how to use social media while maintaining best corporate ... · questions. some awareness, but not...

The Canadian Society of Corporate Secretaries16th Annual Corporate Governance ConferenceBanff Springs Hotel | Banff, AB | August 24 - 27, 2014

How to Use Social Media While Maintaining Best Corporate Governance and Compliant Practices

Liane FongDexter John

Joann Sochor


1Aug. 26, 2014 How to Use Social Media While Maintaining Best Corporate Governance and Compliant Practices


Topics – Social Media

• Introduction – Why focus on social media?

• Social Media 101

• What can directors learn from social media?

• What do directors using social media need to know?

• How can directors evaluate their companies’ use of social media?

• What regulations apply to commercial use of social media? What are some mitigating controls?



First, a little quiz…

How would you rate your level of knowledge about social media with regard to business practices?

Very knowledgeable and can easily discuss the topic and ask probing questions.

Some awareness, but not a strong grasp on the topic, especially at the level needed for board oversight

Minimal knowledge, get lost in discussion about the topic and can’t really ask probing questions about it

Don’t really understand it at all




How would your board rate its level of knowledge about social media with regard to its company’s practices?





Results from Korn/Ferry International’s 2013 survey:The Impact of Social Media on Boards and Directors Today




How would your board rate its level of knowledge about social media with regard to its company’s practices?





27% 55% 16% 2%





Does your board think it has an adequate oversight of the risks and opportunities related to social media?

Yes No Don’t know





Does your board think it has an adequate oversight of the risks and opportunities related to social media?

Yes No Don’t know


33% 45% 22%



Introduction – Why focus on social media?Director Survey: Gap between Knowledge and Need

Korn/Ferry International Survey: The Impact of Social Media on Boards and Directors Today*

Aug. 26, 2014 How to Use Social Media While Maintaining Best Corporate Governance and Compliant Practices 8

Will social media have a significant impact on boards within 3-5 years?

Do you feel you can provide meaningful oversight of social media?

Does social media have an impact on business?• 52% say social media is an important tool that can provide many opportunities• 55% say it is a risk, but potential benefits outweigh risks• 3% say it is a risk not worth taking

Do directors feel they have adequate oversight of social media?• 88% of directors want greater exposure to senior management responsible for policies and activities related to social

media and see this is an important step towards their own personal understanding of the issue.• 33% of directors think their boards have adequate oversight of the risks and opportunities related to social media• 45% think their boards do not have adequate social media oversight; • 22% are unsure

Respondents assessment of their board’s approach to social media• 26% mostly proactive and consider risks and opportunities presented by social media• 40% mostly reactive and they deal with repercussions from what is disseminated on social media, both negative and

positive• 25% appropriately proactive and reactive in social media.

Yes25%

No75%

Significant Importance

74%

No significant importance

26%

*171 directors were surveyed in 2013


Introduction – Why focus on social media?Director Survey: Board Information and Guidelines

2012 Survey by The Conference Board and the Rock Center for Corporate Governance at Stanford University


Do you have a committee on your board of directors that has oversight of social media monitoring efforts?

Does the board receive reports containing summary information derived from social media sources?

If yes, how useful is this information?

Does your company have formal social media guidelines or policies for board members?

Yes7%

No91%

Don't know3%

Yes8%

No86%

Don't know7%

Very Useful, 29%

Moderately Useful71%

Not Useful0%

Yes15%

No75%

Don't know 10%


Social Media 101 – The basics


Used courtesy of John Atkinson http://wronghands1.wordpress.com/


Social Media 101 – User demographics

• In case you have been hibernating for the last 10 years, social media is BIG!

