Los Angeles Real Estate Litigation Lawyer Jeffer Mangels Butler & Mitchell LLP Home
Social media records as corporate records
by Robert E. Braun
Bob Braun’s article titled "Social Media Records as Corporate Records," was published in the August 31, 2011 edition of BNA’s Corporate Counsel Weekly. To view a PDF version, click here. See PDF for footnote information.
August 31, 2011. Reprinted with permission.
Where and how companies maintain their records has undergone a seismic revolution in the past several years. Firms began utilizing electronic storage facilities to retain records decades ago, and email long ago overtook physical mail as a preferred means of written communication. More recently, mobile devices and remote servers have become prevalent means of obtaining, transmitting and storing information. These changes in technology have demanded a legal response — how should enterprises address these new methods of collecting, storing and retrieving information so as to comply with legal obligations. The response, from a legal perspective, has been to treat all these sources of information as electronic records (Electronically Stored Information, or ESI), as provided in a variety of statutes, regulations and court decisions.
Technological advances are not alone in changing the landscape of ESI – companies must also consider how technological advances are used and how those can impact approaches to ESI. In particular, as interactive media have gained popularity over the last several years, social media have developed into a new and potentially confusing source of electronic records. As social media transitions from a narrowly used facility among a limited number of users into a generally accepted means of communicating and storing information, companies have to determine whether that information should be treated as Electronically Stored Information, or whether it has different characteristics and requires different treatment.
The question firms now face is whether (or should) the rules regarding the maintenance of ESI apply to information on social networks, and if so, are there responses to minimize the legal liability of a social network presence.
What is social media?
Social media has a number of definitions, depending on the user and promoter. Social media has been identified as media optimized for social interaction, using highly accessible and scalable communication techniques, and one of the key elements of social media, under this definition, is the use of web-based and mobile technologies to turn communication into interactive dialogue. Another accepted definition of social media is "a group of Internet-based applications that build on the ideological and technological foundations of Web 2.0, which allows the creation and exchange of user-generated content." Still others refer to social media as “the set of Web-based broadcast technologies that enable the democratization of content, giving people the ability to emerge from consumers of content to publishers.”
The common thread to all these definitions is the focus on the technology used to host social media – Internet based applications which emphasize the importance of interactivity, turning the transactions of a static media environment into a interactional environment. Underlying the technology and interactivity of social media is another aspect, which focuses not on the technology, which allows multiple parties to generate content, but to the content itself, commonly referred to as consumer-generated media (CGM). Social media outlets blend technology and social interaction to blur the lines between creators and users of information, resulting in multiple sources and authorship. This aspect of social media creates new challenges for companies at the very same time that these companies are, more and more, emphasizing the value of information, the importance of collecting it, and the risk of its unintended or unauthorized disclosure.
How do businesses use social media?
Corporations recognize the value of interactive communications with their stakeholders (whether shareholders, customers, employees or others) and have incorporated social media into their core communications strategies. Unlike traditional “static” websites, which simply allow a company to present the information it generates, social media sites also include interactive features allowing communication between the sponsor and the viewers and between the viewers themselves. Companies are thus able to tap into the opinions of their stakeholders on a real-time, uncensored basis, allowing them greater access to key information. Firms are also attracted by the low cost of developing and maintaining a social network presence; compared to an advertising campaign on traditional media (print, radio and television), a presence on a social media site is strikingly inexpensive and holds the possibility of connecting directly with key constituents. Consequently, many companies have committed to social media as a way to connect with customers, employees and shareholders. A majority of Fortune 500 companies have either a Twitter or a Facebook account, and it is estimated that, today, 60% of companies are using social media in some way.
How is social network ESI the same as other information?
At the outset, there are many similarities between the ways businesses use social media and the way businesses use company-sponsored websites without the interactivity and community generated material of social media. For example, a company that establishes a Facebook page prepares its own materials, establishes terms of use (within Facebook’s requirements), responds to consumer inquiries, displays information that may not be substantially different from its company-based website; it may be the functional equivalent of an informational, static website. To that end, the “rules of the road” for acquiring, protecting and using information for the Facebook page may not be different from the company’s website. Instead, a social media site may simply be a substitute for or addition to other forms of communication and advertising.
How are social networks different from other ESI?
Businesses can also establish social media sites that are significantly different from static websites. Most obviously, social media sites, or at least the sites that take advantage of the interactivity of social media, are not "one-way," static sites; they provide a means for viewers and visitors to respond in ways that are not controlled by the sponsor. The sponsor may have limited ability to screen user comments, or to differentiate sponsored sites from independent sites.
