Lawful Data-Mining of Social Networks

Consider this: With the use of basic information, including a valid e-mail address, a person may establish a presence on many social network sites, such as Windows Live Spaces, MySpace and Facebook. This means that blog users can freely post content that anonymous third parties, including potential or actual employers, are equally free to read. Yes, it's out there, and despite many users' confidence in their Web skills, they don't realize that what they're putting out there is typically fair ' and often attractive ' game in an open season for information hunters.

Hurt feelings, and legal squabbles, will ensue ' and have, aplenty.

To avoid legal difficulties when company representatives mine information about people from social-network locations, counsel would do well to advise employer clients to use caution and discretion, for certain, but also to make sure they know that they should employ three particular policies when using information mined from blogs. These three particular policies that may help companies to ensure the lawful use of blogs include specific actions associated with third parties and existing and potential employees.

Here's how to proceed.

First, attempt to ensure that the firm's personnel who research potential employees' backgrounds comply with the appropriate third-party terms-of-use agreements while data-mining blogs. They are, after all, a visiting third party, and may not necessarily in their search be a member of a site's “network,” say, of “friends,” or other type of user designation.

Second, the firm's employee handbook should be updated to detail what specific kinds of data mined from blogs may be used for checking on employees, and what kinds of data mined from blogs specifically may not be used. Attention to these details can go a long way in keeping employees content while allowing a company to vet an employee's activities that might reflect on his or her job, the company's public image, or the company's and an employee's conduct that may have a direct impact on work issues.

Third, a company should update disclosure statements and background-search permission acknowledgements that potential and existing employees sign so that data mined in blog reviews is appropriately and legitimately covered, and allowed, shielding the employer from actions an employee or potential employee may take when he or she feels impinged in some way.

(Editor's note: For a brief analysis of discoverability of information on social-networking sites, see, “Social Networking and Litigation,” in the January edition of e-Commerce Law & Strategy, at www.ljnonline.com/issues/ljn_ecommerce/25_9/news/151577-1.html. For a look at law'firm-specific online-recruiting issues related to social-networking sites, see, “Law Firms and Social Networking” in the March edition of Marketing the Law Firm, (www.ljnonline.com/issues/ljn_marketing/22_11/news/151790-1.html), and “The Tweet 16″ in the March edition of Internet Law & Strategy (www.ljnonline.com/issues/ljn_internetlaw/7_3/news/151834-1.html).

Rules Govern Lawful Access

It's important to keep in mind that lawful access to blogs requires compliance with the terms of use agreement associated with each blog that may be mined. A terms of use agreement for a blog is similar to such agreements put in place by Web site operators and others who wish to govern a client's or user's actions ' in essence, it is a set of rules that govern how the owner's or operator's blogs may be reasonably, and legally, used. From a legal perspective, a blog's terms of use agreement is a contractual agreement between a blog operator and a third-party user.

A blog terms of use agreement generally details the duties of each party. For employer researchers, the agreement identifies what a blog miner ' a third-party or registered user ' may do with the content posted on the blog. The terms of use agreement, then, also dictates what a prospective employee may post on the blog, and how that information can be offered for public display and use by others. Terms of use agreements, though typically ignored by social-network users, are important, and must be paid attention to by employer researchers, and by current and potential employees. In a court of law, for example, agreeing to terms of use is tantamount to entry into a written contract.

From the employer's perspective, a blog terms of use agreement is useful for justifying what can and cannot be done to or with the blog content with or without permission. Typically, with respect to content, a blog terms of use agreement normally is limited to stating that content may not be distributed by e-mail or other means. Thus, the blog terms of use agreement does not prohibit an employer from using the content as a basis for an employment-related decision if the information is simply seen.

To stave off legal difficulties, then, it's good advice for employers who review blogs as part of the hiring and employment process to require employee blog miners to include a copy of the terms of use agreement of each blog reviewed in the blog-content file so that file reviewers, and employees, when necessary, can see the terms of use that allowed particular access and data-mining. Such information, furthermore, will assist the blog-content user in making a proper decision with respect to the use of the content in question. Alternatively, counsel or other appropriate designated agent of the company, may have a third party certify that the employer's use of the blog complies with the appropriate terms of use agreement.

Finders Keepers, Found-outs Weepers?

Among the many standard public profiles used by most social networks appear such terms as:

• Sex;
• Drugs;
• Porn; and
• Alcohol.