• MacLeans study April 2013:

– 70% Canadians use social media

– 63% read Facebook posts, Tweets or LinkedIn updates every day

• The average Canadian spends 7.7 hours on social media/month (US is 7.6)

– (Source: Browser Media, Socialnomics, MacWorld)

• and many more emergent (Pinterest) and regional (Weibo) social media platforms…



Social Media 101 – Key platforms*

Micro-blogging social site (140 character limit)

255 MILLION active users

26% of users are in North Americastatista.com/statistics/303684/regional‐twitter‐user‐distribution (June 19, 2014)

Social networking and sharing site

More than 1 BILLION active users

680 million mobile usersStatisticbrain.com/facebook‐statistics (June 19, 2014)

Business-focused social networking site

Worlds largest professional network 300 Million usersPress.linkedin.com/about (June 19, 2014)

9 Million+ users in CanadaPress.linkedin.com/about (June 19, 2014)


* Leveragenewagemedia.com (April 25, 2014)


Social Media 101 – Key platforms*

500 MILLION tweets sent per day About.twitter.com/company (June 19, 2014)

55% over the age of 35About.twitter.com/company (June 19, 2014)

Approximately 1 MILLION links shared every 20 minutes. Statisticbrain.com/facebook‐statistics (June 19, 2014)

7 million integrated websites and appsStatisticbrain.com/facebook‐statistics (June 19, 2014)

79% of users are 35 or olderLeveragenewagemedia.com (April 25, 2014)

3+ Million companies have LinkedIn Company PagesPress.linkedin.com/about (June 19, 2014)


* Leveragenewagemedia.com (April 25, 2014)


Social Media 101 – Risks and rewards of social media

• Reputational– Defamation– Negative brand

impact– Crisis management

• Information security– Malware– Fraud– Information leakage– Cyber-attack– Hijacking corporate

social media accounts

• Legal – eDiscovery– Intellectual

property, trademark and copyright issues

– Ownership of social assets

– Personal and professional communications

• Industry-specific Compliance risks

– Securities/Banking– Telecommunications– Health care– Mining

• Privacy

• Consumer protection and regulations

• Marketing laws and regulations

• Human Rights and Employment laws

• Corporate Disclosure laws

Rewards

Enhance brand and company image

Deliver convenient service

Respond to crises Build customer

relationships Provide expert advice Acquire customers Monitor competitors Inform/monitor

shareholders Recruit and retain

employees Connect employees Uncover cyber threats,

data leaks

Risks

How to Use Social Media While Maintaining Best Corporate Governance and Compliant Practices


WHAT CAN DIRECTORS LEARN FROM SOCIAL MEDIA?



What can directors learn from social media?

“Social Media Intelligence” about your company• What people are saying about your company online• Identify broad market sentiments about your company

– Does your online reputation fit with your company profile?– Devote resources to using social media tools to reshape that perception

• Low-cost source of information on stakeholders and influencers to target those groups– NGO campaigns, public sentiment on key issues, environmental issues, etc.

• Identify key employees and drivers– For directors who use social media for business purposes, more of them use

it to engage with employees (56%) than with customers or clients (41%)*

- Identify whether there any leaks of non-public information that might require disclosure- Australian Stock Exchange requires companies to monitor for leaks of

confidential information

17Aug. 26, 2014 How to Use Social Media While Maintaining Best Corporate Governance and Compliant Practices*Korn/Ferry International “The Impact of Social Media on Boards and Directors Today – Special Report 2013)



“Social Media Intelligence” about other companies

Other Companies

- Reputational checking of companies as part of due diligence in an acquisition or tender

- Monitor suppliers (e.g., ethical work practices, other reputational risks)

Competitors

- Information your competitors are sharing

- LinkedIn hires

- New product and/or research announcements




How can directors learn what social media is telling them?

• Instant feedback and rich stream of data = communication overflow

• Social media monitoring tools to systematically capture and analyze relevant conversations about your company

• Monitoring online news, blogs, forums, and social networks

– Influence: Identify social media participants that are influential about a particular topic

• Klout Score– what is your social influence? Follower count, re-tweets, how influential the people who follow or re-tweet you

– Listening: What is being said about your company, your competitors, and your category in social media. Where is conversation occurring and what words are being used in association?

– Social scoring to identify user’s ability to drive online action




• Wildfire: “Who’s Winning on Social?” • Tracks Likes, Check-ins, Followers, Tweets, etc.




Rival IQ: Analyze competitive position, relative performance and market share




Radian6: Monitor and measure buzz, analyze trends, locate conversations that matter by tracking demographics, trends, from social posts



WHAT DO DIRECTORS USING SOCIAL MEDIA NEED TO KNOW?



