Social Media Use in the Workplace

One of the most commonly discussed issues regarding social media and business is whether employees should be permitted to access social media platforms during the work day. The Internet is full of debate for and against employee use of social media. Critics state that employee use of social media at work will result in a waste of the organization’s valuable resources as well as potentially endanger the organization. Detractors state that employee use of social media can harm the organization as a result of thoughtless social media interactions that disclose trade secrets and other confidential information. Further, these opponents state that employees also create legal liability as a result of the potential for disparaging, harassing, and other comments that give rise to legal action by fellow employees and third parties.

Proponents of social media acknowledge that risks exist but that the potential benefits outweigh the risks so long as the risks are well managed. Supporters of employee use of social media point to social media’s ability to significantly increase brand awareness in an effective and economical manner. Also touted is the potential that social media has for increasing sales as a result of an effective social media marketing initiative that includes employees as brand ambassadors. Other benefits include increased goodwill for organizations that act in an honest and transparent manner as well as the benefit to the organization for developing a communal environment that listens to the outside world.

Employee use of social media is not right for all organizations. Some organizations may find it beneficial relative to business development, branding, and customer service. On the other hand, organizations may determine that the workforce has no business use for social media. Whether or not an organization embarks on a strategy that permits employee use of social media is dependent upon the organization’s mission, goals, and appetite for risk. To the extent that an organization decides to permit employee use of social media in the workplace, it must ensure that employee social media usage is managed properly.

Employee use of social media can be an extremely effective tool when properly used. Conversely, a poorly managed employee-based social media effort can create nothing but headaches for an organization. Regardless of an organization’s position regarding employee social media use, a formal, written social media policy is essential to protect the organization.

Why Willie Sutton Would Not Survive Long With Web 2.0

A couple weeks ago I wrote a piece called What Bankers and Willie Sutton Have in Common. If you recall that post you'll remember who Willie Sutton was...a famous bank robber whose career spanned decades.



The point of that post was not to discuss bank robbery. The point was to make the reader aware of the obvious...people are using social media at an increasing rate and banks should consider whether it makes sense for them.

Like I said, the point of THAT post was not to talk about bank robbery. But that was then and this is now. So today, let's talk about bank robbery.

On October 18, 2009, Seth Liss of the Sun Sentinel newspaper wrote an article called "Social Media the New Crime-Fighter." This article discussed how social media is currently being used by private citizens as well as law enforcement to track down criminals. Through YouTube, Facebook and Twitter, people are creating their own version of America's Most Wanted, the popular syndicated television program.

This got me to thinking...again. If law enforcement can post photos and videos on Twitpic, YouTube, etc., shouldn't banks use the same technology in the event of a robbery? While some thought needs to be given to how it is publicized and where it is published, social media can be an effective way to speed up the discovery process in the case of a bank robbery...or any crime, for that matter.

Now, I say some thought needs to be given to the manner of disclosure because no banker would want to general public to get the impression that the bank is Robbery Central and subsequently, unsafe. However, handled properly social media can be an effective tool to closing bank robbery cases and simultaneously act as a preventive tool since no one wants their friends to spot them with women's hosiery over their head (not that there's anything wrong with that!).

I must admit that I haven't given this too much thought and I would probably want to consult a security expert (any out there?) to provide some pros and cons in terms of disclosure. But at a very basic level it seems like something that could work and become incorporated into a bank's overall social media strategy as well as its risk management strategy. Tie a decent bounty to tips leading to an arrest and in this economy you'll have some pretty good success.

Bank Lawyer's Social Media Checklist

On April 17th, I published Social Media and Bank Compliance Requirements, where I provided, thanks to the ABA Banking Journal, a list of regulatory compliance-related items that should be considered by banks that are thinking of or have already implemented some form of social media within their organization.

In this post I leverage (and paraphrase) off of the work of Richard Best as contained in NZLawyer article titled, "Social media and legal code: A checklist of issues."