Perhaps most significantly, by situating a presence on another entity’s Internet real estate, the sponsoring company will adopt the social media company’s rules, which may be at odds with the sponsor’s policies. Social media websites often claim rights in any information that passes through the site, making possible for the social media website to utilize the sponsor’s material. Moreover, some rules can conflict directly with the company’s policies. For example, it is not uncommon for companies to have a general policy of deleting email 90 days after receipt or generation; social media networks may have policies of retaining emails for longer periods of time, or never deleting those emails. Companies that use social media messaging functions to respond to customers and inquiries need to be aware of differing policies and how those impact existing procedures.
The issue as to the discovery of social media has become particularly apparent in employment cases. Commentators have speculated that if an employee uses social media for business purposes, it may lead to an obligation of the employer to preserve the evidence; where an employer monitors social media by employees, that employer may have increased its obligation to preserve the usage as evidence uses social media.
Regulators are treating social network information as ESI
Since social media, by definition, involves the dissemination of information, it is not surprising that corporate deployment of social media raises potential compliance issues under the federal securities laws and has become the focus of regulators. Regulators, particularly securities regulators, are beginning to treat information derived from or provided on social networks as ESI and subject to the same treatment.
The Financial Industry Regulatory Authority (FINRA) recently issued guidance for broker-dealers that “Every Firm that intends to communicate, or permit its associated persons to communicate, through social media sites must first ensure that it can retain records of those communications as required by Rules 17a-3 and17a-4 under the Securities Exchange Act of 1934 and NASD Rule 3110.” FINRA used this authority to fine Credit Suisse Securities $4.5 million in May 2011, citing Credit Suisse’s failure to disclose updates on the performance of some residential subprime mortgage securitizations (“RMBS”) on its website as one reason. In its May 26, 2011 press release, FINRA described its findings and the basis for its fine:
FINRA found that in 2006, Credit Suisse misrepresented the historical delinquency rates for 21 subprime RMBS it underwrote and sold. Although Credit Suisse knew of these inaccuracies, it did not sufficiently investigate the delinquency errors, inform clients who invested in these securitizations of the specific reporting discrepancies or correct the information on the website where the information was displayed. Credit Suisse also failed to name or define the methodology used to calculate mortgage delinquencies in five other subprime securitizations. Additionally, Credit Suisse failed to establish an adequate system to supervise the maintenance and updating of relevant disclosure on its website (emphasis added).
What should companies do?
There are a variety of steps companies should consider when incorporating social media into their business operations.
Document Retention Policies. First and foremost, since a company may be expected to preserve social media as evidence in a future proceeding, a company should rationally revise its document retention policies to reflect that possibility. A document retention policy should incorporate several key components:
- Recognize that social media is treated as any other ESI – the fact that it is maintained through a social media site or access does not change the company’s obligations.
- Reflect the company’s actual social media uses and needs, both by the company and its employees – utilizing another company’s standard will not address the issue.
- Audit and enforce the policy; failure to enforce the policy eliminates its credibility. Moreover, all employees should periodically acknowledge the knowledge and acceptance of the policy in writing.
- Update the policy regularly to reflect technological developments and changes imposed by social networks themselves.
- In addition to changes imposed by social media sponsors, consideration should be given to the multiplicity of different physical platforms – smartphones, tablets, cloud computing, etc. – that can have an impact on document retention policies.
Company Presence on Social Media. Companies that utilize social media as a means of communicating with customers, vendors, shareholders and others should treat postings with the same degree of seriousness as any other communication. This is particularly challenging because of the informal nature of social media and the belief that the benefits of using social media will be lost by utilizing the same formalities, disclaimers and other techniques used with other communications. However, that very issue argues toward a careful implementation of social media – in addition to its informal nature, social media is virtually indestructible, whether by virtue of the rules and policies of its sponsors, or the nature of the Internet, which makes complete eradication of a statement, or even its correction, difficult, if not impossible.
Monitoring Social Media. Those factors also suggest that companies actively monitor social media use by employees and establish appropriate guidelines, both with respect to company hardware and mobile or offsite systems. While monitoring social media usage may render a company more likely to be subject to obligations with respect to that media, it seems likely that a company would be held liable in any case; monitoring usage may give the company additional opportunities to avoid improper statements attributed to it.
Please contact us
Robert Braun is a partner at Jeffer Mangels Butler & Mitchell LLP. His practice focuses on information technology and security. For more information, contact Bob at RBraun@jmbm.com or 310.201.5331
