To assist employers, the Office of the Information & Privacy Commissioner for British Columbia recently published an updated guideline.
There is no question that social media has transformed the way businesses market themselves, with companies dedicating significant resources to this ever-expanding platform. Social media has also changed the way employers search for, monitor, and choose candidates and prospective employees. Given the wealth of information available with just one click, many employers increasingly use social media platforms to conduct background checks on candidates and employees. However, with this increase comes the potential of running afoul privacy laws.
To assist employers, the Office of the Information & Privacy Commissioner for British Columbia recently published an updated guideline, Conducting Social Media Background Checks ("Updated Guideline"). When a private sector company conducts social media background checks, the use, disclosure, and collection of personal information is governed by the Personal Information Protection Act; whereas, public bodies are governed by the Freedom of Information and Protection of Privacy Act. This article focuses on the requirements for private sector companies.
The Updated Guideline outlines the risks employers need to consider when conducting social media background checks, including:
1. Inaccuracy: Privacy laws require companies to take steps to ensure that the personal information they collect is accurate. This can be difficult because the social media account may not be the actual candidate, photographs may be mislabelled, or information may be out-of-date.
2. Collecting irrelevant and/or too much information: Under privacy laws, companies are only allowed to collect personal information that a reasonable person would consider appropriate in the circumstances. Companies should filter how much, and what type of, information is collected during background checks. Without intending to do so, an employer may inadvertently collect information about the candidate's race, gender, age, sexual orientation or religion through their social media posts, or may collect information about other people.
3. Over-reliance on consent: Privacy laws allow companies to ask individuals for consent to access their social media platforms, but individuals can withdraw their consent at any time. If consent is withdrawn, the company cannot continue to either collect, or use the information previously collected to make a decision about that person. One exception to this is when an employer collects social media information regarding a person's employment. In that case, the employer may use the information, without the person's consent, if it is for reasonable purposes related to hiring, maintaining, managing, or terminating the employment relationship. However, the employer must still notify the individual that this type of information has been collected, unless it is used for a purpose for which consent is not required (e.g. certain types of investigations).
To minimize the risk of breaching an individual's privacy when conducting social media background checks, the Updated Guideline reminds employers that any information collected about individuals is personal information and is subject to privacy laws. The Updated Guideline also recommends that companies conduct a privacy impact assessment of the risks associated with using social media in background checks. A privacy impact assessment should:
- determine which privacy law applies;
- identify the purpose and legal authority for using the information to be collected;
- consider less intrusive measures for collecting and using the information;
- identify the types and amounts of personal information likely to be collected;
- identify the risks associated with collecting and using the information;
- ensure policies and procedures are in place to address the identified risks;
- notify the individual that social media background checks will be performed, if the collection is authorized; and
- prepare to provide access to the information collected.
The Updated Guideline serves as a useful reminder for employers of the risks associated with conducting social media background checks. If a candidate, potential employee, or current employee suspects their personal information has been misused, they can file a complaint with the Office of the Information & Privacy Commissioner for British Columbia, which may result in legal consequences for the employer.