Mr. Best highlighted four distinct areas that require legal consideration:

• Upfront governance and assessment;
• Site design and set-up;
• Content creation, moderation, and use; and,
• Content distribution.

Upfront Governance and Assessment

Questions that should be addressed :

1. Does the bank have a clear objective/rationale for creating a online presence with social media capability?
2. Has management and the board considered the business case for the development of a social media component? Is the presentation and board decision clearly documented in the board minutes?
3. Has bank management formed a steering committee with an appropriate mix of skills been set up to oversee the development and implementation of the site’s planning, policies, and procedures? At a minimum, members of this team should have a background in the nuances related to social media and Web 2.0.
4. Has a review and approval process been developed relative to the process? Who has the final say? Executive management? Board of Directors?
5. Has the bank developed the appropriate policies and procedures that address issues such as site usage policy, staff contribution guidelines, employee training (e.g., who is authorized) and ongoing assessment ?
6. Has the bank revised its record retention policy and procedures to ensure that electronic records created comply with applicable disclosure and security requirements?

Site Design and Set-Up

Questions that should be addressed :

1. Has the bank chosen and researched the availablity of the Web site name and domain name name?
2. Has the bank's Compliance or other Department completed a comprehensive risk assessment and have the results of the risk assessment been presented to executive management and the board of directors?
3. Has the bank determined whether the site be designed in-house or outsourced? If outsourced, has the bank completed an appropriate vendor assessment according to the bank's vendor management policy?

Content Creation, Moderation, and Use

Questions that should be addressed:

1. Has the bank's legal department developed a terms of use policy that complies with applicable laws, rules and regulations. Refer to Social Media, Banking and the Communications Decency Act post. Considerations should include:

• Registration obligations;
• Copyright and licensing disclosures;
• Warranties on the part of site users contributing third-party copyright content that they have the right to use such material;
• Indemnification of the bank against loss;
• Ownership or licensing of users’ contributions;
• Unacceptable use and the bank’s right to remove offending material;
• Cooperation with authorities in the event that material breaching other parties’ rights, or that is otherwise unlawful, is posted to the site;
• Moderation and banning of abusive commentators;
• Disclaimers of liability (to the extent appropriate), and
• Right to amend the terms of use.

Content Distribution

Questions that should be addressed:

1. If the bank will be resyndicating content from other sites on the bank’s site (e.g., through RSS feeds available on other sites), the bank should ensure that the bank is licensed to resyndicate that content.

Mr. Best does a great job of noting key issues that must be considered. While this list is not exhaustive, consideration of each point noted here will go a very long way in protecting the bank from a legal perspective.

I recommend that bankers download a copy of my Community Banker's Guide to Social Network Marketing to educate management and the board on what it takes to develop and implement a sound social media strategy. The Guide can be downloaded at http://www.tinyurl.com/cbgsnm. Before a bank can reasonably approve such a measure, decision makers must be knowledgable. The Guide goes a long way in providing an education on social media and social networks.

Should The Internet Be The New Resume?

Over the weekend I came across a very thought provoking article at Law.com titled Bank Nixes Use of Social Networking Sites in Hiring Process. This article, written by Jenny B. Davis, addressed a recent policy implemented by Amegy Bank of Texas, an $11 billion Houston-based bank.

The article speaks to the bank's decision to block all access to social media sites in an effort to prevent the bank's human resources personnel from accessing the personal profiles of job applicants. The article states that the bank's outside counsel recommended the policy in an effort to prevent unnecessary employment-based litigation. The article used the Pregnancy Discrimination Act as a key motivator, since it is plausible that an applicant's social media profile(s) may contain mention of a pending pregnancy or of other information that employers are not permitted to request. The danger is that upon discovery of such information, the bank's human resources personnel may be "perceived" as having acted on such information if an applicant is not hired. As such, if the bank's policy does not permit access to such sites, the bank has a strong defense against any such complaints.

While at first blush that bank's position may seem a bit severe and short sited, given that that almost 40% of employers have used Facebook and other social networking sites to gather information on job candidates and more than 80% of employers consider that negative information discovered when making hiring decisions, this was not an entirely bad decision. Further, during tough economic times people may be more apt to file frivolous compliants.

