Social Media in Background Checks

Social media background check | BCBusiness
Before trolling a potential employee’s Facebook, find out if collecting data via social media is breaking any privacy laws.

Employers should think twice before digging up dirt on potential employees through social media sites or risk breaking privacy laws.

Given all the potential sources of information on social media sites including Twitter, YouTube and blogs, it isn’t surprising employers are searching these as part of their background checks on prospective employees and volunteers. Many employers assume when someone posts information online, they tacitly consent to the use of that information by prospective employers when making hiring decisions. Unfortunately, that assumption isn’t correct and companies can get themselves into hot water as a result.

The offices of the Information and Privacy Commissioners in B.C. and Alberta have recently published guidelines on employers’ use of social media in background checks. The guidelines start from the premise that just because someone publishes information online, it does not mean they consent to the use of that information for background checks. Further, even if consent can be implied, the commissioners warn privacy laws still apply to the kinds of information that can be accessed and collected. In other words, irrespective of whether the information is available online, employers still are subject to privacy laws if they intend to view, collect and use such information.

Before reviewing the highlights of these guidelines, it’s important to understand which privacy laws apply to your company. The Freedom of Information and Protection of Privacy Act (FOIPPA) applies to B.C.’s public sector organizations (Crowns, health authorities, universities, etc.). The Personal Information Protection Act (PIPA) applies to B.C.’s private companies. 

The strictest rules affect public sector organizations. Section 27 of FOIPPA states all private information must be collected directly from an individual, unless another collection method is consented to by the individual [sec. 27(a)(i)]. Further, once such information is collected, the employer must inform the individual [sec. 27(2)].

Because collecting personal information from social media sites is indirect, public bodies must always have an individual’s consent to gather personal information from social sites. Once consent is provided, public sector organizations are also required to collect personal information a reasonable person would consider appropriate in the circumstances (sec. 26). 

For private companies, PIPA permits the collection of personal information without the individual’s consent if the collection is reasonably related or necessary for assessing the individual’s suitability for the position. 

Even if public sector organizations and private companies have complied with the above provisions, they can still breach their obligations under the legislation. The B.C. Office of the Privacy Commissioner’s Guidelines for Social Media Background Checks identify special risks associated using social media sites to collect personal information for prospective employees or volunteers.  

• Collecting inaccurate information. FOIPPA and PIPA require employers to take steps to ensure personal information they collect is accurate. Information gathered on social media sites may be inaccurate as it’s possible the information relates to another person with the same name, is out of date or was deliberately inaccurate as part of a plan to discredit that individual. 

• Collecting irrelevant and too much information. FOIPPA and PIPA require employers to only gather information that would reasonably be deemed relevant or appropriate. Since information posted on social media sites wasn’t intended for prospective employers, inevitably organizations will gather much more information than which fulfills this requirement.  Also, in the course of collecting personal information about an individual, employers will often gather personal information of third parties.

For more information on this topic, check out the guidelines as they include tips and practical advice for those who may be considering using social media sites to gather personal information on employees or prospective employees.  

Employers should also remember if an individual suspects their personal information has been collected, they have a right to ask for copies of information collected. If they suspect that personal information has been improperly collected, they may complain to the Information and Privacy Officer. Thus, it is important that even if companies believe they have complied with the requirements of FOIPA or PIPA, they should be prepared to defend any challenges to their right to collect, and use personal information, and to show that any information collected was destroyed and not used for any other purpose, after the interview/background check purpose.