Chevy Kelly, a partner in the UK-based Social Media Leadership Forum, recently sat down with Socially Aware's own Sue McLean, a Social Media Leadership Forum member, to discuss the legal implications of UK companies' use of social media as part of their marketing strategies.

Chevy Kelly: In your opinion, what are the top three legal risks that organizations in the United Kingdom face when engaging in social media?

Sue McLean: Compliance with relevant advertising and marketing rules is a key priority. All relevant rules, whether it's the CAP Code, unfair trading regulations, FCA promotions rules, are concerned with organizations treating the customer fairly and being transparent. Companies will be experienced with applicable rules in terms of traditional media but, of course, social media brings its own challenges, including space/character limitations and the immediacy element of social media bypassing the time for review and approval protocols built into "old media" usage.

Data protection is also a key challenge. Whether you're collecting personal information from customers via your social media channels, mining data from social media platforms or carrying out Big Data analytics, you need to ensure that you comply with relevant privacy laws. If you're a global business, unfortunately that means a myriad of different laws. It's not just a question of compliance. Showing that you take customers' data seriously will help build trust; it may even help give you a competitive advantage.

Lastly, companies need to continue to focus on social media policies and the education and training of employees. Given the rate of change, companies really need to regularly review their policies and practices. New platforms can trigger new issues, as we have seen with instant messaging, as well as visual, anonymous, self-deleting platforms. Get social media right and employees can be fantastic brand ambassadors; but get it wrong and their activity could result in damage to your reputation and potentially legal or regulatory action.

CK: Are UK lawmakers able to keep up with the rate of change and disruption in the digital era and how are they coping to legislate for every scenario?

SM: No. Given the rate of technological change we have seen over the past decade and are continuing to see (whether it's social media, Big Data, the Internet of Things, drones, etc.), the law is always playing catch-up; it's virtually impossible for the lawmakers to keep up.

Also, it often takes so long to bring in a new law, that by the time it's adopted it may be out of date. By way of example, the long-awaited Data Protection Regulation was proposed back in 2012 to reflect technological changes, including social media—but is still being debated in Europe and, even if it is finalized this year, there will be a transition period of two years before the law applies.

But it's not always a case of bringing in new laws. Often it's about interpreting how existing laws can apply to new platforms. That's certainly the approach the FCA has taken (at least up until now) with respect of the use of social media by financial organizations, the approach that their rules are media neutral and apply to social media in the same way as they apply to traditional media. It's also the approach the government has taken to trolling and other malicious behavior via social media—that the framework of laws we have are fit for purpose in this digital age (even if they were designed in a world before social media, e.g., to apply to poison-pen letters).

And, of course, while laws are inherently national, social media is a global phenomenon. Unless laws are very closely harmonized (which they are not), social media users face uncertainty because of different approaches to law and regulation in the key countries.

CK: Would you say that large organizations are taking the legal risks surrounding social media as seriously as other traditional communications channels?

SM: I'm not sure it's a case of not taking the legal risks of social media seriously. I think it's more a case of organizations being less experienced with social media generally, and that includes legal and compliance departments. If social media is being run out of a marketing/communications team then they will be very experienced with the legal risks of traditional media. But social media triggers new, different types of risk and both the marketing/ communications team and the legal and compliance teams are trying to figure out how to handle those risks.

And, of course, not all social media platforms are the same, and we are getting new platforms all the time. Companies may have become just about comfortable with Facebook and Twitter, but now they have to deal with, say, Pinterest, Instagram, Snapchat. And that's just in the West; if you are a global organization, it's likely that you have to deal with a variety of platforms across the different regions.

Of course, it's not just a question of using social media to promote your business and interact with customers. If you've implemented an enterprise social media platform for your employees, that throws up a whole host of other issues.

CK: If you were to reference an example to give a wake-up call to an organization that may be laid-back in their attitude to social media governance, what would it be?

SM: There are a lot of examples I can point to where companies' social media activity has ended up making headlines for all the wrong reasons. For example, the HMV case where the company didn't take sufficient control of its Twitter account and employees managed to send a series of angry tweets before the company took control. In fact, I expect that a lot of companies still don't put enough focus on social media in the context of insolvency and crisis management. It's not just a question of implementing proper social media governance to avoid legal sanctions. In many cases, it's equally important to avoid the risk of damage to the company's reputation.

CK: Have you found that having an in-depth understanding of the law actually makes organizations more risk averse, or are they more averse when they don't know the boundaries?

SM: A number of companies have taken limited steps into social media because they think that they should be on it, but haven't fully engaged because of a lack of understanding of social media and a fear of the potential legal risks. But legal risks must be weighed up against the damage that may be caused to the business of not properly engaging. If you appreciate what the risks are, you can weigh up those risks against the business benefit, and also the damage that may be caused to your business of not engaging. Whereas, if you don't understand the nature or level of the risks, you could be almost paralyzed into inaction. In most cases, the legal risks are not insurmountable. Companies need to exercise the same common sense, judgment and risk-balancing that they use with other media.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved