Social Media and Mobile Devices in the Work Place “Are you Ready” Aparna M. Dave, Senior Counsel, Wells Fargo Bank, N.A. Seba Kurian, Counsel, Invesco Jake McKee, Kroll Ontrack April 8, 2014

29% of employees are anytime/anywhere employees with 53% using 3 or more locations and 82% using 7 or mores apps to work, Forrester. 2

Social Media & Mobile Devices in the Work Place  Statistics and Trends  Discovery & Preservation  Privacy & The Stored Communication Act  Collection and Preservation Methods  State and Federal Regulatory Impact  Corporate Usage Policy Best Practices 3

Statistics and Trends

5 Social Media: a staple in everyday communication Number of Active FB Users (millions)  In January 2013, Americans between the ages of spent an average of 3.2 hours a day on social media sites »Of this statistic, Men are on social media sites 2.6 hours a day and women 3.6 hours a day  In January 2014, Facebook surpassed 1.23 billion users »Twitter reported 243 million users in February 2014 –Approximately two new members joining per second »Linkedin at 277 million users in OTX, Americans’ Daily Time spent Social Networking (2013)

 More than 80% of companies are using social media to communicate with potential clients and drive new business. 6 -Worldcom, Corporate Social Media Spent to Increase Among B2B Companies Globally According to Worldcom Survey (May 2011) Social Media: more than personal communication -Marketing Land, New Record For 2014: Hashtags Mentioned in 57% of Super Bowl Ads (Feb. 2014)  During Super Bowl XLVIII, more than 57% of the ads shown mentioned Twitter  Many companies now leverage enterprise social networks for communications with the organization: Many websites now offer 4+ links to share on social media!

 Bring Your Own Device (BYOD) - Gartner CIO survey determined 80% of employees will be eligible to use their own equipment with employee data on board by 2016  Forrester’s study of US information workers revealed that 37% are doing something with technology before formal permissions or policies are instituted.  Pew research reports that 44 percent of cellphone owners have slept with their devices for fear of missing a call, message, or . 7 Mobile Devices: A.K.A. Digital Appendages

Discovery & Preservation

Where does discoverable social media reside? 9 »Comments & Messages –Tweets, wall comments, status updates, posts »Photos –Profile pictures, albums, pictures others tag you in »Videos »User Information –LinkedIn resume, things ‘liked,’ username, date of birth, location, employment & education info, groups joined »Metadata

10 What social media information is discoverable? Generally, social media data is discoverable

11 What social media information is discoverable?  Metadata is data about data Text of post - not metadata Key responsive metadata!

What social media information is discoverable? 12 Is everything discoverable? Courts are settled that social media is discoverable, but not how much is discoverable E.E.O.C. v. Original Honeybaked Ham Co. of Georgia Inc., 2012 WL (D. Colo. Nov. 7, 2012): Reasoned that social media data was the logical equivalent of an “everything about me” folder with a bevy of relevant information. Private Sections? Narrow Broad Mailhoit v. Home Depot U.S.A., Inc., 2012 WL (C.D. Cal. Sept. 7, 2012): The Federal Rules do not grant a “generalized right to rummage at will through information [a person] has limited from public view” absent a Rule 34 showing of “reasonable particularity” in request for data.

13 Court ordered production of data from Facebook and MySpace account: privacy is “wishful thinking” Romano v. Steelcase Inc., 907 N.Y.S.2d 650 (N.Y.Sup. Sept. 21, 2010). Plaintiff ordered to preserve existing information on MySpace and Facebook: provide user names and passwords to opposing counsel McMillen v. Hummingbird Speedway, Inc., No CD (C.P. Jefferson Sept. 9, 2010). Court ordered production of user names and passwords: private portions of social media accounts are “fair game” Zimmerman v. Weis Markets, Inc., No. CV (C.P. Northumberland May 19, 2011). What social media information is discoverable? You post User Content... on the Site at your own risk. Although we allow you to set privacy options that limit access to your pages, please be aware that no security measures are perfect or impenetrable. - Romano v. Steelcase Inc. (citing Facebook’s privacy policy (last viewed June 18, 2009))  Early disputes: public versus private information »What about the private sections of your Facebook?

