Tread carefully with social media checks

Alberta’s privacy commissioner issues guidelines for employers
By Amanda Silliker
|Canadian HR Reporter|Last Updated: 01/26/2012

When Ryan Berger, a partner at law firm Bull, Housser and Tupper, is conducting social media seminars with employers, he asks: “Who types a potential candidate’s name into Google or looks them up on Facebook?”

Invariably, just about everyone puts up their hand, he said.

“Oftentimes, people’s first reaction when they meet someone or they’re dealing with someone new, they’ll punch them into Google and see what comes up,” said Berger, who is based in Vancouver.

This growing trend among employers prompted the Office of the Information and Privacy Commissioner of Alberta to release Guidelines for Social Media Background Checks in December. The term “social media” in the guidelines refers to social networking sites, blogs, micro-blogging (such as Twitter) and file-sharing sites, including photographs and video. British Columbia is the only other province with such guidelines.

“Generally, we needed to highlight and communicate to organizations that there are risks in terms of collecting personal information through social media and to understand those risks prior to doing it,” said Tara Perverseff, portfolio officer at the Office of the Information and Privacy Commissioner of Alberta in Calgary.

“Organizations probably do it but don’t understand there are risks associated with doing it.”

Inaccurate, out-of-date information

One risk is the information collected may not be accurate, according to Alberta’s guidelines. Social media can include mislabelled photographs and out-of-date information, and recruiters may need to guess which social media account matches the name on a resumé.

Privacy laws require organizations to take steps to ensure the information collected during background checks is accurate, said Perverseff.

“We put this one guy’s name into Google and the first thing that came up was that he was a child molester,” said Michelle Berg, president and CEO of Elevated HR Solutions in Calgary.

“It’s bad for the guy but we knew, when we dug a little bit deeper, it couldn’t have been him from an age perspective and so on and so forth. But if you took it at face value…”

Now, Berg uses email addresses, instead of names, for social media background checks including Google, Facebook, Twitter and YouTube. On her company’s website, it clearly outlines that by submitting your resumé, you’re consenting to a background check, which will include social media, she said.

And employers cannot collect information without consent under privacy laws, said Perverseff.

Too much personal information

Another hazard is a recruiter may be collecting irrelevant information or too much personal information. Under privacy laws, organizations can only collect personal information a reasonable person would consider appropriate in the circumstances. With social media, employers lose control over the quantity of information they collect, according to the guidelines.

And collecting irrelevant or too much personal information can easily lead to discrimination, said Berg.

“If I put their email address into Facebook and they come up, I could know how big they are, how old they are, what colour their skin is and, as an employer, I could start to make decisions: ‘Oh, maybe I don’t want that person,’” she said.

This discrimination opens the door for human rights complaints because the employer can be collecting information that should not be a factor in selecting a new employee, said Perverseff.

“Even if the decision not to hire me was honestly because I wasn’t the right fit for the job… I can come back to you and ask, ‘What did you look at? Can I please have access to my personal information?’ and I find out you checked my Facebook page, you found out I am a single mother or I’m Jewish or I’m gay and I file a human rights complaint,” she said.

Third party information

The third major hazard is collecting third party information. For example, in viewing an individual’s Facebook profile, an organization may be collecting personal information without consent about other individuals who have posted on the profile page, which may constitute a violation of privacy laws, according to the guidelines.

If an individual makes a complaint to the privacy commissioner, an investigation will be launched to determine what personal information was collected, said Perverseff.

If the commissioner determines an organization has violated privacy laws, the commissioner can issue an order to the organization and, in some circumstances, the individual affected may have a cause of action for damages, said Guidelines for Social Media Background Checks.

“We haven’t seen a case like that yet but, at some point, it’s brewing,” said Berger. “The privacy commissioner has the power to essentially issue a fine or make a monetary order. They haven’t done that yet, but the legal fees in dealing with these sorts of things will probably outweigh any fines they start to issue, at least initially.”

And this can pose reputational risks as the names of organizations that are in contravention of privacy laws are published, said Perverseff.

According to the guidelines, simply viewing the information is considered a form of collection — which may be difficult to prove.

“We’re people, we all have our judgment, we don’t really write it down, therefore, it’s not really collected and, most importantly, we tend to keep it to ourselves,” said Berg. “So how would (the privacy commissioner) ever prove otherwise?”

And Berger agreed HR professionals are not necessarily writing down or making a printout of every web page they visit, he said.

To determine whether or not a social media background check is reasonable, the guidelines recommend employers conduct a privacy impact assessment. This looks at the reason for collecting the information, what is being collected, how it will be safeguarded and the collection’s impact on privacy.

The assessment identifies the risks in advance and then an organization can assess whether the risks are too great, said Perverseff.

Organizations should consider whether it’s appropriate to conduct a social media background check for the position, said Berger.

“If you’re employing a truck driver, it would be appropriate to get an ICBC (Insurance Corporation of British Columbia) abstract, but not necessarily a credit check and I think it’s the same thing with social media. You don’t necessarily need to know what the truck driver is posting on Facebook but if you’re hiring for a media communications company, you would want to see how this person is putting themselves out there to the world,” he said.

Organizations need to consider the business purpose of conducting social media background checks and what they are going to gain that they cannot get through traditional means, said Perverseff.

“Before we used social media, you interviewed the person, you checked references, you talked to previous employers — you didn’t go through their garbage or follow them on the street and listen to a conversation they were having with their mom,” she said. “Our office would argue you really just don’t need it.”

Add Comment

  • *
  • *
  • *
  • *