By Stephen Antle, Charmane Sing, Brandon Hillis and Michael Damiani

Social media sites can be a useful tool for employers to screen prospective job candidates.  With over one billion active Facebook profiles and 500 million Twitter users, employers are just a few clicks away from copious amounts of readily accessible personal information.  Nevertheless, employers must be aware that these “social media background checks” are subject to privacy laws which place restrictions on the collection, use and disclosure of personal information.  They should also be aware of the risks of using this information.

Social media sites, an ever growing online presence, can take the form of blogs, social networking sites, file and photo sharing sites, or wikis.  Social media background checks can range from simply browsing a job candidate’s Facebook or Twitter profile to demanding social media passwords (a growing issue in the United States) to hiring a company to gather all available online information on a person, sometimes under the pretext of having a social relationship with them.

Today, as soon as an employer receives a job candidate’s name, it is ‘Googled’ and, within a few seconds, an employer can review the candidate’s online profiles.  Privacy issues may arise if, during the screening process, information is flagged which may affect the candidate’s hiring prospects.  These issues are often difficult to recognize.  The candidate may not know these checks are occurring.  The prospective employer may feel they are just casual, and free from the constraints of more formal background checks.  However, just because someone posts messages or displays information about themselves online does not mean an employer has any right to access or use that information.

PIPA and Disclosure

The B.C. Personal Information Protection Act (“PIPA”) governs the collection, use and disclosure of personal information by organizations in the private sector.  Personal information is broadly defined as information that can identify a person (for example name, home address, home phone number, SIN number) or about identifiable individual attributes (educational qualifications, job experience).

Generally speaking, PIPA requires private sector organizations to obtain a person’s consent before collecting, using or disclosing their personal information.  However, consistent with its stated purpose of balancing people’s right to protect their personal information against the needs of organizations to collect, use or disclose personal information in appropriate circumstances, PIPA sets out a variety of exceptions to that requirement.

‘Reasonable’ Exceptions in Employment Context

One such exception is in the employment context, where PIPA permits organizations to collect, use or disclose personal information without a person’s consent—provided that is reasonably required for the establishment, management or termination of an employment relationship, and as long as notice is given to the person.  In the context of a social media background check, the key requirement – and challenge – is that the information must be collected, used or disclosed for “purposes that a reasonable person would consider appropriate in the circumstances,” the circumstances being the establishment of the employment relationship.

While what is reasonable depends on a case-by-case assessment of the facts, in most situations it is unlikely that personal information obtained from a person’s social media website would be reasonably required for establishing an employment relationship.  It is difficult to see how Facebook pictures from a birthday party or trip to Mexico, or tweets about the Vancouver Canucks’ goaltending controversy, could be relevant to hiring decisions.

While there are few cases where the B.C. Office of the Information and Privacy Commissioner has taken issue with social media background checks, the current commissioner is alive to the issue.  In 2010, when Elizabeth Denham was assistant privacy commissioner under the federal privacy legislation she noted that:

While we haven’t yet investigated a complaint involving surreptitious social networking background checks, my feeling is that [the legislation] would prevent this kind of collection of personal information.

Since Ms. Denham became the B.C. Commissioner, her office has released Guidelines for Social Media Background Checks.

Politics of Social Media Emerge

In 2011 the Commissioner launched a high-profile investigation into the B.C. NDP’s privacy and social media practices, after it came to light that the party had been requiring potential leadership candidates to provide their social media account passwords.  The investigation was completed in October 2011, with the Commissioner finding that:
The BC NDP collected a large amount of personal information, including information that may be outdated, irrelevant or inaccurate [as well as] personal information from third parties that it did not have consent to collect.  There were…reasonable alternatives that could have been used to meet the purposes of vetting candidates.  These factors all weighed against the collecting being considered to be what a reasonable person would consider appropriate in the circumstances.

Recruiter Be Wary

There are other risks associated with social media background checks, several of which were the subject of the Commissioner’s investigation into the B.C. NDP and all of which should be at the forefront of an employer’s mind before conducting any online searches on prospective employees:

• Accuracy of Information
• Ease of labelling and linking online information leads to inaccuracies.
• Common names may result in the employer viewing an unintended profile.
• Out-of-date information – social media sites tend to keep information accessible indefinitely.
• Collecting Irrelevant/Excess Information
• Background checks may catch more information than intended, including irrelevant personal information.

Over-reliance on Consent

Even when people have consented to background searches, privacy laws usually allow them to withdraw their consent at any time

It is important for employers to recognize that all personal information collected during a background search is subject to privacy laws, whether or not it is available online.  Employers should also understand that they are collecting personal information as soon as it is viewed on their computer screens, regardless of whether it is later saved.  Once collected, the information may be difficult to disregard and, if a job candidate suspects their personal information was improperly collected, they may complain to the Office of the Information and Privacy Commissioner.

…Or Pay the PIPA

In terms of enforcement, improperly accessing, using or disclosing such information constitutes an offence under PIPA and can result in fines of up to $10,000 for individuals and $100,000 for organizations.  Furthermore, if the Commissioner makes an order against an organization, or it has been convicted of an offence under PIPA, a person can sue the organization for damages for any actual harm they have suffered as a result of the organization’s breach of PIPA.  In addition the Commissioner has the power to initiate audits and investigations where there are reasonable grounds to believe an organization is not complying with PIPA.

Stephen Antle, Charmane Sing, Brandon Hillis and Michael Damiani work with Borden Ladner Gervais LLP (BLG)—a full-service, national law firm focusing on business law, commercial litigation and intellectual property.
(PeopleTalk Spring 2013)