These terms are used by social-network denizens in their basic shared-information files to allow others to search for, find and connect with them. Additionally, social-network sites allow users to post nearly anything they wish about themselves on their personal profiles, including:

• Political views;
• Sexual orientation;
• Interests;
• Relationship status; and
• Religious beliefs.

Employers may find such content useful in their decision-making process, but employer data-miners and employment decision-makers must be trained about what data they may collect and how such mined data may be used. Remember, it's “out there,” but this information is subject to some regulation, and even information that isn't can be used in a way that invites legal action from the person who originally posted or distributed it.

Court Rulings and Data-Mining Policies

The use of Internet searches for hiring managers to make employment decisions has been found to be lawful (see, David Mullins v. Department of Commerce, Fed. Cir. 06-3284 (May 4, 2007)).

Consequently, it is not surprising that the Bethlehem, PA-based National Association of Colleges and Employers (“NACE”) reported that employers regularly reviewing potential hires' posted social-network information is a growing practice. NACE says that among its membership, the use of social network site mining isn't a widespread practice yet, with only 10% of respondents to the group's Job Outlook 2007 Fall Preview Survey saying they did this, but those are figures from just one group. The organization asks in a press release addressing technology trends that is posted on its Web site: “What about two years from now? For most employers, such activity wasn't even on their radar just a few years ago.”

But, concerning use of gathered data, just as in the real world, it is not lawful for an employer to use lawfully mined Internet information for employment-decision purposes that concerns:

• Race;
• Age;
• Gender;
• Religion; or, in some jurisdictions,
• Sexual orientation.

Consequently, then, an employer should establish and promote policies that forbid the unlawful use of such information in determining directly whether a person may be employed, or may not be employed.

Update Handbooks and Hold Training

An employer should update its employee handbook to specifically state that in the course of reviewing blogs as part of the employee-hiring process, it is contrary to company policy to collect or use information for an unlawful motive; for example, using such collected information to practice discrimination based on race, gender or age. Additionally, it is advisable to hold a training class, or include in any existing training class for those who hire for the employer, information concerning the proper use of blog research. This combination of notice and training on how to collect and use information culled from social-networking sites should protect an employer from the unlawful use of blog-mining by a rogue employee.

Use What's Applicable

Note, too, that if an employer learned on the Internet that a potential employee was engaging in harmful activities, such as active involvement in numerous motor-vehicle accidents, the company may use this information as a basis for rejecting the applicant as a company driver. In short, the company should permit employees to use the results of blog research as grounds for employment action only if the information discovered is related to the work for which the applicant is being considered, or for which he or she has applied.

Expectation-of-Privacy Issues

In order for a person's privacy to be invaded, that person must have a reasonable expectation of privacy. For instance, the mere fact that a person can be seen by someone does not automatically mean that he or she can legally be forced to be seen by every person (see, Sanders v. American Brdcst. Co., 978 P.2d 67, 72 (Cal. 1999)). Most courts, however, reject a plaintiff's invocation of a limited right to privacy regarding particular facts or information that the plaintiff disclosed to third parties.

Consider Nader v. General Motors Corp., 255 N.E.2d 765 (1970), for example, in which the New York Court of Appeals found that people assumed the risk of public disclosure when they disclosed private information to others. Thus, it is generally found that as a matter of law, facts shared with others are no longer private (see, Duran v. Detroit News, Inc., 504 N.W.2d 715 (1993) and Fisher v. Ohio Department of Rehabilitation and Correction, 578 N.E.2d 901 (1988)).

Unauthorized Use of Information from Social Sites

Other cases have also dealt with the unauthorized use of an Internet site and are suitable for application to matters involving a violation of terms-of-use agreements. For example, in the case Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002), the Ninth Circuit determined that the unauthorized viewing of a secured Internet site by an employer could afford a plaintiff a cause of action under U.S.C. ”2701-2711 (2000), Title II of the Electronic Communications Privacy Act.

A Duty to Facebook?

From a legal perspective, some sources suggest that an employer that does not search social networks for readily available information may be negligent in its hiring practices. Some validity resides in this claim, when one considers that Internet social networks provide employers with a low-cost, easy-to-use, high-availability screening tool for job applicants.

