For The Defense, February 2012 - DRI Today

not be sufficient to encompass the specific
concerns related to social networking, for
example, especially if social networking is
not mentioned. Second, in terms of “education,”
employees must receive education
about an acceptable use policy and understand
the repercussions of violating the
policy. Third, company must enforce an
acceptable use policy. Fourth, an employer
can require employees who use social networking
for business purposes to create
separate business accounts based on business
e-mail addresses as a condition to
using certain sites in the workplace and
on the employer’s equipment, including
mobile phones, desktops, and laptops,
establishing “separation” between acceptable
business use and personal use. Fifth,
an employer should ensure “discoverability”
by making employees aware that the
information that they post on social networking
sites, their e-mails, and conversations
may be subject to legal holds and legal
collection obligations. An employer should
formulate a written agreement stating that
in exchange for an employee’s access and
use of social networking in the workplace,
the employee will grant consent for the disclosure
of the information from his or her
business profile page, including e-mail,
posts, notes, and all features of Facebook
or Twitter used for communication purposes
in the event that the employer needs
the information for litigation or general
auditing purposes. Sixth, by “visibility”
we mean that an employee should have no
expectation of privacy in communications
on social networking sites made through
the employee’s business account, on an
employer’s computer network, or on the
employer’s hardware, including desktop
computers, laptop computers, and mobile
phones. Seventh, “formality” means that
an employer should remind employees
that the rules that apply to their normal
business conversations and communications
also apply with respect to social
networking in the workplace. Eighth and
finally, an employer should define the privacy
settings “accessibility limits” that an
employee account should maintain in his
or her business accounts. For example, an
employee profile should be set so that an
Internet search would not reveal information
about the employer’s business contacts
or clients.
Records Retention, Preservation,
and Collection
As mentioned previously, employees’ use
of social networking and mobile devices
for business purposes increases the scope
of discoverable information that a company
has to manage, and so a company
may need to modify data retention procedures
to accommodate discovery- related
legal duties. If a company anticipates litigation,
after consulting with counsel a company
should consider issuing a litigation
hold that encompasses information posted
on social networking sites.
A company should also work with the
company IT departments to explore the
application of tools that automatically
retain and preserve electronic records
aligned with the company’s legal hold
instructions. Given the rapid pace of technological
innovation, however, it is likely
that automatic preservation technologies
will continue to trail the evolution of communication
platforms, creating burdensome
discovery efforts, which will include
retaining and preserving certain electronic
records manually. This can be especially
complicated for data such as instant
messages or information created in an
Enterprise 2.0 environment because the
technology available to export data may be
less sophisticated. A company should first
determine whether it needs to retain and
preserve information under the Federal
Rules of Civil Procedure. Courts appear
to be moving toward requiring companies
to retain more and more types of information,
even transitory information such
as instant messages. See Alexi Oreskovic,
Instant Headache, Law.com (May 20, 2005),
http://www.law.com/jsp/cc/ PubArticleFriendlyCC.
jspid=900005429200 (last visited Jan. 3,
2011).
If subject to preservation, a company
may need to take special steps to preserve
continuously replicated or overwritten data
appropriately.
An organization should also consider
instituting a plan guiding how it will collect
data that it does not control, such as text
messages stored on the servers of a wireless
provider or data in hosted applications
from a software- as- a- service vendor. Even
controlled systems contain unmanageable
information: a company should bring unified
communications systems that combine
messaging, voice, and video into the company
record- keeping process.
In considering cloud options, when a
vendor or another third party will possess a
company’s data, the company should make
sure to incorporate provisions in the contract
with the vendor requiring the vendor
to cooperate with subpoenas for company
information.
Allowing employees
to use public social
networking tools, webbased
technologies,
and microblogging in
the normal course of
business offers tremendous
marketing opportunities.
Conclusion
Despite the pervasiveness of Web 2.0 technologies
and mobile devices in today’s
workplace, a recent survey of management
and human resource executives indicated
that a majority of companies do not
have written social media or acceptable
use policies. Companies with employees
and offices spread throughout the world
especially rely on collaborative platforms
and technologies such as internal social
networks, instant messaging, and cloud
computing—and it is nearly certain that
employees in companies of all sizes and
in every industry use applications outside
of the companies’ internal networks. Failing
to pay attention to or manage the exponentially
burgeoning data resulting from
today’s technologies can create serious
legal risk and expense for all organizations.
Those entities which attorneys counsel to
manage their data strategically and proactively,
however, will undoubtedly reap
the rewards of increased efficiency, greater
potential revenue, enhanced security, and
legal defensibility.
For The Defense ■ February 2012 ■ 29