What do directors using social media need to know?History of Regulation FD

– The United States Regulation FD (Reg FD), adopted in 2000, focuses on more traditional methods of distributing information.

– Generally requires that public companies communicate material information to investors on a broad, non-exclusive basis to ensure “fair disclosure” to all investors.

– In 2008, the SEC issued guidance to advise that disclosure made on a corporate website could comply with Reg FD, so long as the company first establishes its website as a “recognized channel of distribution” for material information.

– The 2008 guidance did not address social media, which was less significant then.



What do directors using social media need to know?

• Directors actively posting on social sites should be aware:– Minimizing reputation risk. Don’t communicate more than you want to:

• Posts may be more public than you think• Pictures or other posts may lead to speculation about the location of a potential

transaction or corporate expansion. Even when a picture’s location isn’t visually recognizable or the text of a tweet doesn’t state location, their geotags may reveal all.

• Posts spread fast and last forever– Disclosure requirements apply to social media

• Material information: US SEC Reg Full Disclosure guidance permits social media to be used to disclose material information; Canadian security administrators have not done so.

• Posts can implicate laws covering proxy solicitation, selective disclosure, public offerings and insider trading

• Canadian Anti-Spam Legislation applies to direct messages sent through social media

• Industry-specific disclosure rules apply (e.g., describing financial products, mining data)

– SEC Act section 20 says that companies can be liable if employees post insider information on social media.



What do directors using social media need to know?Examples

• In July 2012, when the CEO of Netflix used his personal, publicly available Facebook account to disclose what the SEC thought was material information, the SEC threatened Netflix and its CEO with an enforcement action.

• The SEC then instead provided guidance on how companies can use social media in compliance with Reg FD.

• The new guidance is a logical application with respect to a recommended approach for the use of social media.



What do directors using social media need to know?Regulation FD Guidance

– Before the Section 21(a) report the SEC was officially silent on the use of social media to comply with Regulation FD. The report addresses this gap in guidance and makes it clear that the SEC does not “wish to inhibit the content, form, or forum” of corporate disclosures, but rather seeks to “encourage companies to seek out new forms of communication to better connect with shareholders.”

– The report states that the principles outlined in the 2008 guidance, which discusses when information posted on a company website may be considered “public” for purposes of Regulation FD, also apply to disclosure made via social media and other “rapidly changing forms of communication.”

– The Netflix Section 21(a) report is a noteworthy improvement on the 2008 guidance for two key reasons.

– First, the report stresses that the key factor in determining whether social media disclosure satisfies Regulation FD is whether the company has adequately informed investors, the market and the media that it will communicate material information in this manner. This emphasis on sufficient advance notice should turn out to be quite helpful.



What do directors using social media need to know?Regulation FD Guidance (cont’d)

• Prior to the Netflix case, the 2008 guidance was sometimes observed to have created a “chicken and egg” problem by focusing on whether a company’s website was already a “recognized channel of distribution” at the time the information in question was posted. Without a track record of using only its website to release material information, a company would have a hard time knowing whether its website met this standard.

• As a result, many companies adopted a belt-and-suspenders approach to Regulation FD compliance, in which a press release or Form 8-K is used to disclose information that is also disclosed via the company website, or an “advisory press release” is used to alert investors that material information will be posted at a certain time. If a company regularly releases all material information through a press release or Form 8-K, however, the concern persists that investors may not bother subscribing to RSS feeds, for example, because more traditional methods of disclosure remain in use – further inhibiting the development of the website as a recognized channel. By focusing on notice, rather than on whether a company’s disclosure channels have become “recognized” in the eyes of third parties, the Section 21(a) report provides a concrete step a company can take to establish a particular channel as a Regulation FD compliance tool.



What do directors using social media need to know?Regulation FD Guidance (cont’d)

• Second, the report indicates that, as long as proper notice is given, the use of a subscription-based medium such as Facebook or Twitter can be suitable for Regulation FD purposes. This clears up a lingering concern that requiring an investor to subscribe, register or otherwise “opt in” to receive disclosures, even where no payment is required, might violate the Regulation FD imperative that disclosure be made on a “non-exclusionary” basis.