In Pfizer, Inc. Securities Litigation, 288 F.R.D. 297 (S.D.N.Y. Jan. 8, 2013), plaintiff-shareholders sought sanctions against Pfizer for failing to preserve data from “e-rooms.” The “e-rooms” were internal collaboration applications maintained by the company for sharing documents and calendars, archiving, discussion boards and instant messaging. The court found that this information was relevant because it would allow the plaintiffs to draw connections and understand the narrative of events in a way “not necessarily afforded by custodial production.” The court concluded the company breached its duty to preserve. Sanctions, were not warranted because the conduct was merely negligent and the plaintiffs had not shown that any lost data was, indeed, relevant to their claims. 14 Internal Social Media : You wanted us to preserve that…

In Cotton v. Costco Wholesale Corp., No (D. Kan. July 24, 2013), the court denied the employee-plaintiff’s motion to compel text messages sent or received by employees on their personal cell phones, finding that the employee had failed to show that the employer had any legal right to obtain the text messages. In other words, the phones and the data they contained were not in the “possession, custody, or control” of the employer. This is one of the first of its kind and observers will have to wait to see whether the approach is adopted by other courts in cases to come. 15 BYOD – But it’s my personal phone…

Privacy & The Stored Communication Act

Who do I seek information from when cooperation ceases?  Prohibits: »Electronic Communication Service (ECS) and »Remote Computing Service (RCS) providers  From: »knowingly divulging the contents of »a communication »it stores  Unless the divulgence is: »to an intended recipient of such communication or »express permission from the sender is obtained Does the Stored Communications Act prohibit production of social media? 17

18 Who do I seek information from when cooperation ceases? Seek court order to obtain party’s login information? Subpeona social networking site provider? Crispin v. Christian Audigier Inc., 717 F.Supp.2d 965. Zimmerman v. Weis Markets, Inc., No. CV McMillen v. Hummingbird Speedway, Inc., No CD. SCA

Collection and Preservation Methods

 Assume you discover that: –Your company is being sued –An involved employee has relevant non-privileged information on his LinkedIn profile?  Your options: 20 Learning to Collection Unassisted Collection Social Media Collection Tools “Download Your Information”

Use ‘print screen’ to capture relevant information Screen/video capturing programs do exist  Nothing wrong with “old school” collection 21 Learning to Collection Unassisted Collection Simply ‘Googling’ a name works extremely well Flag other social media profiles he has for review Effective social media search tools do exist Create a log of exactly how and when you documented the webpage; this is essential for authentication Hold on to the images! Profiles are ‘subject to change’

Navigate to the General Account Settings Page to You then will get an ‘archive’ of that user’s Facebook account; as Facebook explains: Is this everything you need? Maybe. It’s entirely possible that the scope of discoverable information may be broader than what’s included in the “archive” Remember to document the process extensively  Facebook has a tool that can ease collection 22 Learning to Collection Unassisted Collection “Download Your Information” 2.

Social media collection tools assist social media collection Some platforms allow you to search social media sites With credentials (court ordered or otherwise), or From a third party perspective – you get to see what’s public Some solutions allow you to add Boolean logic to search the data pool E.g., “fired AND new york” These programs leverage Facebook’s APIs enabling the collection of available metadata  New tools in the ediscovery industry 23 Learning to Collection Social Media Collection Tools 3.

