Social Media Policies, an Interview with Sara Delpopolo
Interviewer: Tim Martin, February 2015. Episode #30 from the NET:101 podcast.
Tim: Hello and welcome to episode number 30 of the NET:101 Podcast. With me today I have Sara Delpopolo, who is the principal from Axis Legal, a legal firm based in Sydney. And also the author of "Playing by the Rules - How to Benefit from Social Media without breaking the law." Hello Sara.
Sara: Hi, how are you Tim?
Tim: Good. Okay, what we're gonna talk about today, and I can think of no better person to talk about it with than you. Social media policies. So one of those things that I think everybody has an idea as to what a social policy is, but also a lot of different interpretations of that. So what's your definition of a social media policy?
Sara: Well, a social media policy is basically another document that assists your company in knowing what the rules are internally. So it's part of an employment agreement, realistically. It's another policy, like you would have an OH&S Policy. It replaces the old computer and email use policies, because that's really now - people are using more than just computers and emails. It's now extended to mobile and this whole concept of 24/7 connectivity and what happens in social media. And we've seen that more and more people over the last 5 years have been doing some pretty interesting things. But in social media that's not necessarily flattering for their employer. So, social media policy is effectively another employment - a part of an employment agreement.
Tim: Right, so this is for organisations to essentially cover themselves in case of--
Sara: That's right.
Tim: An incident. Right, so they actually have addressed someone's agreed to work for the business, and part of that agreement is agreeing to the social media policy.
Sara: Yeah, and the thing that makes social media policies a little bit different - because if we think back to the old computer use and email policies, they were a little bit more strict. A little bit more dry, because it's, "You can use your email for this purpose. You can only use it for work purposes, and you can't use your computer for your own personal--" So it was quite dry and it read more like a legal document. The thing with social media is, it's a little bit more fluffy, right? So it's all about how to be nice on social media. And this is where I think for the very first time, companies actually have to express the firm culture. And that's gonna depend from company to company.
So take my firm, right? A law firm is definitely a little bit traditional. We have very strict rules around privacy, client confidentiality. We have high, very high standards. I mean think about the judges that get caught speeding, and they're on the front pages of the newspaper. So, we're kind of really looked at by the powers above. So our social media policies would not include things like, "Make sure that you're out there having lots of fun on social media and tweeting about it and putting it up on Facebook and using Pinterest and Instagram."
So we'll have something that reflects our culture, which is a somewhat fun law firm - as opposed to imagine like a digital agency. Alright, where they're really meant to be out there, they're a lot more extravagant, probably a lot more daring. They're expected to be extremely sociable. It's all about creativity. So their firm culture is gonna be reflected in what they can and can't do inside or in relation to social media.
So this is where social media policies kind of had that - a bit of a crossover. So people need to remember, this is a legal document. It's just that, is like the preface, the preface to that legal document are the fuzzies - warm and fuzzy bits. The things, "Let's be kind to each other on Facebook." It's all those sorts of comments. And that's up to each individual company to decide.
Tim: Now is that something that can be codified? I mean, "Be nice or responsive." Or is it something open to interpretation, and there's a large element of I guess common sense and personal responsibility required?
Sara: Yeah look, I mean I think you're 100% right. It is to a large degree common sense, right? So people - when you make - I mean, I was using a very broad statement, "Be nice to each other." But I mean, I know I've seen some policies where they just say what the levels are as to what's acceptable.
And so, you might have let's say, Charlie Sheen. Okay, so I don't think that Charlie Sheen's gonna be too worried about the use of profanity on his Facebook page, right? So there's your really extreme example. Now, he's still-- Whereas obviously the average even like Australian company, even if you are a digital agency - that would not necessarily be acceptable. However, having said that, even at the extreme level, the Charlie Sheen profanity example. Even with these extreme levels, you still have the boundaries of law.
So, in that instance, when you talk about codification of the warm and fuzzy parts of a social media policy. That'll come down to, "Is this a breach of the discrimination act? Is that harassment? Is it potentially a crime?" So is it a cyber-stalking instance. Or is some other offensive that actually falls foul of a particular piece of legislation of those sorts. Now that's when you're kind of blurring even the most extreme Charlie Sheen version of a policy. You still have to come within the boundaries of legislation.
