:

“[F]rom at least April 2007 to September 2009, ScanScout’s website privacy policy discussed how it used cookies to track users’ behavior.  The privacy policy stated, ‘You can opt out of receiving a cookie by changing your browser settings to prevent the receipt of cookies.’  However, changing browser settings did not remove or block the Flash cookies used by ScanScout….  The claims by ScanScout were deceptive and violated Section 5(a) of the FTC Act.”

In the ScanScout action, the company Tremor Video, Inc. is also subject to the settlement order because ScanScout merged with Tremor Video.  This settlement also highlights the importance of doing an audit of a target company’s social media activity before acquiring or merging with it so your company will have more information concerning the legal risks of the deal.

3.         Business Costs Of Not Updating Your Privacy Policy And Following It

In each of these cases, the FTC is making the settling party do some things that are more than they would have been required to do in the normal course of business, thereby, making it more challenging and expensive for them to do business.

These consent decrees require the settling party to do the following:

(1) Tell users what information is being collected and for what purpose, with the right to “opt out” of the targeted advertising (ScanScout);

(2) Obtain consumers’ affirmative express consent before enacting changes that override their privacy preferences (Facebook; Google);

(3) Establish and maintain a comprehensive privacy program to address privacy risks associated with new and existing products and service, and protect the privacy and confidentiality of consumers’ information (Facebook; Google); and

(4) Every two years, for the next 20 years, obtain independent, third party audits certifying that the privacy program meets or exceeds the requirements of the FTC order (Facebook; Google).

4.         Conclusion

Considering that the vast majority of consumers simply click through the legal agreements to get to the applications on a website, there is no real downside to companies spending a little time and money to ensure that their privacy policy, terms of use and other legal agreements reflect their current practices.  Similarly, updating these agreements should be a routine part of changing how the company is collecting and using information from its users.  It should be coordinated between marketing, IT and legal with each checking off on the updates being accurate.  And, finally, the website should clearly indicate that the privacy policy and/or agreements have been updated so users have the option to review any changes.  If experience is any indicator, virtually all users will continue to visit the website notwithstanding the updated policy or agreements.

 Michelle Sherman is special counsel at Sheppard Mullin Richter & Hampton where she practices business litigation and consults with businesses on legal and regulatory compliance issues relating to social media and the Internet.  Michelle is the editor and contributing author to the law firm’s Social Media Law Update blog.

LEGAL ISSUES SURROUNDING SOCIAL MEDIA BACKGROUND CHECKS

Ed. Note-we are pleased to host a posting today from Michelle Sherman.

Agatha Christie had a novel take on invention being the mother of necessity.  She disagreed and said, “[I]nvention, in my opinion, arises directly from idleness, possibly also from laziness.  To save oneself trouble.”  She may have been onto something when you think about businesses that are turning to outside vendors to research employees and job candidates for them.  Whether or not these outside vendors are the best solution, however, remains to be seen.

1.  Companies Should Have An Internal Procedure For Researching Job Candidates And Employees On The Internet

We recommended in a January 2011 blog post, that businesses establish an internal procedure for making employment decisions based on Internet research, so they would not run afoul of state and federal laws that prohibit job discrimination based on protected factors.  See http://www.socialmedialawupdate.com, Social Media Research + Employment Decisions: May Be A Recipe For Litigation.  The protected factors include, for example:  (1) Race, color, national origin, religion and gender under Title VII of the Civil Rights Act of 1964; and (2) Sexual orientation, marital status, pregnancy, cancer, political affiliation, genetic characteristics, and gender identity under California law.  Most states have their own list of protected factors, which should be considered depending on where your company has employees.

Not surprisingly, the legal risks of making employment decisions using the Internet have become a real concern for businesses, especially when you consider that 54% of employers surveyed in 2011 acknowledged using the Internet to research job candidates.  The actual number of employers using the Internet is probably higher, and sometimes companies may not even be aware that their employees are researching job candidates and factoring that information into their evaluations.  This is yet another reason to establish an internal procedure for researching job candidates, and communicating your procedure to employees who are participating in the employment process.

There is nothing wrong with researching people on the Internet so long as it is done properly.  The Internet has a wealth of useful information, some of it intentionally posted by job applicants for employers to consider such as LinkedIn profiles.

With this “necessity” to do Internet searches properly, some businesses have turned to outside vendors to do the research for them, and, thereby, try to reduce their legal exposure and the administrative inconvenience of doing it themselves.  At least one of these vendors has received letters concerning its business practices from the Federal Trade Commission (“FTC”) and, more recently, two U.S. Senators.

