Andrew Allison talks about the legality behind Social Media in the workplace and how to manage the legal risks.

1. Managing the Legal Risks:
social media in the workplace

2. If you want to
learn about
risk, give
mining a try

3. …and more
specifically, try
gold mining

4. So what does gold mining have to do with
social media?

5. Translating and applying the mining industry’s
risk management framework
to the office environment

6. International Organization for Standardization
ISO 31000: family of standards “to provide principles
and generic guidelines on risk management”

7. What is risk?
“The effect of uncertainty on objectives,
whether positive or negative”

8. Risk management steps
1. identify 2. assess 3. prioritise 4. treat

9. Risk treatment
1. eliminate 2. mitigate 3. share 4. accept

10. So what is the biggest single source of risk in
the office environment?

11. these guys

12. Vicarious liability
(employer’s general risk)

13. What is
vicarious
liability?
Strict – or “no fault” - liability of an employer for
the conduct of an employee acting in the
course and scope of employment.

14. Bezuidenhout NO
v Eskom 2003

15. Managing the risks posed by
vicarious liability
1. identify 2. assess 3. prioritise 4. treat

16. Treating the risks posed by
vicarious liability
1. eliminate 2. mitigate 3. share 4. accept

17. …and so
what about
social
media?

18. Step 1. Identify
Conduct: use of social media in the workplace

19. Step 2. Assess

20. Defamation
Confidentiality
4 specific
risks
Personal
Information
Intellectual
Property

21. Defamation
Confidentiality
1st risk
Personal
Information
Intellectual
Property

22. Defamation
“the intentional and wrongful publication of words or
behaviour to a third party which has the effect
(objectively viewed) of injuring or undermining a
person’s or entity’s good name, status or reputation”

23. Defamation
The internet has increased the scope of and risk
associated with defamation
There are now more ways in which publication may
occur

24. Remember
Defamation includes the repeating,
confirmation or proliferation of defamatory
content…
…so beware of republishing, email forwarding,
linking and retweeting.

25. …and, of
course,
vicarious
liability

26. Defamation
eliminate > mitigate > share > accept

27. Eliminate
> Lock employees out of social media sites
> Limit access for work purposes only

28. Mitigate
> Training
> Internet usage and email policies
> Communications and brand guidelines
> Management pre-approval of publications

29. Share
> Disclaimers on digital properties
> Website terms and conditions
> Insurance

30. Accept
Hope for the best and deal with it if it happens

31. “psychotic, lying,
whoring, still-going-
to-clubs-at-her-age
skank”
This guy shot JFK

32. Defamation
Confidentiality
2nd risk
Personal
Information
Intellectual
Property

33. Pretty much all well-drafted commercial
agreements these days contain
confidentiality – or non-disclosure –
provisions of some sort or another.

34. …once again,
vicarious
liability

35. Confidentiality
eliminate > mitigate > share > accept

36. Eliminate
> Do not accept confidential material
> Only accept what is strictly necessary

37. Mitigate
> Training
> Employment agreements and policies
> Secure networks and robust IT infrastructure

38. Share
> Well considered NDAs
> Insurance

39. Accept
Hope for the best and deal with it if it happens

41. Defamation
Confidentiality
3rd risk
Personal
Information
Intellectual
Property

42. The right to privacy is protected by the
Constitution
However, there is currently no umbrella law
governing privacy of personal information in
South Africa

43. Chapter 8 of ECTA contains a data protection
“Code of Good Practice”, but compliance is
voluntary.
If adopted, the principles should be included in
website privacy policy and consequences of
breach should be clearly stipulated.