Tim: But what about the - we'll go back to the interpretation of it. I mean it's one thing to have a black letter document, and it says, "Well we do do this, and we don't do that." But this is so new for a lot of people. Do they need some training and support around how the policies gonna work?
Sara: I think so, and I mean I guess this is where people like yourself come into play. So for example, a lot of people are confused even about what social media that they should be on. Alright, so using myself and my firm as an example again, there's no reason for Axis Legal to be on Instagram or Pinterest. It's not a, there's no business case for it. But we're on Twitter, we have a Facebook page and we have a LinkedIn profile. So that's our company.
Now, a company that a fashion design company, or retail. Well naturally they will also probably be including social media sites like Pinterest and Instagram. So I think that a lot of companies first, the confusion is about what are they really meant to be on? And also, what is the use of each of the platforms? So they need to have some, they definitely need advice from someone who is an expert on the implementation of social media within the company as part of the marketing and business development. To give them guidance on what's gonna make sense for them. And once they've decided that, then the social media can actually properly reflect that.
So again, it comes down to the core generally of a business. Once they know what they're meant to be doing and what's gonna be worthwhile, then the social media policy will reflect it to some sense for the-- Remember, this is a document that is at the very first instance, something that's for employees and contractors and whatever else. So that gives them an idea. It solidifies and it reinforces the company culture and the standards to which it's going to be adhering to.
Now when we know, when we go onto like a Facebook page for example, generally a lot of people, and it is definitely good practice - and required really, to be entirely safe. When you go onto, for example, someone's company Twitter account. Well there should be a link back to the website where the social media, at least the moderation components. So not only is this important for your internal staff to be aware of, because - there are risks that we can probably talk about later in relation to employment issues. But you want to make sure that you can actually make it clear to your customers. For people, the external communication. So whoever's engaging with you externally, as to what are acceptable levels.
Tim: Can I just go back for a moment? You talked about organisations having an understanding as to which platforms they're on or not and that sort of will guide the policy to some extent. What about an organisation that is not actively on social media at all. They maybe don't have a Facebook page, they're not on Twitter, they haven't done anything. Do they still need a social media policy?
Sara: Well probably the most important questions that need to be asked, 'cause I know like what you're saying is exactly what I've heard before. So the question to ask there is, "So how many of your employees are on Facebook? Or on Twitter? Or on Instagram?" And this is the thing. Companies that think, "Oh, we're not on there." And look, there might be very legitimate reasons for someone to not have to worry about or be interested in social media.
Tim: Oh completely.
Sara: The thing - yeah totally. But the thing is, that even if the company as a whole is not interested in social media, there is a 99.9% chance that your staff are on social media. And there's been so many instances in the past where there have been breaches, really serious breaches of client confidentiality, okay? Even of any sort of-- Yeah well, I think that's pretty much the main thing, the client confidentiality. Because an employee has been onsite or doing a piece of work, and has decided to post a photo up on Facebook or tweet about it, Instagram. And next thing you know, the poor company unsuspectingly is in all sorts of strife. And it can be really serious strife. So it's more, it's as important for a company who has no desire to be on social media, to ensure that this is actually covered off in your employment agreement.
It has to be part of your employment agreement. And the other factor is that just because you're not talking about yourself on social media, it doesn't mean that someone else is. So again, you just want to make sure that you're setting out some guidelines, right? It's like customer feedback. Just because you don't have a formal process for customer feedback, it doesn't mean that you're necessarily gonna get some.
Tim: Because this is the other angle that I see a lot within a social media policy. There's the black letter, the education, the training, and mitigating legal risk. But there's also the - what's best practice? How should we do things? What's our turnaround time for a response to the question posted on Facebook? What do we do in the case of somebody voicing a complaint on Twitter?
Tim: Yeah, so really there's a number of different facets of a robust social media policy.
Sara: That's right, and that's the other thing isn't it? Look, this is a real hero (13:10?) for a lot of companies. Because it's a whole new - I guess a platform that they don't really have control over. Not like the internet where people like Harvey Norman, up until a couple of years ago actually chose to not be on the internet. See, social media doesn't give you that choice. So, understandably a lot of people are thinking, "Oh my goodness, like what do with this?" It's hard enough when it's a difficult time potentially financially. You've just come out of GFC. It's hard enough for businesses to focus on the actual daily business. Now they've got this other thing to worry about.