But the use of social-network data mining isn't confined to helping screen job applicants. For the safety of existing employees, for instance, one could well argue that a blog search is necessary. In light of the cost and availability, it may also be argued that an employer has a duty to mine blogs of potential and existing employees. With the power and responsibilities employees have in the workplace, it is important that employers possess as much lawful information about their staff as is practical to gather and retain, if they are to protect the employees, and the enterprises, from unwanted impressions or actions that blogging may bring.

Due Diligence on Types of Data

Employers must also train Internet researchers to separate content related to work from content related to personal life. Despite the available technology that can potentially limit or block unwanted third parties from viewing social-network profiles, most blog users ' like many other Internet users who don't read terms of use agreements before clicking the “I agree” button ' do not activate their privacy settings, thus lawfully allowing employers to gain access to profiles that the blog users believe are protected by privacy settings.

Getting in, and Getting the Goods

Employers can access potential hires' social-networking profiles in a variety of ways. Firms, for instance, may simply hire graduates who kept their profiles and maintain connections to their colleges' social networks, which would allow them to maintain connections to the college students who make up the bulk of Facebook users. Alternatively, with an alumni e-mail address, employees can create profiles and become affiliated with their universities' undergraduate networks and, by doing so, acquire access to current students' profiles and information.

Update Background Search
Acknowledgements

Finally, also to avoid legal difficulties, an employer should update disclosures and background search-permission acknowledgements that would apply to potential and existing employees so that the disclosures and acknowledgements appropriately cover blog review.

Technology is ever-changing, and employer-screening and employer-monitoring tactics frequently adapt to these changes, bringing the need for new perspectives, understandings, and consents. As in most cases, virtual or not, evidence of consent will simply and ably extinguish many causes of action with respect to blog mining, before they have time to spread and, possibly, burn down the house.

Blogs simultaneously provide Internet users with social-network prospects and employers with a previously unavailable source of information suitable for employment-assessment decisions.

And it's in this intersection on the Information Superhighway where often occurs a collision of worlds, perspectives and direction that frequently cripples or kills prospects, and individuals' aspirations. Employees of e-commerce companies aren't immune to such collisions, nor are agents of the companies who gather data on prospective or current employees, if they go about their work unlawfully, or in other improper ways that could lead to legal or other types of regulatory action.

While social-network users may argue that the content they've posted on virtual social networks is private because it's theirs and because it depicts private acts that aren't, except for appearing on the Internet, part of the public realm, courts have unequivocally ruled that the revelation of personal information in a public manner ' and putting information on the Internet, to which millions of users have access as a public forum, is a very public manner ' typically results in the diminution or elimination of reasonable privacy expectations.

Consider this: With the use of basic information, including a valid e-mail address, a person may establish a presence on many social network sites, such as Windows Live Spaces, MySpace and Facebook. This means that blog users can freely post content that anonymous third parties, including potential or actual employers, are equally free to read. Yes, it's out there, and despite many users' confidence in their Web skills, they don't realize that what they're putting out there is typically fair ' and often attractive ' game in an open season for information hunters.

Hurt feelings, and legal squabbles, will ensue ' and have, aplenty.

To avoid legal difficulties when company representatives mine information about people from social-network locations, counsel would do well to advise employer clients to use caution and discretion, for certain, but also to make sure they know that they should employ three particular policies when using information mined from blogs. These three particular policies that may help companies to ensure the lawful use of blogs include specific actions associated with third parties and existing and potential employees.

Here's how to proceed.

First, attempt to ensure that the firm's personnel who research potential employees' backgrounds comply with the appropriate third-party terms-of-use agreements while data-mining blogs. They are, after all, a visiting third party, and may not necessarily in their search be a member of a site's “network,” say, of “friends,” or other type of user designation.

Second, the firm's employee handbook should be updated to detail what specific kinds of data mined from blogs may be used for checking on employees, and what kinds of data mined from blogs specifically may not be used. Attention to these details can go a long way in keeping employees content while allowing a company to vet an employee's activities that might reflect on his or her job, the company's public image, or the company's and an employee's conduct that may have a direct impact on work issues.

Third, a company should update disclosure statements and background-search permission acknowledgements that potential and existing employees sign so that data mined in blog reviews is appropriately and legitimately covered, and allowed, shielding the employer from actions an employee or potential employee may take when he or she feels impinged in some way.