2.  The Business Practices Of Outside Vendors That Provide Social Media Background Checks Are Being Examined For Compliance With Privacy And Intellectual Property Laws

On May 9, 2011, the staff of the FTC’s Division of Privacy and Identity Protection sent a “no action” letter to Social Intelligence Corporation (“Social Intelligence”), “an Internet and social media background screening service used by employers in pre-employment background screening.”  The FTC treated Social Intelligence as a consumer reporting agency “because it assembles or evaluates consumer report information that is furnished to third parties that use such information as a factor in establishing a consumer’s eligibility for employment.”  The FTC stated that the same rules that apply to consumer reporting agencies (such as the Fair Credit Reporting Act (“FCRA”)) apply equally in the social networking context.  These rules include the obligation to provide employees or applicants with notice of any adverse action taken on the basis of these reports.  Businesses should also be mindful of similar state consumer protection laws that may be applicable and may afford additional rights to employees and applicants (e.g. California Investigative Consumer Reporting Agencies Act).

The FTC concluded by stating that information provided by Social Intelligence about its policies and procedures for compliance with the FCRA appears not to warrant further action, but that its action “is not to be construed as a determination that a violation may not have occurred,” and that the FTC “reserves the right to take further action as the public interest may require.”  This FTC “no action” letter was reported fairly widely, and probably increased the comfort level of businesses that wanted to use an outside service for Internet background checks.

On September 19, 2011, Senators Richard Blumenthal (D-Conn) and Al Franken (D-Minn) sent a letter to Social Intelligence with 13 questions regarding whether the company is taking steps to ensure that the information it is gathering from social networks is accurate, whether the company is respecting the guidelines for how the websites and their users want the content used, and whether the company is protecting consumers’ right to online privacy.  The letter raises some legitimate concerns, and requests a prompt response from Social Intelligence to the questions presented.

3.  Legal Assurances That Your Company May Want To Seek If Using An Outside Vendor

Some of the questions also warrant due consideration on the part of businesses receiving reports from outside vendors about how much weight they want to give the information provided.  Further, what the business may want in the form of legal assurances from the outside vendor that no laws (e.g. FCRA, privacy, copyright, or other intellectual property laws) have been violated in gathering the information or providing screenshot copies of pages from social networking sites.

Some of the questions from the Senators which raise these concerns include, for example:

1.  “How does your company determine the accuracy of the information it provides to employers?”  [Social Intelligence is reportedly collecting social networking activity dating back 7 years, and, therefore, may capture something that was later removed, or was a “tag” post through a picture that the job candidate was not responsible for making public, and may have removed once it came to his attention.]

2.  “Is your company able to differentiate among applicants with common names?  How?”  [e.g. Have they researched the correct “Jane Smith” of the hundreds on Facebook since social security numbers or other specific identifying information is not useful on social networking sites as it is with the standard background check.]

3.  “Is the information that your company collects from social media websites like Facebook limited to information that can be seen by everyone, or does your company endeavor to access restricted information.”

4.  “The reports that your company prepares for employers contain screenshots of the sources of the information your company compiles…These websites are typically governed by terms of service agreements that prohibit the collection, dissemination, or sale of users’ content without the consent of the user and/or the website….. Your company’s business model seems to necessitate violating these agreements.  does your company operate in compliance with the agreements found on sites whose content your company compiles and sells?”

5.  There appears “to be significant violations of user’s intellectual property rights to control the use of the content that your company collects and sells.  …. These pictures [of the users], taken from sites like Flickr and Picasa, are often licensed by the owner for a narrow set of uses, such as noncommercial use only or a prohibition on derivative works.  Does your company obtain permission from the owners of these pictures to use, sell, or modify them?”

4.  Conclusion

Establishing an internal procedure for using the Internet to make employment decisions is one more piece of a sound ethics and compliance program that addresses how your company is using social media.  If using an outside vendor to perform social media background checks is part of that policy, you should assure yourself that the company is acting in compliance with the relevant laws.  Further, if your company does decide to use an outside vendor, the company should not assume that employees will forego their own Internet searches of job candidates unless they are specifically instructed to follow the company’s procedure.

Michelle Sherman is special counsel at Sheppard Mullin Richter & Hampton where she practices business litigation and consults with businesses on legal and regulatory compliance issues relating to social media and the Internet.  Michelle is the editor and contributing author to the law firm’s Social Media Law Update blog.