So this is where a lot of companies, a lot of people - and this is large and small, become quite terrified. So you have a social media, and you can have the best social media policy in the universe. And you hand it out as part of the employment agreement. And you're right, and then what happens? How do you actually roll this out? So there have been some cases, and there was a case. I think it's still in dispute, and I'm not sure but, might still be under dispute. But, do you remember the Barminco mine case?
Sara: Last year, remember when everyone was doing the ice bucket challenge for charity?
Tim: Indeed I do.
Sara: Yes well, a group of 15 miners, Barminco miners, decided to do the Hippy Hippy Shake in one of the mines, in their mining gear. And it was a 30 second video. It was for the ice bucket challenge, and it was posted up onto YouTube. I think they had like, they had thousands and thousands of hits in a space of like a couple of hours of viewers. They ended up getting sacked. And a couple of the miners have in fact turned around and are suing Barminco for unfair dismissal. And it's based on what actually does this policy really mean?
So a lot of people are getting these fabulous policies put into place, but they haven't actually got the process. So, this is where getting a policy together, it's not just, "Let's steal it from here, let's copy it from there." There has to be a bit of an understanding about what you're actually physically gonna do. So there has to be a procedure. You can't have a great document to put in the drawer, and then a complaint happens or there's a crisis management. And everyone's running around like a chook with their heads off, because you don't know what to do next.
Tim: So you're saying, in the case of the miners that they may have had a policy there or not, but it's almost mute because if people don't fundamentally understand what is acceptable and unacceptable, doesn't matter.
Sara: That's right, that's right. So this is a document. It's like, this is a document. And I'm talking about internal, right? So we're not necessarily talking about external communications, we're talking here about the internal processes and the internal things. So when you have a policy, when you have a social media policy, it's really important for a company to ensure that they're staff understand it. And that you have, the person that you have to go see.
So if there's an employment dispute, you know that you go to the HR manager, okay? And the HR manager for example, knows what the process is. They have their procedures that they put in place. So every, most companies, even small one's will have who does what? The office manager is in charge of these 10 things. There's a supply operations person or the CFO. You'll have specific roles. So there has to be someone who is actually in charge of looking after some of the aspects of a policy.
Tim: And a policy would be organic in nature too. I mean, things change, new platforms roll out. You'd go back and update the policy?
Sara: Yep, 100%, absolutely.
Tim: Yeah, I saw one the other day and I think they were making reference to Myspace. Now I know it's still out there.
Sara: Hang on, isn't it relaunching?
Tim: Yeah, it's relaunching. But I think that was written like 6 years ago for example and it--
Sara: I know.
Tim: When I read it--
Sara: Ages ago, ages ago.
Tim: It just looked very, very odd. So write down for example as to what do in a crisis. I mean it's one thing to say the wrong thing or post a video or get somebody offside by deleting their comment. But what about crisis management?
Sara: Crisis management. Well crisis-- I mean look, there's all sorts of levels of crisis management obviously. But look, crisis management. Are we talking about for example a brand attack? Or are we talking about defamation or--?
Tim: Oh no, somebody slips on a proverbial grape in the supermarket and all hell breaks loose on their Facebook page. I mean, it's how to deal with an incident like that, a crisis - should that be part of a social media policy also?
Sara: Well, I think that that's probably going into too much detail for a policy. What you need to have in the policy is who you have to report that to. Who is in charge of looking after that? And also, if you're working in a company, then you want to make sure that if one of your employers or one of your staff members or a contractor actually sees something that affects your brand, that it's brought to your attention straight away. So when things like that are discovered, "Oh my God, there's someone that's actually trashing Axis Legal on Instagram," okay? Well we want to know straight away. So there's gotta be a reporting mechanism, and then the person who's actually in charge of that - that's the person who actually puts, applies this management plan into place, into action straight away.