(Editor's note: For a brief analysis of discoverability of information on social-networking sites, see, “Social Networking and Litigation,” in the January edition of e-Commerce Law & Strategy, at www.ljnonline.com/issues/ljn_ecommerce/25_9/news/151577-1.html. For a look at law'firm-specific online-recruiting issues related to social-networking sites, see, “Law Firms and Social Networking” in the March edition of Marketing the Law Firm, (www.ljnonline.com/issues/ljn_marketing/22_11/news/151790-1.html), and “The Tweet 16″ in the March edition of Internet Law & Strategy (www.ljnonline.com/issues/ljn_internetlaw/7_3/news/151834-1.html).

Rules Govern Lawful Access

It's important to keep in mind that lawful access to blogs requires compliance with the terms of use agreement associated with each blog that may be mined. A terms of use agreement for a blog is similar to such agreements put in place by Web site operators and others who wish to govern a client's or user's actions ' in essence, it is a set of rules that govern how the owner's or operator's blogs may be reasonably, and legally, used. From a legal perspective, a blog's terms of use agreement is a contractual agreement between a blog operator and a third-party user.

A blog terms of use agreement generally details the duties of each party. For employer researchers, the agreement identifies what a blog miner ' a third-party or registered user ' may do with the content posted on the blog. The terms of use agreement, then, also dictates what a prospective employee may post on the blog, and how that information can be offered for public display and use by others. Terms of use agreements, though typically ignored by social-network users, are important, and must be paid attention to by employer researchers, and by current and potential employees. In a court of law, for example, agreeing to terms of use is tantamount to entry into a written contract.

From the employer's perspective, a blog terms of use agreement is useful for justifying what can and cannot be done to or with the blog content with or without permission. Typically, with respect to content, a blog terms of use agreement normally is limited to stating that content may not be distributed by e-mail or other means. Thus, the blog terms of use agreement does not prohibit an employer from using the content as a basis for an employment-related decision if the information is simply seen.

To stave off legal difficulties, then, it's good advice for employers who review blogs as part of the hiring and employment process to require employee blog miners to include a copy of the terms of use agreement of each blog reviewed in the blog-content file so that file reviewers, and employees, when necessary, can see the terms of use that allowed particular access and data-mining. Such information, furthermore, will assist the blog-content user in making a proper decision with respect to the use of the content in question. Alternatively, counsel or other appropriate designated agent of the company, may have a third party certify that the employer's use of the blog complies with the appropriate terms of use agreement.

Finders Keepers, Found-outs Weepers?

Among the many standard public profiles used by most social networks appear such terms as:

• Sex;
• Drugs;
• Porn; and
• Alcohol.

These terms are used by social-network denizens in their basic shared-information files to allow others to search for, find and connect with them. Additionally, social-network sites allow users to post nearly anything they wish about themselves on their personal profiles, including:

• Political views;
• Sexual orientation;
• Interests;
• Relationship status; and
• Religious beliefs.

Employers may find such content useful in their decision-making process, but employer data-miners and employment decision-makers must be trained about what data they may collect and how such mined data may be used. Remember, it's “out there,” but this information is subject to some regulation, and even information that isn't can be used in a way that invites legal action from the person who originally posted or distributed it.

Court Rulings and Data-Mining Policies

The use of Internet searches for hiring managers to make employment decisions has been found to be lawful (see, David Mullins v. Department of Commerce, Fed. Cir. 06-3284 (May 4, 2007)).

Consequently, it is not surprising that the Bethlehem, PA-based National Association of Colleges and Employers (“NACE”) reported that employers regularly reviewing potential hires' posted social-network information is a growing practice. NACE says that among its membership, the use of social network site mining isn't a widespread practice yet, with only 10% of respondents to the group's Job Outlook 2007 Fall Preview Survey saying they did this, but those are figures from just one group. The organization asks in a press release addressing technology trends that is posted on its Web site: “What about two years from now? For most employers, such activity wasn't even on their radar just a few years ago.”

But, concerning use of gathered data, just as in the real world, it is not lawful for an employer to use lawfully mined Internet information for employment-decision purposes that concerns:

• Race;
• Age;
• Gender;
• Religion; or, in some jurisdictions,
• Sexual orientation.

Consequently, then, an employer should establish and promote policies that forbid the unlawful use of such information in determining directly whether a person may be employed, or may not be employed.