• Going Forward - Below are a few suggestions to lay the groundwork for website and social media disclosure of Regulation FD-sensitive corporate information.

– Decide which channels you want to use – and be specific.

– Identify the precise location where material information will appear, such as the specific URL, Twitter handle or Facebook page, rather than a general home page or a general reference to a particular social media site. The more specificity you provide investors about where and when to find future announcements, the better. The SEC expects you to make it easy for investors to find information. And although the SEC is comfortable with “opt in” channels, an investor should not have to pay money or agree to unusual license terms in order to access the channel.



What do directors using social media need to know?Regulation FD Guidance Guidance (cont’d)

• Decide what type of information you want to disclose. Although many companies will use websites and social media for some form of content, we expect that practice will continue to vary as to what types of information will be communicated through these channels.

• Craft a short paragraph explaining what you plan to disclose and where you plan to disclose it. Once you have decided what channels you will use and what you will communicate through these channels, you need a concise statement explaining this.

• Publish this paragraph regularly in your annual and quarterly reports, in your press release boilerplate, and on the home page of your corporate website. This is the key to ensuring that the market has notice of your plans. If you intend to change your practices, make sure notice of the change is publicized well in advance.

• Use available push technology. When possible, you should provide a mechanism for investors to receive alerts that new information has been posted.

• Use it or lose it. Once you have announced your intention to use a particular channel for a particular purpose, it’s important that you use it as you have described. Sporadic or inconsistent use is less likely to produce the kind of market following that the SEC is clearly looking for.




• Example:

Gene Morphis, ex-CFO of clothing retailer, Francesca tweeted @TheOldCFO:

• Official numbers had not been released to all investors.

• Although he did not use his name in his Twitter handle, his Twitter account had links to his personal Facebook and LinkedIn accounts.

• Gene was fired.

• Incident prompted Motley Fool to run an article, “Why Are Some Boards So Darn Stupid?” http://www.fool.com/investing/general/2012/05/16/why-are-some-boards-so-darn-stupid.aspx




• Example:

– Shortly after announcing a merger agreement, the CEO of Zipcar, the target company, expressed his enthusiasm for the deal by tweeting “@bostonglobe weighs in on the revolution we started at Zipcar” and linked to the Boston Globe’s report.

– Because the company had previously announced a merger that was subject to stockholder approval and securities laws dictate that the company must file with regulators, the tweet was deemed to have solicited stockholder votes. To comply with SEC rules, the company had to rush to file the tweet as well as the newspaper article.



HOW CAN DIRECTORS EVALUATE THEIR COMPANIES’ USE OF SOCIAL MEDIA?



How can directors evaluate their companies’ use of social media? Strategic questions about social media

• Who leads the social media oversight within the company? A single leader? A management steering committee? How is this leadership group linked to the board?

• What is the minimum level of understanding of social media required by directors for your company? Do your directors have this minimum level of understanding of social media?

• How can companies assist directors in improving their minimum level of social media knowledge and expertise?

• What are the organization’s goals for the use of social media? How do social media strategies support the key strategies of the company? Does the board have a full understanding of these linkages?

• Do the broad communication plan and policies address social media specifically? Do they consider the factors that make social media different from traditional media?

• How is social media used to leverage and expand traditional advertising and effectively engage customers? Is competitive activity monitored on social media?



How can directors evaluate their companies’ use of social media? Strategic questions about social media (con’t)

• Are both management and the board satisfied with the quality and quantity of discussion about social media risks and opportunities at board meetings?

• What element of the CEO evaluation considers the CEO’s grasp and proficiency in the use of social media? Is this necessary? If it not, why not?

• Are there internal mechanisms and systems that are monitoring what social media is reporting on your company? Does your company have strategies to immediately address information that is incorrect and may get virally out of control?

• How is the business currently using social media to engage with its employees? What are its plans for upcoming years? What does the board need to know about this?

• Are directors satisfied with the amount of exposure they get to management and employees involved in social media initiatives and operations?

