Implementing social media policies in Hong Kong's workplace

With the recent rise of social media such as LinkedIn, Twitter, and Facebook in the workplace, it is becoming increasingly important for employers to consider their social media policies in order to adequately protect their business interests whilst upholding the employees’ personal data rights and freedom of speech.

Social media issues may arise within the context of employment in a number of areas including recruitment, disciplinary action, termination and post-termination.

For instance, in the context of recruitment, what evidential weight should employers place on information gleaned from social media sites regarding potential candidates and will this expose them to any risks of discrimination allegations? Upon termination, what right does the employee have to retain Facebook friends or LinkedIn contacts acquired within the course of employment and would this pose any risk of a breach of post-termination restrictive covenants?

In Hong Kong, there is currently no dedicated law governing the use of social media in the workplace and so existing employment and personal data law, namely the Employment Ordinance (EO) and the Personal Data Privacy Ordinance (PDPO) will apply. There are also various codes and guidelines issued by the Privacy Commissioner for Personal Data (e.g. the Privacy Guidelines on Monitoring and Personal Data Privacy at Work), which regulate the employer’s ability to monitor its employees’ emails and internet usage.

Whilst we have yet to see any significant Hong Kong employment cases involving social media, some guidance may be obtained from recent English cases which still remain highly persuasive in Hong Kong.

For example, in one instance, the High Court ordered a former employee to disclose the LinkedIn contacts acquired during the course of his employment on the basis that he was in breach of a non-solicitation clause by sending invitations to his employer’s clients prior to his departure. In another case, the High Court upheld an employee’s claim for breach of contract where he was demoted as a result of posting comments on his Facebook wall considered to be against his employer’s Code of Conduct, in spite of the fact that many of his colleagues were able to view those comments.

Given the rapid explosion of social networking, it is therefore becoming increasingly important for employers to put in place clear social media policies and have them properly implemented. Below are a few practical tips to be observed by employers in formulating a social media policy and monitoring an employee’s use or access of social media in the workplace.

1. Implement a clear and comprehensive policy dedicated to the use of social media.
In the absence of a clear policy, it may be difficult for an employer to lawfully sanction an employee for misuse of social media. Employers should therefore implement a social media policy that clearly sets out acceptable and unacceptable conduct of employees both within and outside of working hours as well as post-employment.

For example, clear guidelines should be provided on the confidentiality settings to be implemented by the employee. Such policy should be implemented in accordance with the relevant local data privacy and employment laws (i.e. the EO and PDPO) without being so sweeping that it contravenes the laws.

The policy should be broadly worded without limiting it to specific social media sites, given the constant and rapid expansion and development of social networking.

It should also set out in detail the possible conduct of the employee that would warrant disciplinary action, for instance disclosure of the employer’s confidential information on social media sites from which the employer is easily identifiable, excessive use of social media during working hours, and making derogatory comments about colleagues, the employer, its products and services, or its customers.

In relation to business contacts accumulated within the course of employment, employers should provide clear guidelines as to whether those contacts appearing on a particular site belong to the employer.

Employers should address the use of confidential information in their social media policies in a clear and precise manner so that employees are well aware of what they are allowed to disclose. Employers should make it clear that employees may be held accountable for misuse of the employer’s confidential information on social media sites, even if this occurs outside of office hours. It is also advisable to include details of what may constitute prohibited use of social media sites within the employment agreement and any separate confidentiality agreement.

2. Regular review and update
The social media policy should be regularly reviewed and updated given the speed and expansion of social media development.

3. Implement a lawful and reasonable monitoring system
If an employer chooses to monitor its employee’s use of social media, it should include clear guidelines as part of its social media policy. Any monitoring system adopted should be reasonable and should not exceed what is necessary to protect the employer’s legitimate business interests. Employers will need to balance the protection of their legitimate interests with the employee’s right to privacy.

Employers are generally permitted to monitor and to block altogether an employee’s social media use on devices owned by the employer.

However, an employee’s social media access on his or her own device such as an employee’s personal smart phone may be prohibited during working hours but constraints will apply in relation to monitoring.

Furthermore, general monitoring without sufficient justification may be perceived to be unfair. In some instances, “concealed” monitoring may be justified where there is a legitimate reason to carry it out and where all other options have been considered and appropriately rejected.

Employers should follow these general guidelines:

• Restrict monitoring of the employee’s social media use to what is necessary and proportionate to protect legitimate business interests.
• Properly inform employees of monitoring guidelines and provide a Personal Information Collection Statement in accordance with the PDPO setting out the purpose of the collection, and the employees’ rights of access.
• Ensure that any monitoring is carried out by properly authorized personnel and does not contravene the PDPO, e.g. ensure that any information is stored safely and not for longer than is necessary.

4. Provide proper and regular training
All company policies, including social media policies, should be communicated to employees and regular training should be provided. This will ensure that employees are well aware of their obligations and of what constitutes the employer’s confidential information.

5. Ensure consistency in policies and their implementation
Employers should ensure that the social media policy is consistent with its other workplace policies, such as harassment, confidentiality and discrimination policies. It is important that any company policy is consistently enforced, and the social media policy is no exception.

6. Treat information gleaned from social media with caution
Information gleaned from an employee’s social media site should be treated with caution, particularly for the purposes of recruitment or in respect of taking disciplinary action as such information may be inaccurate and/or outdated.

Again, employers should balance their rights to protect legitimate business interests with the data privacy rights and freedom of speech of employees.

Relying on information obtained from social media sites may also expose employers to the risk of discrimination allegations. For example, in relation to recruitment, it is possible to envision a scenario whereby a candidate may be treated less favourably by reason of some personal information obtained by the employer from social media sites.

Whilst employers may conduct searches on public forums such as LinkedIn as part of the recruitment process, they should be able to demonstrate the relevance and reasonableness of such search.