 Best Practices »Consider social media production challenges (e.g. native format) upfront when negotiating at the Rule 26(f) meet and confer »Don’t try to collect social media without consent of the owner »Don’t get overwhelmed: consider enlisting the help of an investigator or service provider if a case size is massive or deadlines are tight »Communicate to your client the importance of prior postings to litigation and the far reaching repercussions of spoliation sanctions 24 Learning to Collection

State and Federal Regulatory Impact

WA OR NV CA UT CO NMAR IL MI  Eleven states have passed laws prohibiting private employers from requesting or requiring that job applicants or employees provide log-in credentials for their personal social media accounts »Only 1% of the Littler Mendelson respondents request social media logins as part of hiring or onboarding process Social Media Policies on the Rise 26 MD

 Holding: NLRB found that the provision was overbroad; it “has a tendency” to inhibit protected employee activity in violation of Section 8(a)(1) of the National Labor Relations Act  Rationale: Concerted activities protesting Costco’s treatment of employees (protected) would be encompassed under this policy  Solution: Carve out exceptions for NLRA protections Costco Wholesale Corp., 358 NLRB No. 106 (Sept. 7, 2012). “Be aware that statements posted electronically (such as [to] online message boards or discussion groups) that damage the Company, defame any individual or damage any person’s reputation, or violate the policies outlined in the Costco Employee Agreement, may be subject to discipline” Implications: National Labor Relations Act 27 Employee Handbook

 Regulation FD prohibits companies registered under Section 12 of the Exchange Act from selectively disclosing material nonpublic information to investors, analysts, etc. without concurrently making widespread public disclosure. »Includes information about earnings, mergers/acquisitions, new products, and changes in control or management.  Regulation FD applied to social media: –April 2, 2013 SEC Press Release Implications: Regulation Fair Disclosure (FD) 28 “[C]ompanies can use social media outlets like Facebook or Twitter to announce key information in compliance with [Regulation FD]... so long as investors have been alerted about which social media will be used to disseminate such information.”

 Terminated CEO alleging lost business opportunities  When plaintiff set up her LinkedIn account, she gave another employee her password according to internal policies  Employer used plaintiff’s password to change her LinkedIn profile to that of the new CEO as well as the password associated with the account  Searches for plaintiff resulted in the display of the incoming CEO’s name, photograph and new position  Holding: »Insufficient damages for claim under the Computer Fraud and Abuse Act »“Likelihood of confusion” element unmet under the Lanham Act »Employer wins on S/J, state actions go forward Implications: Federal Law 29 Eagle v. Moran et al., Civil Action No (E.D.Pa. Oct. 4, 2012).

 Serves as a baseline for appropriate corporate social media policies Social Media Tips: The NLRB’s “Model” Policy 30  As a starting point, employers should: »Avoid unrealistic mandates! »Distinguish between: –purely personal use of social media at work –social media use that furthers the interests of the company (such as contacting customers or marketing a product) »Encourage employees to refrain from personal use of social media while on work equipment, “unless it is authorized by [a] manager” or consistent with company policy.” Social Media Policy Updated: May 4, 2012

Corporate Usage Policy Best Practices

 Onus is on organizations to set policies regarding social media use in the workplace  Proactive social media policies are increasingly popular among corporations, according to a July 2013 Littler Mendelson survey: Social Media Policies on the Rise 32 »64% of respondents created polices regarding employee social media use during work hours »58% had rules for social media use on employer-issued devices »52% had policies addressing employees discussing the company through their own social media channels »10% screened applicants based on social media profiles

Social Media Tips: Usage Policies 33  Articulate clear policies: »Define appropriate workplace use »Inform employees that activity on company devices may be monitored  Encourage prudent posting: »Specify what employees can and cannot divulge »Posts should be honest, accurate, respectful and consistent with corporate ethics and harassment policies »Identify consequences of non-compliance  Train employees: »Couple social media policy with privacy awareness training

 Policy should reflect corporate culture and law  Must understand: »Your company’s brand »Tolerance for dissent and risk »Relationship with workforce  Balance those factors with what the law requires/allows 34 Social Media Tips: Usage Policies Ultimately, there is no “one size fits all” approach!

Q&A

Parting Thoughts 36  Stay updated on social media—it will only continue to expand  Pay attention to case law, new legislation, and ethical guidance  Train employees on usage policies  Balance is key when it comes to social media usage policies

Social Media and Mobile Devices in the Work Place “Are you Ready” Aparna M. Dave, Senior Counsel, Wells Fargo Bank, N.A. Seba Kurian, Counsel, Invesco Jake McKee, Kroll Ontrack April 8, 2014