So I think that the big, the big danger is having everyone or no one as an admin manager of your social media sites. You have to have, you have to have a designated - more than one but less than 20 people looking after your sites. And the second thing is that, I mean, and you would agree with this. I would imagine you would've seen this sort of stuff. You can't be silent, you can't excuse yourself, you can't remove things unless they're entirely offensive. And I mean offensive as in, they are completely defamatory or racially discriminating or something extreme. But you have to have the mechanisms of what happens in those instances. Don't get involved for example, report things - don't start responding to them yourself as an employee, would be a really obvious thing.
Tim: Yeah I guess that would be complemented with house rules on the various social media platforms.
Tim: I know it's quite common for example, on Facebook there's a separate tab, which are the rules - and they're up there for everybody to read, and if you break the rules, well this is what's gonna happen.
Sara: That's right, yeah, and that's your warm and fuzzies, right? Your house rules. So, the house rules is for your external communication so that's your 3rd party interactions. And you're house rules and the rest of the policy is really for your internal so they know. Your staff know what to do. Yeah, so crisis management, that's really procedural, so that will be-- And a lot of that is legal, a lot of that comes down to legal. So it would depend on what sort of issue there is at hand as to what the legal steps would be to make sure that whatever has happened on the website does not breach-- For example,someone doesn't decide to post up a comment - and thereby potentially misleading, deceptive. Falling into the misleading, deceptive conduct trap. Or inciting further defamatory comments to be made or making a statement that may actually affect share price of a company. So that's the sort of stuff where you really do need to have the one person to go back, report crisis has occurred, and the procedures are set at that level.
Tim: And I know one of the big traps that a lot of organisations fall into when there is a bit of static or some push back from the community, is to go ahead and delete comments. They may delete their original comment, which caused the issue in the first place. Or they might not like what people are saying, and they try and delete and block those users. I guess that a social media policy would deal with situations like that too?
Sara: Yeah I think so, and look the reality is that if you're a company, you should be entitled to block people. So if I'm a restaurant and I decide that I do not want to serve a customer in my restaurant again because they have been completely rude - beyond, beyond reasonable. I'm entitled to say, "I'm sorry I'm not serving you." It's just different in the physical world, because it's no longer a private activity when you're doing this. On social media, everyone gets to know that you've decided to block someone, because you're not happy with them. And so that, as you've said, can spiral completely ridiculously and get out of hand. Become bigger than Ben Hur, and next thing you know you've got consumer support groups lobbying - it can get that ridiculous. 'Cause people do get caught up in a frenzy.
Tim: Oh, I've seen it.
Sara: They get caught up, but they've actually - haven't taken a step back to go, "What exactly are we actually contributing here to realistically? So when you have situations like that, you shouldn't just do the knee jerk reaction and start pulling down your comments. This definitely infuriates people, and it's like covering up a bad service. But people generally just want to hear, "Sorry." Now you don't have to sit there and say sorry about everything. I don't think that that really is a requirement. I don't that companies need to think, need to be lead to believe that they are actually gonna end up being at the mercy of everyone.
But I think that it should be limited to pulling things down that will actually potentially breach laws. So, if someone decides to post up a pornographic photo, which I think happened with one of the Virgin sites, wasn't it? Last someone actually posted on - I think it was Virgin or Qantas? Or British Airways? It was one of the airlines. Someone actually posted a pornographic photo. Now, clearly you're gonna pull that down. So anything that is pornographic, you will pull down from your Twitter. You don't need an excuse to do that. Anything that is racially discriminating, or inciting violence - pull it down. These are your major, major breaches. You don't need an excuse.
If it's just talking about customer service or product that they weren't happy with. Or, "We bought something at your shop, we bought a TV and it's broken." That sort of thing is more just a general comment, and I think that it needs to be dealt with differently.
Tim: I see a lot of sticky situations where people are being baited. The trolls are coming on, and the inexperienced social media manager, or whoever is looking after the page, basically doesn't see it for what it is, and takes the bait. And it just turns nasty.
Sara: Yeah it does, and you know people are passionate - without having social media to make it all complicated. But people say all sorts of things in SMS's, and it's misconstrued. I mean this is the internet, you can't see someone's facial expression, you can't hear the tone of someone's voice. You don't even really know anything abou this person. In most cases, they are strangers. So people tend to overreact, because everyone reads things differently. That's the danger of - especially when you're looking at a tweet. That's very dangerous as well. Because you've got 140 characters, most people can't even express themselves in 140 words, let alone 140 characters.