A related blog article at gNeil, titled Dangers of Using Social Networking Sites to Screen Applicants, stated that when a company uses the Internet to research job candidates and even current employees, there are some very important legal issues to keep in mind such as:

• Invasion of privacy. Some social networking sites state specifically in their terms of service that is is illegal to use users’ profile information for commercial purposes.
  
• State protected privacy. California and New York have laws preventing employers from interfering in employees’ private lives outside of the workplace.

• Discrimination. Even if you stumbled across an applicant’s personal information unintentionally, it is unlawful to deny employment based on protected categories such as age, race or gender.

• False information. It’s probably not surprising, but users on social networking sites don’t always post information that is entirely true. It’s best to rely on information that the applicant directly gives you.

• Fair Credit Reporting Act (FCRA). If you’re using an outside agency to conduct background checks on job candidates, you must comply with the FCRA and receive the applicant’s consent before starting the background screening process.

So, while it has been said that the Internet is the new resume, banks should carefully craft thier background check procedures - especially those that utilize social networks. For example, use of LinkedIn would likely be acceptable since it is primarily used for professional purposes. However, other platforms such as Facebook and MySpace may be undesirable. While the use of these sites may provide helpful information relative to the character of the candidate, certain information may expose the bank to litigation.

According the the gNeil blog, "to avoid potential discrimination lawsuits, develop a uniform procedure for using social networking sites in the hiring process. Train everyone involved in the hiring process to treat every applicant consistently to avoid trouble and document each step you take. With the rate at which new technology emerges, it’s almost impossible for the law to keep up the pace. When you use social networking sites to research applicants, you may be taking uncertain legal risks with every search you make."

Amegy's CEO was quoted as saying, "good hiring decisions are among the top two or three decisions here, because it is where a lot of risks are managed." This is definitely true. And social media applications may help to reduce risk by identifying potential hazards. Unfortunately, human resource law is not Web 2.0 compliant and as such, taking advantage of these tools as part of the human resource process will require careful consideration, strong policies and procedures and an increased appetite for potential litigation.

Banking Regulators Should Make Use of Social Media Mandatory

Back on May 6, 2005, then Acting Comptroller of the Currency Julie L. Williams, delivered a press release titled, "Acting Comptroller Williams Discusses Management and Supervision of Reputation Risk In Large Banking Organizations; Stresses Important Role of Ethics and Corporate Values."

Ms. Williams, through her press release, stated that there is no more elusive, difficult to manage, and feared risk than reputation risk. Ms. Williams stressed the importance of establishing within a bank's overall risk management program, a defense against reputation risk that ensures that banks are grounded in a sound corporate culture and value system. This statement was released in 2005, years before the social media boom that we find ourselves in today.

Since Mr. Williams' release, the banking industry has undergone significant stress. These stresses have resulted in a significant outlash against banks by consumers, regulators and lawmakers. Events triggered by IndyMac, AIG, Bear Stearns, et al, have resulted in significant criticism at the macro and micro levels. And social media platforms such as Facebook, Twitter and LinkedIn have acted as the conduits for many of these disgruntled messages.

Therefore, if we believe Ms. Williams and agree that reputation risk has been historically difficult to manage, then the banking community should agree that one method of effective management is through the deployment of a social media strategy that includes as an objective, the use of social media to track and timely respond to events that affect the reputation of financial institutions.

EXAMPLE 1

In 2008, Johnson & Johnson released a marketing campaign targeted at mothers with newborns that use slings for carry their children. The campaign that utilized a web commercial that suggested that mothers used such slings for trendy reasons. The campaign asked mothers to use Motrin for relief from back, shoulder and neck pain associated with the use of the slings.

For some reason mothers were disgusted at the suggestion that these slings were merely trendy baby accessories. The result was a Twitter-based protest that snowballed and attracted significant attention. The protest attacked Johnson & Johnson and its Motrin brand on the basis of "not getting it" relative to why mothers use the slings. Eventually the protest reached Johnson & Johnson's ad agency and an apology and retraction of the ad campaign took place.

