Future Proof – Protecting our digital future

Here are some of the questions we get asked about government use of social media:

• what is the legal status of information in social systems?
• does the State Records Act apply to social media?
• does defamation law apply to social media?
• how does the Privacy and Personal Information Protection Act apply to social media?
• how do I know if I need a social media information management strategy?
• what are the business benefits of developing a social media information management strategy?

What is the legal status of information in social systems?

Social systems, even if they are third party hosted systems like Twitter and Facebook or internal communication tools like Yammer, are government business systems when they are used by a government entity for business purposes.

They are therefore subject to all standard legislative requirements, including defamation, criminal and other legal requirements.

Information-related legislation such as the State Records Act, Privacy Act, Government Information Public Access Act and the Copyright Act all also apply to socially generated information. Social systems are also subject to discovery provisions, like any other business application.

The fact that social tools are often used to have informal conversations does not stop legislative requirements from applying to them.

Current experience is showing that very broad notions of business purposes are being applied to new technologies. For example, personal mobile devices are frequently subpoenaed or subject to discovery orders if those devices have also been used for business communications. Therefore the fact that social tools host informal chat as well business specific conversations do not prevent social systems from being subject to the standard range of legislative requirements affecting any business environment.

Proactive information management strategies for social systems, particularly those supporting high risk business processes, can therefore help in the management of any legal issues that arise.

Does the State Records Act apply to social media?

Yes, social media information is a record under the definitions of the State Records Act.

This does not mean that all social media information must be captured and managed as an official record but it does mean that some high risk and key business value social media information will need to be managed and kept for appropriate periods of time.

Does defamation law apply to social media?

In Australia, the Federal Court has held that a party could be liable as a publisher for defamatory comments posted by members of the public on corporate social media accounts.

This raises information management issues for government organisations running social media sites where people have the ability to post comments.

The advice, Online defamation: what you need to know (May 2013) says it is important to have appropriate policies in place regarding the management of sites, to monitor these sites and any comments posted, to remove posts that are offensive or potentially defamatory, and to appropriately document the action taken by your organisation in case the issue escalates.

The incident should be documented, the post deleted and appropriate senior management and legal staff informed in case the issue escalates.

How does the Privacy and Personal Information Protection (PPIP) Act apply to social media?

The PPIP Act requires you to be upfront about what you are doing with personal information.

Social media communications are in the public domain. Care must be taken to not use social media applications in ways that collect or disclose personal information. Privacy protection and management therefore needs to be proactively considered and designed into social strategies.

Example: Educate staff not to obtain or disclose personal information via social media

The University of Sydney’s Privacy Management Plan says:

Use of social media such as Facebook or Twitter is limited to providing information to students on a broadcast basis, as for any other website presence.

Social media must not be used for responding to any current or prospective student’s question where the response would include personal information or would be giving specific advice regarding candidature.

Example: Tell your clients that you will not obtain personal information through social media. The Commonwealth Department of Human Services says:

We will never ask you for personal information through social media. If we need personal information to answer your question or help you, we will ask you to use a more private channel, such as Express Plus apps, Online Services, by calling us, or visiting your nearest service centre.

To manage privacy, you also need to be very clear about how you will be using any personal information provided via social channels, and this includes capturing information and making records of social media activities.

Example: Tell people how their feedback will be used

The NSW Government’s Have Your Say site includes advice in its Privacy statement (as at February 2014) that tells people how the feedback they provide will be used:

The Department of Premier and Cabinet provides feedback facilities on this site to allow users to provide input into the future development of the site and to comment on the provision of service by the Department.

Users provide personal details for the purpose of receiving a reply to their feedback. This information will only be used for the purpose for which it was provided. We will not add your email address or name to any mailing list.

The Department of Premier and Cabinet may publish aggregated information about feedback on the site, to the extent that it does not identify or cannot be used to identify individual users.

