By Shelley Garside, CHRP

Technology has woven itself through everyone’s life both personally and professionally.  We can find information about almost every subject we could ever dream of with the click of a button.  We can also find out all kinds of information regarding people.  Social media has made sharing and retrieving of information even more expansive and, frankly, a lot more personal.  So, when a potential employment candidate’s resume is brought to our attention the temptation is to do a little searching.  This is the human resources practitioner’s job, right?  Well, not so fast.

The office of the Information and Privacy Commissioner of British Columbia has released its new guidelines regarding social media background checks for employees, volunteers and candidates.  The document provides guidance for both private and public bodies. In its news release, Commissioner Elizabeth Denham cautions that organizations that use social media for background checks can find themselves facing “legal and other challenges”

The report goes on to remind us that when organizations and public bodies search for information about an individual, the collection, use, and disclosure of that personal information is subject to the privacy provisions of BC’s  Freedom of Information and Protection of Privacy Act  (for public bodies), or Personal Information Protection Act  (for organizations).

The laws apply whether the individual is applying for paid or unpaid employment, a volunteer position, or if they are applying to run as a candidate in an election.

The seven-page document is designed to give organizations and public bodies practical tools and guidelines to follow when conducting background checks.  Examples of some of the risks when using social media in background checks are collecting inaccurate information, collecting too much information, or collecting information that is not relevant.

Additional Highlights
The document includes these tips for consideration when completing social media background checks:

1. Recognize that any information collected about individuals is personal information or personal employee information and is subject  to privacy laws, whether or not the information is publicly available online or whether it is online but subject to limited access as a result of privacy settings or other restrictions;

2. Conduct a privacy impact assessment including an assessment of the risks associated with your use of social media as a component of background checks. When conducting this assessment, public bodies and organizations should:

• Find out what privacy law applies and review it, ensuring that there is authority to collect and use personal information;
• Identify the purposes for using social media to collect personal information;
• Determine whether the identified purposes for the collection and use of  personal information are authorized;
• Consider and assess other, less intrusive, measures that meet the same purposes;
• Identify the types and amounts of personal information likely to be collected in the course of a social  media background check including collateral personal information about other people that may be inadvertently collected as a result of the social media background check;
• Identify the risks associated with the collection and use of this personal information including risks resulting from actions taken based on inaccurate information;
• Ensure that the appropriate policies, procedures and controls are in place to address the risks related to the collection, use, disclosure, retention, accuracy and protection of personal information.
• If the collection is authorized, notify the individual that you will be performing a social media background check and tell them what you will be checking and what the legal authority is for collecting it;
• Be prepared to provide access to the information you collected and used to make a decision about an employee or volunteer.

Things to Avoid:

1. Wait until after conducting a social media background check to evaluate compliance with privacy legislation.

2. Assume in advance that a social media background check will only retrieve information about one individual and not about multiple individuals.

3. Perform a social media background check from a personal account in an attempt to avoid privacy laws.

4. Attempt to avoid privacy obligations by contracting a third party to carry out background checks.

5. Perform a social media background check under the assumption that individuals will never be able to find out about it. For example, an individual could use web analytics to try to determine what IP address accessed their personal information.

There are many risks associated with the collection and use of personal information regardless of its ease of collection and availability. It is the responsibility of organizations and public bodies to review the guidelines and ensure that they are complying with privacy requirements regarding the use of social media.

The document can be found at www.oipc.bc.ca under “What’s New” or contact Maria Dupuis, communications and research officer at 250.953.4191.

Shelley Garside, CHRP, is the owner of Garside Consulting based on Vancouver Island.  Garside Consulting offers a wide range of human resources expertise and services to businesses and organizations.  Shelley can be reached at 250.333.8585 or 250.616.6570 (cell) or  by email at shelley@garside.ca.