• Are there clear policies and guidelines for the directors’ use of social media?

• Are directors personally engaged in trying to understand the impact of social media on their director responsibilities?



How can directors evaluate their companies’ use of social media? Ten topics for directors to review from a governance perspective

1. Social media plan

– Does the organization have a social media plan identifying the purposes of the organization’s social media, the persons accountable for implementing the social media plan, and the metrics by which the time and effort spent on social media will be measured?

2. Type of social media strategy

– Will the social media be simply one-way promotion of the organization or will it truly be “social” in the sense of engaging with stakeholders?

– How does the strategy fit with the organization’s social media plan and other public relations efforts?

3. Choice of platforms

– What social media platforms will be used to implement the social media plan?

– How do those platforms match the goals of the social media plan and the strategy to achieve those goals?

– Have the terms of use and end user licence agreements for those platforms been reviewed?


Source: Timothy Banks (Dentons)



(con’t)4. Advertising compliance

– Does the organization’s social media plan comply with the Competition Act (Canada), Competition Bureau Guidelines, the Canadian Code of Advertising Standards and other legal restrictions that may affect the use of social media to promote the organization?

– Is the organization providing benefits to “influencers” (persons with large followings on social media and who influence people to take actions, such as clicking on a link or signing up for a promotion)? Is this appropriately disclosed?

5. Contests

– Will social media be used to engage in contests?

– How will the organization ensure compliance with the Criminal Code and the Competition Act in respect of those contests?

6. Criticism

– How will the organization respond to criticism in social media platforms?

– Does the organization have clear guidelines on how to handle a disgruntled stakeholder or a negative social media report?

– How will criticism be elevated within the organization?


Source: Timothy Banks (Dentons)



(con’t)7. Confidentiality

– How will the organization ensure that postings through social media do not result in the inadvertent disclosure of non-public material information, confidential information or trade secrets of the organization or a third party to whom the organization owes a duty of confidence, or personal information of employees, customers or others?

8. Employee engagement

– Does the organization have a social media policy covering employees?

– Does the policy balance the right of employees to engage in free speech while educating employees and protecting the organization against activities that may contravene advertising laws or be considered to be defamatory or discriminatory?

– Do employees understand the consequences of breaching the social media policy?

9. Monitoring

– Who is responsible for surveillance of the reputation of the organization and competitors in social media? Who will receive reports of major events?

– How will the social media strategy be fine-tuned to respond to the information received through social media?




(con’t)9. Disaster plan

– Does the organization have a 24/7/365 disaster plan in place in the event that the organization is under attack on social media platforms or a social media effort backfires?

– Are the appropriate personnel and external advisers in place to assist?



WHAT RISKS APPLY TO COMMERCIAL USE OF SOCIAL MEDIA?



Myriad Canadian and US regulations apply to social media across industries

Aug. 26, 2014 How to Use Social Media While Maintaining Best Corporate Governance and Compliant Practices 41Canada USA

Canadian Anti-Spam Legislation• Requirements for commercial electronic messages• Consent/opt-outs

US State Password Protection LawsLimit employer access to employee social media accounts

Civil Rights Act of 1964Restricts discrimination based on personal information (that might be on social sites)

Privacy LegislationPIPEDA, GLBARestricts collection, use, protection of Personal Information

Stored Communications Act• Restricts access to electronic records

• Extends privacy rights

Nat’l Labor Relations Act• Protects employees’ rights to discuss terms and conditions of employment

• Restricts employers’ actions that “chill” employees’ protected discussions

Canadian/USCopyright/Trade-mark LawsUse of intellectual property

Competition Act Covers online contests, promotions

Human Rights ActRestricts discrimination based on personal information (that might be on social sites)

State rules on contestsCovers SM contests and promotions

Regulation Full Disclosure• Covers release of material information• Can be done on social media

Federal Rules of Civil ProcedureRequire organizations maintain data archives (including social media) readily accessible in the event of litigation.