44. Enter the Protection of Personal
Information Bill (POPIA)

45. POPI
the intention
> To give effect to the Constitutional right to privacy
> To regulate the collection/processing of personal information
> To provide individuals with rights and remedies
> to establish an Information Protection Commission

46. POPI
Section 10
Personal information may only be processed:
> with the data subject’s consent
> if processing is necessary for completion of a contract
> if it protects a legitimate interest of the data subject
> if in compliance with an obligation imposed by law
> if in pursuance of the legitimate interests of the processor

47. Direct Marketing
Opt-in versus opt-out

48. Direct
marketing
Opt out
ECTA (section 45) and the CPA (section 11) both require
direct marketers to provide recipients with an option to “opt
out”
The CPA envisages an “opt out” registry (like that of the
DMMA), but this has not yet been implemented.

49. Direct
marketing
Opt in
POPI, however, will implement an “opt in” framework,
mirroring the approach being adopted in Europe.

50. Direct
marketing
Opt in
Direct marketing is prohibited except:
> with specific consent of the data subject
> to customers, where:
> the processor has obtained personal information in the context of a
sale
> for marketing of processor’s similar products/services
> if data subject has been given opportunity to object or opt out (free
of charge)

51. Direct
marketing
Soft opt in
In the UK, the implied “opt in” is known as a “soft opt in”.
It applies also in the context of negotiations leading up to a
sale.

52. …you know the
score by now

53. Personal Information
eliminate > mitigate > share > accept

54. Eliminate
> Do not collect/process personal information
> Only collect what is strictly necessary

55. Mitigate
> Training
> Internal policies and guidelines
> IT and online security
> Compliance with ECTA, CPA and POPIA
> Regular audits

56. Share
> Detailed commercial agreements
> Website terms and conditions
> Insurance

57. Accept
Hope for the best and deal with it if it happens

58. Defamation
Confidentiality
4th risk
Personal
Information
Intellectual
Property

59. What is IP?
“A work or invention that is the result of
creativity, such as a manuscript or a design,
to which one has rights and for which one may
apply for a patent, copyright, trademark, etc.”

60. Intellectual Property
Copyright
Trademark
Patent

61. COPYRIGHT

62. What is
copyright?
“A proprietary right which arises automatically
when an author reduces an idea to a material
form.”

63. What is
copyright?
No requirement for registration (in SA)
Copyright can be:
> assigned (must be in writing and signed)
> licenced

64. Breach of
copyright
Breach or infringement of copyright may be:
> direct (guilty knowledge is not a pre-requisite)
> secondary/indirect (unauthorised dealing)
> contributory (facilitation of infringement)

65. Important!
Copyright in work produced by employee in the
course of employment vests with employer
Online properties often comprise of many different
copyrighted assets

66. TRADEMARKS

67. What is a
trademark?
A mark which distinguishes a person’s goods
or services (requirement of distinctiveness)
Must be registered with CIPC and renewed
every 10 years

68. Breach of
TM
Infringer’s mark is confusingly similar in respect of the same
goods/services (reasonable likelihood of confusion)
Infringer’s mark is identical or similar to a registered mark in
respect of similar goods or services

69. Breach of
TM
Dilution of trade mark:
> by blurring (dilution of uniqueness; may be different or non-
competing goods/services)
> by tarnishment (negative/offensive use of TM)

70. Meta tags
and PPC
A common sense approach should be employed (certain bona
fide uses protected under Trade Marks Act)
> purely descriptive purposes (advertising products on an e-
commerce site) would generally be ok
> use of a competitor’s marks to deceive or lure consumers
would generally not be ok

72. In depth – trademark
This is
Terri Welles

73. Intellectual Property
eliminate > mitigate > share > accept

74. Who owns
your twitter
account?

75. …or who is
using it??

76. Eliminate
> Use only proprietary material
> Limit access to the internet / social media

77. Mitigate
> Training
> Internal policies and guidelines
> Provide access to stock content providers
> Regular audits and management sign-off

78. Share
> Detailed commercial agreements
> Limit liability for 3rd party IP infringements
> Insurance

79. Accept
Hope for the best and deal with it if it happens

80. …back to
mining

81. Risk management steps
1. identify 2. assess 3. prioritise 4. treat

82. Risk treatment
1. eliminate 2. mitigate 3. share 4. accept

83. the end