So you know the confusion that has happened in a tweet. Sometimes it's clear and sometimes it just spirals as you said. But look, otherwise I think that with people that are getting baited, that's really where it comes down to. Someone like yourself or other providers that can actually go in there and provide some guidance on what, "How am I actually going to deal with social media getting in my life?" So it's not the fact that yeah, it's not the fact that I've got or want social media, it's the fact that it's here to stay.
Tim: Yeah and it's rough and tumble out there. I know that many brands for example are talked about in forums. You've got - Whirlpool is a big one in Australia.
Sara: Oh it's been around forever.
Tim: But I would caution in some instances going in and trying to react or engage with some of these posts. Because the community can be absolutely vicious.
Sara: Oh yeah, absolutely, and you don't want to end up in one of those. Remember, people that tend to complain a lot on these social media sites - they may not necessarily be busy. I was going to say, it's not necessarily the busiest people or even the most aware people. People say things without realising it, and let emotions get away with them. The next thing you know you're caught up.
Tim: Completely, yeah caught up big time. So a social media policy for example might say, "Look, we will monitor this particular forum or this space, but we will not react or engage. But on Facebook for example, we will monitor and we will react and engage." So that's saying--
Tim: Good for platform A, but not so good for platform B.
Sara: Yeah, exactly. And that, again - the social media policy has to have a look at what you're doing. So it makes entire sense, right?
Tim: Yeah, yeah it does. But we go back to the original position, that whether you're in social media or not, people still talking about you on social media. So it's a question, how you react to that.
Tim: Another aspect would be social media use at work. That I know some organisations have a ban on Facebook for example. Others say, "Look, it's free for all. Anything that you want." And others say, "You can't use anything except LinkedIn." So that would have to be plain and clear in a social media policy, yes?
Tim: And then what happens when the employee leaves work? Does a social policy still apply after they've physically left work?
Sara: Well this is where it gets interesting, right? Because generally when you're with a company for example you've got your LinkedIn profile. Well, your LinkedIn profile would have your current place of employment, and you'll probably also have along the way added clients of your employer. So people that you're working for, or people that you meet through work. So contacts. When you leave, as you would know - I mean, well no, not necessarily because we both have our own companies. We haven't left for ages. But with, when you leave a job you don't have to make an announcement to your clients, right? You just update your profile on LinkedIn, and everyone knows. And suddenly it's, now it would be up - it sends you the notice the notice to congratulate Tim Martin on his new job, he's moved, right? So you no longer need to have that thing.
Now on the flip side, think (30:26?) to your employment and agreement. Every employment agreement probably would, or should, have some sort of confidentiality provision on a restraint of trade. So you'll have a restraint of trade saying that you can't contact clients for the purpose of soliciting them, or enticing them. Now enticing's a very weird word, right? Because it could be enticing them just by an announcement on LinkedIn that you've moved. So there's a bit of an issue there, right? So this is where it does kinda get very tricky.
And there have been some cases, there was a case, a landmark case in the UK. You know Hays recruitment? Oh it's huge, right? So it's a UK based company. Now there was an employee who was with Hays for 7 years. 7 years is a pretty long time. You can pretty much guess that almost every contact, business contact that that person, that employee had amassed was as a direct result of having worked for Hays. Now think also of the job role. You're a recruitment agent. Your job is effectively to go out and meet people. Make contacts. And sometimes they're short lead and sometimes they're long tail marketing contacts. You might not, you might have met someone 2 years ago, and then 2 years down the track - today - they suddenly need you. So that's what recruitment and a lot of business development and a businesses is like that.
In the Hays case, the employee left and went to work for one of the competitors, and bingo. LinkedIn updates the profile, and the employee who was previously at Hays, then continues on with the business of promoting and acting for the clients - and Hays sues. And Hays won. Hays won in that case, because ultimately they said, "There was absolutely no way that that employee would have amassed those contacts, but for the fact that they were working at Hays." That was an interesting case, it was the first one that said, "Beware." But the killer with that, and the other thing that came out of that case was a warning for companies that - this has now changed the whole-- You know that people like to think of their client lists as their confidential information, like your own trade secret. It might be your little black book.