Human Resources

Corporate

Information Security

Recruiting

Background Checks

Employee Collaboration

Employee Conduct

Investigations

Cyber Threat

Monitoring

Research

Financial Disclosure

Customer Service

Brand Promotion

Marketing

Competitive Intelligence

Market Analysis

Advertising/ Promotion

Social Media Use and

Regulation

Human Resources

Investor Relations

National Instrument 47-201 –Using the Internet and Other Electronic MeansRestricts posting new information during a period of distribution

National Instrument 54-101 –Communication with Beneficial OwnersCovers proxy solicitation, covers posts on social media

Bill 168Gives Canadian investors right of action against companies making material misrepresentations in any media

Corporate areas that use social

media

Uses of social media


Myriad Canadian and US laws and regulations apply to social media as used in specific industries


Industries that use social media

FCAC (BA, T&LCA, IA)• Disclosure rules, regardless of media• Complaint reporting/ tracking

MFDA (OSC)• Disclosure (prod. descriptions, conflict of interest)

• Complaint management• Advertising• Monitoring/oversight• Endorsement• Record Retention

IIROC, FINRA (Advisers Act, OSC)• KYC • Complaint management• Advertising• Disclosure (product descriptions,

conflict of interest)• Monitoring/oversight• Endorsements/testimonials• Third-party research• Record Retention

Equal Credit Opportunity Act (Reg B)• Prohibits discrimination based on protected status – affect use of SM for recruiting

Fair Debt Collection Act• Cannot post debt payment info. on customer’ social media wall

Community Reinvestment Act• FIs must retain comments from public made on social media

Human Resources

Retail Banking

Wealth/ Retail

Brokerage

Capital Markets/ Securities

Sales/ Customer Communication

Customer Complaint

Management


Client Communication

Credit Checks

Collections

Client Complaint

Management

Research

Pharmaceutical

Companies

Mining and Resources Companies

Investor Relations


National Instrument 43-101 – Standards of Disclosure for Mineral Projects Covers disclosures of scientific or technical information

National Instrument 51-101 –Standards of Disclosure for Oil and Gas ActivitiesCovers disclosures of scientific or technical information for reserves, recovered volumes…

FDA Disclosure RulesCovers information concerning prescription drugs and medical devices


Uses of social media Canada USA

Social Media Use and

Regulation


Existing regulations applied to social media provide complications


Legislation How Social Complicates

Canadian Anti-Spam Legislation• Fully applies to social media; requires:

• Express consent for commercial electronic messages sent to specific user addresses.

• Prescribed methods to opt out (narrowly and broadly) from further communications

• Exemption for responses to queries/requests.• Private right of action

• Consent/unsubscribe cannot be implied by participation on the social site• Message sizes limit ability to provide prescribed opt-out messages – need

to use links to fuller opt-out sites• Customer records may not track social handles as robustly as email

addresses and other links to customers• Controls may rely more heavily on manual processes

Privacy (Canada, US, UK)• Same restriction on collection, use,

destruction and protection apply to social media.

• Social’s informality may lead customers, employees to give too much data• Both company and social site privacy rules apply; site rules change often• Documenting consent for collection may be challenging• Social site data breaches happen• Data permanency: data on social sites survives use for which data was

collected

State Password Protection Laws (US)• 15 states have passed laws restricting

employers’ access to social media accounts; more on the way

• Inconsistent definitions, restrictions, carve-outs (e.g. for investigations or monitoring)

• Can extend privacy definitions beyond what would apply in other contexts• Possible conflicts may arise of compliance with state law vs. federal law

(e.g. 5 state social media laws do not support requests for passwords to support SRO monitoring requirements)

FDA Drug and Medical Device Marketing Regulations• Prescribes how manufacturers, packers and

distributors of prescription drugs and medial devices communicate benefit, risk information

• Character space limitations on social sites (e.g., tweets) and search engine sponsored links restrict ability to indicate use of products and risks; risk data must be displayed prominently.

• Tweets/ads must include proprietary and generic names and the most serious product risks; can link to other sites, but links’ names should identify that they lead to risk lists.

Low

Compliance Angst-o-meter

High


Existing regulations applied to social media provide complications (cont.)

