Social media is here to stay. Whether Centennials entering the workforce or Baby Boomers, chances are your employees use some form of social media. Tweeting and posting by employees might reveal too much information about an employer's business, resulting in a breach of confidentiality or in some circumstances the privacy of other employees or even clients. When does social media talk by an employee go too far, and what can you as an employer do to ensure that employees' personal posts do not taint the organisation? Do you as an employer even have the right to monitor employees' personal social media accounts?

The answer is not straight forward. Obviously on one hand, employees have a right and an expectation to privacy. On the other hand, in certain situations, or in certain industries, monitoring may be necessary. Take for example, employees in the banking and finance industry who use their personal social media accounts for business purposes. Employers may have a duty under the Securities and Futures Commission's licensing code of conduct to supervise business related activities. In this situation, the monitoring of personal media may be justified.

What about in circumstances where flight crew are flying ultra-high net worth individuals around the globe? Posting photos of themselves in various countries in real time (or worse, with a visual aircraft registration number) could pose a risk to the safety of those on board. In this situation, an employer may have a well-founded reason for monitoring its employees' social media accounts. Whether monitoring is reasonable will be decided, in the absence of legislation in Hong Kong relating directly to social media, with reference to the Personal Data Privacy Ordinance (the Ordinance), in situations where the monitoring results in the collection of personal data. Once triggered, the Ordinance mandates the way in which an employer may collect, use and store personal data of employees, as well as the rights that employees have in relation to the collected data.

Any monitoring of social media by an employer should be well thought out and communicated to employees (unless under certain circumstances). Employers should have a robust social media policy that clearly sets out what is acceptable and what is unacceptable to post on social media, both during working hours and outside of them. It should remind employees that they are responsible for what they post, and that they represent their employers even when they are not working. It should stress the importance of keeping confidential information confidential, and that employees should refrain from posting anything online that could be perceived as threatening, intimidating, harassing, discriminatory, or unlawful. It should remind employees that even when they are away on a work trip, regardless of whether they are on duty, they are representing their employer (for example flight crew who may be on layovers in other countries). The policy should also set out clearly the consequences of any breach, including any disciplinary action that might be taken. Obviously, it should state that social media monitoring may occur.

Social media monitoring should be reasonable under the circumstances, and policies drafted in such a way so as to not go beyond what is reasonable to protect the employer's legitimate business interests. Under the monitoring guidelines issued by the Privacy Commissioner, before deciding on whether monitoring of employees is appropriate, employers should consider the 3A's – Assessment, Alternatives and Accountability. Firstly, employers should assess the risks that employee monitoring seeks to manage, and the benefits that may be derived from the monitoring. Then employers should consider whether there are any alternatives to employee monitoring that may be equally cost effective and practical, yet less intrusive to those having their personal data collected. Finally, accountability: It is the responsibility of employers to implement privacy compliant data management practices when handling personal data obtained from employee monitoring.

Of course, employers should be cautious of relying on what they find on an employee's social media account to take disciplinary action. Not all accounts are legitimate, and hacking does sometimes occur. Some platforms will allow other users to "tag" others without their knowledge or permission (although privacy settings can often be set to avoid this). Information may be unreliable. The importance of fact checking should not be overlooked before disciplinary action is taken.

A properly drafted and implemented social media policy will not only spell out to employees what they can expect during their employment in relation to monitoring, but it could also guard employers against potential reputational damage and even liability for the actions of employees. But to ensure its effectiveness, just like any other policy, employees must be made aware of it and understand it, meaning the policy should be easily available to employees, and regular training of employees should be carried out.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.