Update Handbooks and Hold Training

An employer should update its employee handbook to specifically state that in the course of reviewing blogs as part of the employee-hiring process, it is contrary to company policy to collect or use information for an unlawful motive; for example, using such collected information to practice discrimination based on race, gender or age. Additionally, it is advisable to hold a training class, or include in any existing training class for those who hire for the employer, information concerning the proper use of blog research. This combination of notice and training on how to collect and use information culled from social-networking sites should protect an employer from the unlawful use of blog-mining by a rogue employee.

Use What's Applicable

Note, too, that if an employer learned on the Internet that a potential employee was engaging in harmful activities, such as active involvement in numerous motor-vehicle accidents, the company may use this information as a basis for rejecting the applicant as a company driver. In short, the company should permit employees to use the results of blog research as grounds for employment action only if the information discovered is related to the work for which the applicant is being considered, or for which he or she has applied.

Expectation-of-Privacy Issues

In order for a person's privacy to be invaded, that person must have a reasonable expectation of privacy. For instance, the mere fact that a person can be seen by someone does not automatically mean that he or she can legally be forced to be seen by every person ( see , Sanders v. American Brdcst. Co. , 978 P.2d 67, 72 (Cal. 1999)). Most courts, however, reject a plaintiff's invocation of a limited right to privacy regarding particular facts or information that the plaintiff disclosed to third parties.

Consider Nader v. General Motors Corp. , 255 N.E.2d 765 (1970), for example, in which the New York Court of Appeals found that people assumed the risk of public disclosure when they disclosed private information to others. Thus, it is generally found that as a matter of law, facts shared with others are no longer private ( see , Duran v. Detroit News, Inc. , 504 N.W.2d 715 (1993) and Fisher v. Ohio Department of Rehabilitation and Correction , 578 N.E.2d 901 (1988)).

Unauthorized Use of Information from Social Sites

Other cases have also dealt with the unauthorized use of an Internet site and are suitable for application to matters involving a violation of terms-of-use agreements. For example, in the case Konop v. Hawaiian Airlines, Inc. , 302 F.3d 868 (9th Cir. 2002), the Ninth Circuit determined that the unauthorized viewing of a secured Internet site by an employer could afford a plaintiff a cause of action under U.S.C. ”2701-2711 (2000), Title II of the Electronic Communications Privacy Act.

A Duty to Facebook?

From a legal perspective, some sources suggest that an employer that does not search social networks for readily available information may be negligent in its hiring practices. Some validity resides in this claim, when one considers that Internet social networks provide employers with a low-cost, easy-to-use, high-availability screening tool for job applicants.

But the use of social-network data mining isn't confined to helping screen job applicants. For the safety of existing employees, for instance, one could well argue that a blog search is necessary. In light of the cost and availability, it may also be argued that an employer has a duty to mine blogs of potential and existing employees. With the power and responsibilities employees have in the workplace, it is important that employers possess as much lawful information about their staff as is practical to gather and retain, if they are to protect the employees, and the enterprises, from unwanted impressions or actions that blogging may bring.

Due Diligence on Types of Data

Employers must also train Internet researchers to separate content related to work from content related to personal life. Despite the available technology that can potentially limit or block unwanted third parties from viewing social-network profiles, most blog users ' like many other Internet users who don't read terms of use agreements before clicking the “I agree” button ' do not activate their privacy settings, thus lawfully allowing employers to gain access to profiles that the blog users believe are protected by privacy settings.

Getting in, and Getting the Goods

Employers can access potential hires' social-networking profiles in a variety of ways. Firms, for instance, may simply hire graduates who kept their profiles and maintain connections to their colleges' social networks, which would allow them to maintain connections to the college students who make up the bulk of Facebook users. Alternatively, with an alumni e-mail address, employees can create profiles and become affiliated with their universities' undergraduate networks and, by doing so, acquire access to current students' profiles and information.

Update Background Search
Acknowledgements

Finally, also to avoid legal difficulties, an employer should update disclosures and background search-permission acknowledgements that would apply to potential and existing employees so that the disclosures and acknowledgements appropriately cover blog review.

Technology is ever-changing, and employer-screening and employer-monitoring tactics frequently adapt to these changes, bringing the need for new perspectives, understandings, and consents. As in most cases, virtual or not, evidence of consent will simply and ably extinguish many causes of action with respect to blog mining, before they have time to spread and, possibly, burn down the house.