Jack Halprin, Esq., VP eDiscovery and Compliance, Autonomy, Inc.

Corporate counsel are beginning to deal with the challenge of managing interactions with social media sites (SMS) as these human-friendly means of communications are electronically stored information (ESI) that must be managed. Though not new, the rapid adoption of SMS as a means of communication and business development has made it essential that counsel be aware of both the benefits and challenges. Counsel must not only understand why SMS are important, but they must also work with their colleagues across the organization to ensure proper management.

1. Understand the Scope of Interactions.

SMS use and content is growing rapidly, has already surpassed personal email use, and is expected to soon pass business email use. Research analyst Gartner predicts that social networking is set to overtake email in some corporate settings by 2014. See “Social Networking Slowly Taking Over Email,” “Gartner’s Prediction on Email and Social Networking Disappointing,” and “Social Networking Usage (Facebook…) Surpassing Email.”

To understand the volume, consider the following statistics:

Facebook   
More than 500 million users, translated into 70 languages in more than 180 countries. 150 million active users access the site through mobile devices.

Twitter 
More than 190 million visitors each month, generating more than 90+ million tweets every day. 

LinkedIn   
More than 70 million members in more than 200 countries, including executives from all Fortune 500 companies. 

MySpace 
More than 122 million monthly active users in 29 regions and 15 languages. 

YouTube 
More than two billion videos viewed every day.

2. Account for Multiple Access Points.

Social media is difficult to manage not only due to volume and scope but also because interactions occur through a variety of channels which may not be part of current corporate communications channels. Any SMS policy or preservation effort must account for the different access points:

Inside-Out: Employees within the corporate network accessing social media sites from controlled devices.

Moderated: A corporate sponsored website or page hosted by third-party application (e.g., corporate Facebook page).

Outside-External: Interaction with social media outside of direct corporate control (e.g., posting through uncontrolled devices).

3. SMS are Essential to Business.

Corporations are using SMS to drive business, communicate with customers, and provide customer support and service. Rapid adoption of SMS is the rule, not the exception. Counsel must be prepared to provide guidance to the business as part of an overall risk management strategy.

4. SMS Can be Discoverable.

Under the US Federal Rules of Civil Procedure (FRCP), the UK Civil Procedure Rules, and Canadian civil procedure rules, SMS data is ESI that can be discoverable if relevant. Though most organizations do not yet include SMS in their eDiscovery and information governance strategies, Counsel should be aware of the need for managing and preserving relevant SMS data. See Rule 34(a)(1)(A) (http://www.uscourts.gov/uscourts/RulesAndPolicies/rules/CV2009.pdf).

SMS case law is rapidly evolving and counsel should keep up to date on the ever-changing landscape. Some of the more recent and often cited cases include:

•  Crispin v Christian Audigier, Inc., 2010 WL 2293238 (C.D. Cal., May 26, 2010). The court found the Stored Communications Act (SCA) prevented the third-party subpoenas, but noted the distinction between private messages and more public posts for which the SCA was inapplicable. The court notes that SMS data can be obtained directly from parties to the action. 

•  Romano v. Steelcase, Inc., 2010 WL 3703242 (N.Y. Sup., Sept. 21, 2010). The court found SMS data was “material and necessary to the defense” and could include deleted pages, noting that “privacy is no longer grounded in reasonable expectations, but rather in some theoretical protocol better known as wishful thinking.”

•  Leduc v. Roman (2009 Can LII 6838 (ON S.C.). The Canadian Court held SMS data discoverable but drew a distinction between public and private data. On the privacy issue, however, the court noted that the plaintiff could not have “a serious expectation of privacy [when] 366 people have been granted access to the private site.”

5. Ignorance of the Law is Not a Valid Defense and Ignoring the Law is Not an Excuse.

In addition to the preservation obligation, counsel must also ensure regulatory compliance. As regulators recognize the influence and risks associated with SMS, some are beginning to require active monitoring and governance of social media interactions. For instance, FINRA (the Financial Industry Regulation Authority) Regulatory Notice 10-06, issued in January 2010, requires member firms to monitor and maintain records on social media site usage and interactions. Additionally, the Food and Drug Administration (FDA), Federal Trade Commission (FTC) and National Futures Association (NFA) are developing rules or guidelines for SMS use, and the Federal Courts and state bar associations are issuing guidelines or opinions on usage. The compliance challenge will depend on both the industry and business unit.

6. Preserve and Manage Your Data.

Corporate counsel can block SMS use, punt and ignore it, or proactively manage it. Blocking and punting will open the organization to unnecessary risk and are generally neither defensible nor best-practices. Proactively addressing corporate use of SMS is the best approach and guidelines should be developed. The courts and regulators have made it clear that they expect all ESI to be managed properly, and it is essential that counsel be prepared with processes and, where necessary, solutions. See Pension Committee v. Banc of America Securities (2010 US Dist. Lexis 4546 [SDNY, Jan. 15, 2010]), Rimkus v. Cammarata (2010 US Dist. Lexis 14573 [SD Tex., Feb. 19, 2010]) and Victor Stanley, Inc. v. Creative Pipe, Inc. (No. MJG-06-2662 [September 2010]).

7. Manage SMS and Rich Media as Part of an Information Governance Policy.

While most organizations have policies and procedures for discovery and information governance, many were designed before the rapid rise of SMS use. Counsel should actively re-examine current governance, discovery, and compliance policies and update them as needed to account SMS usage. Any policy should highlight:

•  Acceptable and unacceptable use criteria
•  An overview of which departments and/or personnel are entitled to use SMS on behalf of the organization
•  Training or policies for authorized corporate spokespeople
•  Guidelines on acceptable association and/or attribution to the corporation

8. Privacy and Globalization: One Size Does Not Fit All.

Global organizations face additional challenges due to the myriad of privacy and data protection regulations. Counsel need to understand the different global regulations and how they affect monitoring SMS and other data sources. The rapidly evolving case law and privacy regulations make this challenging, and while the trend in the US and Canada has been toward a lower expectation of privacy for SMS users, the UK, EU and APAC regions offer limited guidance. Counsel for multi-national organizations need to ensure the policy is defensible and may need different policies for different jurisdictions.

9. Develop a Team to Manage Information Sources.

Management of social media cannot occur in a vacuum and a team approach is required for success. A cross-functional team should be created to ensure proper management, including legal, IT, information security, privacy, records and compliance as well as marketing, sales and public relations.

10. Enforce and Monitor Compliance Policies, Using Technology to Proactively and Defensibly Manage the Process.

The task of managing SMS data is not insurmountable, and developing the right policies will help ensure that your organization meets its discovery, compliance and governance needs.

In addition to defensible processes, counsel should also consider the advantage of using technology. The volume and breadth of SMS data makes a manual approach virtually impossible. Automation and the use of advanced search technology can assist counsel in enforcing governance and regulatory policies and meeting the preservation obligation. Solutions should be able to deal with the slang, abbreviations, and code words present in SMS data, with the ability to understand meaning, concepts, and context in both a language- and format-independent manner. Such an approach will overcome the shortcomings of keyword search and other legacy methods and provide counsel with a defensible platform on which to build their discovery and compliance policies. See George L. Paul and J.R. Baron, “Information Inflation: Can The Legal System Cope?” pages 22-24, Richmond Journal of Law and Technology (2006), and
Asarco, Inc v. United States Environmental Protection Agency (2009 WL 1138830 [DDC, April 28, 2009]), holding that “keyword searches are no longer the favored methodology.”