Legislation How Social ComplicatesSecurities Regulations (Canada, US)• Same client communication rules (e.g.,

advertising, complaints), record retention apply• Fines and sanctions for social media posts are

for contravening the same regulations that apply to older media

• Capture of communications in context challenging without automation

• Requires modification of existing processes (e.g., for preapproving advertising); retraining of employees, supervisors

• Record retention and retrieval of communciations in context requirearchiving of data

National Labor Relations Act (Section VII) (US)• “Employees shall have the right to … engage in

… concerted activities for the purpose of collective bargaining or other mutual aid or protection…”

• National Labor Relations Board (NLRB) prohibits employers’ actions it says “chill” employees’ discussions about terms and conditions of employment.

• Applies to both union and non-union companies

NLRB has deemed illegal social media policies that:• Say: Don’t divulge internal, confidential, or non-public, personal

information • Say: Be polite• Say: Don’t use company logos without permission• Discourage employees “friending” each other• Require internal grievances be addressed through internal

procedures instead of online• Prohibit employees from commenting on pending legal matters

Copyright Laws (Canada, US, UK)• Laws give the creator of work exclusive rights

to its use and distribution.

• Social media facilitates copying and distributing material• Social media format’s brevity (e.g., Twitter) complicates attribution• Terms and conditions for Twitter, LinkedIn, Facebook , Instagram

state that users commit that the users own all content they post and grant the sites a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that users post.

• Legal actions against the sites for reusing the content will be passed on to the users who posted the content originally.


Low

Compliance Angst-o-meter

High


Canadian regulators are signaling increased interest in social media

• Investment Industry Regulatory Organization of Canada (Canadian Securities Regulator)

– Issued Social Media Guidelines (Guidelines for the review, supervision and retention of advertisement, sales literature and correspondence – December 2011) covers: suitability and recommendations, recordkeeping requirements, supervisory requirements, treatment of third-party posts on social media sites)

– Reviewing corporate disclosure requirements and restrictions

• Mutual Fund Dealers Association (Canadian Mutual Fund Regulator)

– Social Media Guidance (#0575 August 2013) promises further guidance; reminder that social is on radar screen

– Annual Product Questionnaire requests information on firms’ use of social media

– Annual 2013-4 Rule Notice/Guidance Note 13-0296 (December 2013) says: IIROC’s Business Conduct Compliance department will be reviewing the social media policies and procedures of Dealers in the next examination cycle.

• Office of the Privacy Commissioner of Canada

– Investigations and advocacy (PIPEDA Case summary #2009-008: CIPPIC v. Facebook Inc.)

• British Columbia Securities Commission (BC Regulator)

– Issued report in 2013 on continuous disclosure in the mining sector included review of social media posts



US regulators are directly addressing social media

• Federal Financial Institutions Examination Council (FFIEC) Social Media: Consumer Compliance Risk Management Guidance (December 2013)

– Members: Federal Reserve Board, Office of the Controller of the Currency, Federal Deposit Insurance Company and Consumer Financial Protection Bureau). FFIEC coordinates exams on behalf of its members

– Requires that financial institutions have:• Social Media Risk Management Program (defined roles and responsibilities, policies and procedures,

training, Compliance and Audit oversight)• Board-level reporting on social media strategy, use and results• Monitoring of FIs’ own and third-party social media and other internet sites• Policy development/training requirements covering social media

– Highlights general application of existing consumer regulations to social media and special focus on special social media consideration

• Security Exchange Commission (US Securities Regulator) – Sweeps targeting member firms using social media– Reviewing corporate disclosure requirements and restrictions

• Financial Industry Regulatory Authority (US Securities Regulator)– Sweeps – Spot-Check of Social Media Communication (June 2013) review of practices (including

business purpose) both the firm’s and its registered representatives’ and associated persons’'’, written supervisory procedures and methods of monitoring use, list of top 20 representatives using social media.

• Office of the Comptroller of the Currency’s Social Media Examinations 2013– Investigating FIs’ use of social media (consistent with FFIEC guidance)

• Federal Drug Administration– Monitors drug advertising and endorsements on social media; recently released guidance on social

media usage



WHAT ARE SOME MITIGATING CONTROLS?