Some firms, I mean, I know for example my own firm - I've got a client page. I don't list every single client that I have. There are some clients that are even bigger than ones that I have there, that have actually said, "Look, it's just our global policy that we don't have logos on other people's sites." So I've got to respect that. So there is a certain freedom as far as who you can actually tell, but for example for me - well maybe my price list might be confidential? Maybe my entire client list will be confidential. But if everyone has actually got access to my entire client list, because my LinkedIn profile is public, and people can see every single one of my 800 and whatever contacts there. I'm not sure if you're gonna be able to argue confidentiality. So this is the whole - yeah, so when someone leaves, you've got this double edged sword.
Tim: Now is this where a social media policy kicks in or just--?
Sara: That's right, yeah. So you've got 2 things there, right? Your social media policy, I mean most social media policies already should include what they can and can't do with equipment. I mean, if you're in a job that you're actually provided with a mobile phone, and iPad, a computer - then the policy should actually have something about what you can and can't do on company property, right? And irrespective of the hours potentially. Alright, and the second thing that it should have is a notice that upon leaving, you should remove all clients - firm clients, and firm contacts from your social media sites. So there needs to be something in there. However, like the crisis management, right? That's gotta be a process that's implemented at the job by that person that looks after it.
Tim: Yeah, no that makes sense. I would imagine that because the space is so new that we're finding these things out the hard way one at a time as they're happening.
Sara: Yeah, yeah totally. What about - and this is another thing that we've seen a lot of. Small company or even - goodness, some of the bigger companies have employed a social media manager. And that social media manager decides to fix up all of the sites, social media platforms and decides to create a LinkedIn profile, and decides to create the Facebook page and the Twitter and everything else. Well you would probably know, that a lot of these sites can only be created off the back of a personal profile.
Tim: Begs the question, whose personal profile is it?
Sara: Well the thing is, what happens when that employee leaves, or something happens, they die? How are you gonna enforce the continuation of your social media platform by someone who is the holder of the platform, right? And you've maybe haven't contemplated them leaving, and they've now got another job for someone else. So these are sorts of like things where we go in and we go, "Right, these are the steps you need to actually do now, before the person leaves - to fix this sort of stuff up."
Tim: Yeah, because whether you're legally in the right or not, it's gonna be a hell of a mess, isn't it? I mean if you're locked out of your own platforms. So, you would imagine that more than one person in the organisation should have access to the key login credentials for all of the business accounts.
Sara: Yeah, but it's worse than that Tim, because it's not just being an admin. The controller of the website now no longer works with you. So they could do, they could shut it down. It wouldn't matter if you're an administrator. So this is where little tricks and things can come into play. So, even worse, if you have walked out that employee. I've seen people unleash all sorts of terror on their employers after having been walked out.
Tim: Yes, so have I.
Sara: Pretty nasty stuff, right? And so this is the sort of thing that needs to be contemplated. So yes, you do have a social media policy, but the details of how you actually roll that out, that's something that you're company, your own business - you would need to sort that out. That's - again - some of it is practical, okay? But the practicalities are often underpinned by what you can and can't legally do.
Tim: Yes. Sara, I'm gonna have to get you back on the show to give us nothing but war stories about terrible things that have happened on social media, 'cause it makes for fascinating listening.
Sara: Oh yeah, totally.
Tim: Especially if it hasn't happened to you, and some other poor person. Sara, let people know where they can find you?
Sara: Okay, well I've got a Twitter page, let me just-- It's @sdelpopolo, that's my own Twitter. But we've also got a firm Twitter account. So we've got @axislegal, very easy. And otherwise, gee where else can you find us? We're on LinkedIn, and we do have a Facebook page as well.
Tim: Excellent, easy to find, and I'm sure that more than one person in your organisation has access to all of those accounts, right?
Sara: Oh yes, I've got them all tied up in knots.
Tim: Tremendous. Sara, thanks so much for your time, we'll talk again.
Sara: Alright, thanks Tim.
Tim: Okay, chow.
Sara: It's been a pleasure, bye.