Example: Tell people about your intended official uses of their information

As reported in New Zealand Government Controller and Auditor-General’s Learning from public entities’ use of social media (June 2013), the Law Commission in New Zealand actively consulted on its New Media Review through social channels. It made clear that content submitted through social media would be treated officially.

Its terms of participation stated that comments made through social channels would be treated as official submissions, could be used by the Law Commission and could form part of any final report.

Example: Tell people if you are going to be capturing information about your social media operations

This organisation notes that some publicly available personal information posted to this organisation’s blogs may be captured and kept as a record in this organisation’s internal business systems.

This organisation only captures and keeps the information it needs to support its business operations and any publicly available personal information that it captures, such as personally identified comments, responses and questions posted to its blogs, will be managed in accordance with the Privacy Act 1998.

To mitigate any potential privacy risks, consider strategies like:

• providing clear guidance to people, advising them not to provide personal information via social media accounts and advising them of any official uses of the information they may provide
• moderating comments before they are officially published
• monitoring any complaints received via social media and ensuring that if people share their personal information or the personal information of other people, this information can be removed from the public arena and passed through other more appropriate channels
• advising people to contact you through alternative channels if they have personal issues they do not want to raise in a public forum.

How do I know if I need a social media information management strategy?

This depends completely on the specific business needs your social media strategy is supporting.

The following questions help to identify the type of business your social media engagement is supporting.

• Is high risk or strategic business in your organisation being performed in social channels?

• Are corporate decisions being made or communicated through social channels?

• Is significant advice communicated to clients through social channels?

• Will your organisation have long term needs for the information generated through social channels?

• Will members of the community base decisions or actions on the advice you are providing through social channels?

• Will business reporting and/or planning and assessment rely on information contained in social systems?

• Will business areas want to reuse content from social systems?

• Does business information generated through social need to be shared through the organisation to inform decision making?

If you answered yes to any of these questions, it is likely that you will need an information management strategy to support your social media operations.

What are the business benefits of developing a social media information management strategy?

In many organisations there is no coordinated, overarching strategy for social media use. Social media technologies are adopted by different business areas without reference to corporate policies or strategies and without considering the information management requirements for the business they are performing.

This approach can lead to information loss or process duplication, as a lack of corporately available information means staff reproduce effort or operate without all information available to them. It can also mean that important, long term value business information can easily disappear.

It is therefore important to identify all uses of social media technologies across your organisation and to develop an information management strategy that encompasses all areas of your social media operations that are supporting with high risk/high value business operations.

A social media information strategy will enable you to:

• comprehensively identify what business processes are moving to social media
• determine what information generated via social media is needed to support these business processes
• identify the legal and business information use and retention requirements that apply to your social media operations
• identify the client needs, expectations and public accountabilities that apply to your social media operations
• identify the business areas in your organisation that need to access, reference, respond to, use or reuse the information generated via your social media channels
• identify and manage the social information that your organisation needs long term access to
• identify appropriate management strategies for high risk, high value business information
• identify the business records that can stay in their native social media applications

Assessing and understanding each of these will help you to determine how your organisation’s social media information can best be managed to meet your specific business needs.

It is important to keep a watching brief on your social media systems and consequently your social media strategy. These systems are very dynamic and how your organisation uses them can change quite rapidly. These changes can be driven by the community who might start to use your systems in different ways or they can be driven by staff who want to maximise the potential of social media.

If use of your social media systems start to change, you need to look at your current social media information management strategies and determine whether these also need to change.

Things to look out for include:

• Are members of the community starting to ask specific questions about policy or services on social media?
• Are you receiving compliments or complaints via social media?
• Are staff members providing advice about new policies or programs via social media?

If these changes start occurring then your organisation’s information needs might change too. This is because you may now need the information from your social media system:

• as input into policy or program development
• as evidence of how a question or complaint was handled
• to give to business areas as part of workflow processes
• to enable effective client management.

Next: More frequently asked questions