How do you mitigate the risks?Start out on social media strategy – homework

• Do your homework– Confirm corporate strategy for social media use (Corporate use or use by

individuals’ use for business purposes?)– Evaluate reputational and compliance risks for all uses– Review corporate policies for updates and alignment. Examples:

• Disciplinary, bullying and harassment policies to make sure they cover derogatory social media posts

• Data protection or privacy policies covering posting of personal information• Electronic communications policies• Corporate Code of Conduct

– Understand legal terms and conditions of social media sites (including right to use posted material, copyright protections, limitation of liability, privacy, how offensive and abusive content may be removed). Note that they change frequently.

– Determine approach for monitoring and retention of content • Special problems of non-text content – e.g. linking and video



How do you mitigate the risks?Starting out on social media strategy - governance

• Set up governance structure– Establish a cross-functional, unified approach– Key groups to involve in strategy review

• Compliance and Privacy• Marketing (brand, digital strategy…)• Core Lines of Business• Corporate Communications• Government Relations• Human Resources• Legal• Technology

– Identify role in decisions to support marketing and technology changes

• Identify role in crisis management, escalation of issues – Insist on a dress rehearsal

• Start with a pilot program



How do you mitigate the risks? Monitor …

• Assure that monitoring takes place of posts from your company and from third parties

– Identify processes to monitor and retain records of social media communications from corporate network

– Implement automated systems, update processes

– Identify escalation procedures and processes to respond to postings

– Retain employee communications and evidence of supervisory review in a form that accommodates eDiscovery, regulatory examinations and other regulatory requirements

• Monitor other companies’ use of social media

• Monitor changes to social media platforms (e.g., new/changed features and layout, changes to terms and conditions, business models)



How do you mitigate the risks for employees using social media for business purposes? Elements of a successful pilot• Identify success criteria for the pilot:

Start small and increase to contain any problems; start conservatively: it is easier to unblock features than to close down features that participants are using. Limit the number of social media sites supported

• Plan pre- and post-review, monitoring and retention processes. Remember pilots are live (not test runs or play). Cover employee posts, third-party content, customer complaints

• For content that must be approved before posting, set expectations about response time.Identify what functionality the site will be allowed (e.g., can “likes” or “recommendations” be used? Can Facebook albums be used? Is person-to-person messaging allowed? Use through mobile devices?)

• Separate business from private: – Facebook limits users to a single account and requires a separate Business page to be used for

commercial activity– Twitter permits multiple accounts, consider making a separate business account

• Select pilot participants who – Are tech-savvy (esp. with the particular social media used in pilot)– Have good Compliance records (esp. with regard to customer communications)– Are willing to use social media frequently during pilot– Have the support of their managers – encouraging participation, following up on non-compliance

instances• Assume dedicated one-on-one time will be required with each participant • Develop mandatory training with testing, covering

– What features can be used and what ones cannot be used– The social media sites’ functionality and best practices on using that functionality to increase sales

(e.g., what to post, how to build networks)– Reminders of general rules governing customer communication, code of conduct



How do you mitigate the risks? Implementation checklist

• Train– General awareness and specialized training for spokespeople, sales staff, supervisors,

include examples– Consider making mandatory for some or all– Speak to your audience – Require all participants to pass test with a score over 80%.– Consider reminders (examples: http://www.youtube.com/watch?v=JRvY1SzWhl0 &

http://www.youtube.com/watch?v=atT1wMhAFZY)• Develop participation agreement for those approved to use social media for

business purposes. • Develop libraries of approved content for employee use • Develop an annual attestation process to cover social media policy compliance• Build in a specific reference to the social media policy as part of your hiring

process for all new starters• Ensure your employment contracts and any post-termination restrictions are

compatible with your social media policies• If you are going to use social media as a recruitment tool be clear about what

you will do with any information gleaned on applicants to reduce the risk of inferences of discrimination being drawn if the candidate is subsequently not successful



Questions?



Contact Information

• Liane Fong [email protected]

• Dexter John [email protected]

• Joann Sochor [email protected]


how to use social media while maintaining best corporate ... · questions. some awareness, but not...

Documents