This social experiment created a reputational issue for Johnson & Johnson and resulted in a significant waste of money and a muddy face for some ad agency and Johnson and Johnson folks associated with the campaign.

EXAMPLE 2

In 2007, HSBC Bank was the target of a Facebook campaign against the Bank's decision to charge a 9.9% interest rate on certain student overdrafts. The virtual "Stop the Great HSBC Graduate Rip-Off" protest was organised by the National Union of Students, which had called for a boycott of Britain’s largest bank. The campaign attracted nearly 5,000 members on the Facebook site.

As with Johnson and Johnson, the event became widely publicized and became a black eye to the global banking giant.

Social Media as a Reputation Risk Tool

According to the Office of the Comptroller of the Currency, reputation risk is the risk to earnings or capital arising from negative public opinion. This affects a bank's ability to establish new relationships or services, or continue servicing existing relationships. This risk can expose the bank to litigation, financial loss, or damage to its reputation.

Reputation risk exposure is present throughout the organization and is why banks have the responsibility to exercise an abundance of caution in dealing with their customers and community. The assessment of reputation risk recognizes the potential impact of the public's opinion on a bank's franchise value. This risk is inherent in all bank activities. Banks which actively associate their name with products and services are more likely to have higher reputation risk exposure. As the bank's vulnerability to public reaction increases, its ability to offer competitive products and services may be affected.

As noted, with Johnson and Johnson and HSBC, an enterprise need not do anything "wrong" to end up with a battered reputation. Further, banks have an affirmative responsibility to manage reputational risk from wherever it may arise.

Enter social media. As the two examples above demonstrate, consumers in the Web 2.0 era no longer write letters - at least most do not. Instead, the disgruntled seek to unite with others who are similarly disgruntled. They band together and utilize the effective word of mouth capabilities built into social media applications such as Twitter and Facebook. The result can be quick and devasting to a bank's image. As such, for a bank to effectively manage its reputation risk in the current environment it must fight fire with fire by itself utilizing the same tools that can be used against the bank.

Today, bank risk managers must work closely with those managing the bank's existing social media applications. To the extent that a bank does not currently have such capability, the risk manager should make the case for the establishment of some form for social media tool such as Twitter, in order to receive complaints and comments. Once received, such feedback must be promptly addressed by the appropriate parties.

Banks that do not make themselves available through social media platforms or that ignore negative feedback are the banks that will find themselves the victims of runaway social media smear campaigns that ultimately result in negative publicity, unnecessary expenses and other potential adverse affect on the bank's bottom line.

To the extent that a bank finds itself being attacked, the bank should rely on a set of incident reponse procedures that include social media attacks. The procedures should address minimizing the negative effect by addressing the issues in an open and direct manner and ensure transparency. The bank should also consult with a social media specialist to determine the most effective manner of quieting the campaign being targeted at the bank.

Social Media Primer for Bankers

Unfortunately, many bankers are not well versed in the uses of social media. As such, bankers should consult with professionals with experience in utilizing social media for risk management and crisis management purposes.

As a first step I would encourage all bankers to download The Community Bankers Guide to Social Network Marketing. It is a free ebook that I wrote to provide a primer to bankers on social media and social networks.

Next I would recommend that risk managers evaluate the processes they have in place to measure reputation risk. In most cases banks focus on the primary risks such as credit risk, liquidity risk, interest rate risk, etc., and do not actively address reputation risk which can have consequences just as severe as the other risks monitored. Risk managers should ensure that social media is incorporated as a measuring tool to ensure that the bank has the opportunity to respond to issues before they become disasters.

In most cases, managing a bank's reputation can be compared to watching the grass grow - it just isn't very exciting. Unfortunately, all it takes is one major event to ruin everyone's day. With a little planning and some knowledge of dealing with the Web 2.0 community, bankers should have a good shot at minimizing or preventing a public relations disaster.