Social networks seek workplace privacy protections
Published
Contributors:
Mathew Schwartz
The debate over access to people’s Facebook and Twitter profiles is heating up, as a number of legislators seek to ban employers from forcing people to disclose their access credentials. But at the same time, intelligence and law enforcement agencies report that they’re starting to troll social networks for suspicious activity. Should job applicants be required to submit their Facebook username and password to prospective employers, or step through their posts and photographs while an interviewer “shoulder surfs”? That Maryland Department of Public Safety and Correctional Services requirement for anyone interviewing—or recertifying—for a job, ostensibly to look for gang affiliations, drew international attention in part because it highlighted the existing disparity between people’s embrace of social networking and the apparent lack of privacy protections afforded to such communications, at least in the workplace. Department of Corrections Officer Robert Collins said he felt he had to comply with the request—he needed a job—which was made during his reinstatement interview, following a leave of absence he took after his mother died. But Collins also reported the practice to the American Civil Liberties Union of Maryland, which alleged in a complaint that the requirement violated the Stored Communications Act (SCA). While other legal experts have said that it’s not clear whether the law applies to social media, the corrections department has backed off. But the department wasn’t alone in its demand for applicants’ Facebook passwords. Similar demands have been made by everyone from the city of Bozeman, MT, and the McLean County Sheriff's Office in Illinois, to an Ontario law enforcement agency and a New York lobbying firm. The bigger issue is that legal privacy protections often lag advances in communications technology. For example, under current workplace laws, discounting jobs that require a security clearance, employers in the United States—and many other countries—can’t require job applicants to submit to a polygraph test. In addition, employers are prohibited from discriminating on the basis of race, religion, security, age, marital status, sexual orientation, disability, national origin or veteran status, which is why most employers studiously avoid any related questions during job interviews. But imagine what trawling a Facebook profile might reveal. No wonder Facebook has decried social media background checks involving private data. “If you are a Facebook user, you should never have to share your password, let anyone access your account or do anything that might jeopardize the security of your account or violate the privacy of your friends,” said Facebook Director of Privacy and Public Policy Erin Egan last month in a blog post. She also warned that employers might be legally liable for having improperly accessed Facebook communications involving a person’s race, sex or other protected information, as well as for violating the social network’s terms of service, which specifically prohibit users from sharing their passwords. The Maryland case, amongst others, has led many legislators to begin rethinking privacy protections for the social media age. Already, the Maryland House and Senate have passed bipartisan legislation—set to take effect October 1—that protects employees against such practices, even when labeled as “voluntary,” as well as any retaliation for failing to share social network access credentials. Other states—including California, Illinois, Michigan, New Jersey, New York and Washington—are weighing similar legislation, as is Congress. What’s the story outside of the United States? Attorney David Fraser, who runs the Canadian Privacy Law Blog, has said that a “patchwork” of laws covers Canadian workplace privacy. While the country’s privacy laws require that any collection of personal information be reasonable in nature, Alberta has warned any company that tries to vet people via Facebook or Twitter to “take a really careful look” at the law, suggesting that it will be watching such practices closely. Likewise, British Columbia has published a detailed set of guidelines for social media background checks. Outside of North America, many privacy officials are likewise urging caution. “We would have serious concerns if employers were regularly asking employees for their Facebook login details in the UK,” said a spokesperson for Britain’s Information Commissioner’s Office by phone. He emphasized that the country’s Data Protection Act prohibits the storing of “excessive” personal information. The embrace of Facebook, Twitter, Google+, Flickr and their social media ilk has triggered sharp privacy questions beyond the workplace realm too. New European regulations, introduced in January, would extend “right to be forgotten” rules to personal data stored by any business that markets to EU citizens. In other words, anyone who cancels their Twitter account could demand that the microblogging platform remove every post they’ve ever made, “without delay.” But law enforcement demands could add a wrinkle. In Britain, for example, government officials have been pushing service providers to retain subscribers’ communications, including Facebook and Twitter messages. Related debates have been influenced in part by last year’s riots in England, which were coordinated—at least in part—using social networks. Meanwhile, the U.S. Department of Homeland Security already monitors social networks. Likewise, the FBI in January issued a request for information to contractors for its own social media monitoring system. That revelation, perhaps predictably, led to a privacy outcry, with civil rights groups questioning whether the bureau should be trawling people’s Facebook profiles. Since then, however, FBI Special Agent Ganpat “Gunner” Wagh said at a conference that the bureau works hard to balance privacy concerns with the need to monitor social networks during some types of investigations. He also said the FBI—in close consultation with its in-house attorneys—only conducts targeted, deep dives of social networks during the course of an investigation. Given the popularity of social networks, not to mention their self-surveillance side effect, should the bureau’s moves be surprising? Cyber investigations, notably, used to focus only on online crimes. But with everyone today carrying a laptop or cell phone, investigators say that almost any case might have a cyber-investigation component. Likewise, it’s no wonder that for major cases, law enforcement agencies want to study social networks to gain a clearer picture of suspects’ activities. The related “ripped from the headlines” cop-show angle writes itself: Amurder suspect gets exonerated because he checked into a restaurant with Foursquare then sent food snaps to Instagram at the time of a murder. Obviously, that example isn’t real. But as more people mirror their everyday thoughts and activities on social networks, expect the related privacy demands—notably, to keep people’s private social media communications private, barring a court order—to intensify.
