Business use of social media – answering the legal queries
Part 1: Investigating other people’s social media activities

Question 1: Can a business review the social media accounts of its staff or customers and re-use information which it finds?

Information shared by others over social media such as Facebook, LinkedIn and Twitter can be useful to a business. Examining profiles of potential employees, customers or suppliers may help you decide whether to recruit or engage with them, and how to market to them; following posts of existing staff and contacts means you can keep up with what they are doing and use this information to develop or manage your relationship; you can also check they are not misusing your intellectual property or damaging your reputation; further analysis of all this information can assist you to improve your services and build up data assets.

These types of investigative activities are not unlawful in themselves, provided the legal issues are addressed appropriately. Businesses who wish to use social media information must balance their interests in using it against the rights of individuals under data protection and human rights laws. This article provides some guidance on applying these areas of law.

Question 2: Can an employer make employment decisions based on an employee’s activities on social media?

Specific guidance is also provided for the employment context, where employers discover social media activity of staff or applicants which may prompt disciplinary action or impact their decision to recruit or dismiss. There have been a number of recent cases which consider where to draw the line between the employee’s and employer’s rights in these circumstances.

Data protection and human rights

A common misconception is that information found online is “public” and therefore can be re-used without restriction. However, this is not the case; even within a public forum, individuals retain rights in relation to their personal data (under the Data Protection Act 1998) and the right to a private life (under the Human Rights Act 19981). Other relevant human rights include freedom of expression, for example allowing individuals to comment freely on social media, and freedom of religion and freedom of association, for example joining religious or political groups on social media.

Therefore, if personal data has been shared via social media and an organisation wishes to re-use that information, all the principles of data protection must be followed. Further, any review or monitoring of individuals’ social media activities and decisions made on the basis of those activities should not interfere with the individuals’ human rights or, to the extent they do, such interference must be justified by the legitimate interests and rights of the organisation. Both areas of law require the business interests to be balanced with the rights of the individuals.


1 Whilst the Human Rights Act 1998 only directly applies to the public sector, the courts must also make decisions and interpret the law (for public and private sector cases) in a way which is compatible with these rights.

Top tips – data protection and human rights

  • Define a clear purpose for using social media information, and ensure your proposed use is proportionate to this goal. For example, checking whether staff are misusing business accounts, or posting defamatory comments about your customers, may be more easily justified than making business decisions about staff based on unrelated social activities outside work.
  • Consider the individual’s original intention and expectations in posting social media content. Individuals may intend or expect information within business-related accounts to be re-used for related business purposes, whereas they may expect more privacy within personal accounts. For example, it is more likely that information on LinkedIn account was intended to be used in a recruitment or marketing context than information on a personal Facebook page.
  • Seek the individual’s consent where appropriate. For example, ask permission before your app accesses a customer’s Facebook profile data for analysis purposes, and ask to connect with someone on LinkedIn before you review their account information. Note that if an individual has made their information available online to a wide group of people, this does not necessarily mean they consent to you using it for your own purposes. However, this may be a factor in assessing overall fairness of use.
  • Where consent is not practical (which may often be the case in an employment context), you will need balance your legitimate interests in using the information against the rights and interests of the employee or other individual, including his/her rights to a private life and to freedom of expression.
  • Ensure the extent of activities which you investigate and the scope of information which you re-use do not go further than genuinely needed to address your legitimate interests. It will generally be unlawful to collect information “just in case” it is useful, or to interfere with rights of individuals based on improbable hypothetical damage to your interests.
  • Let individuals know what you are doing, for example within terms of service, social media policies or within specific communications. Using an individual’s social media information without informing them will only be justified in extreme circumstances, such as a criminal investigation.
  • Assess whether information you find is accurate and up to date and seek confirmation where appropriate. Just because something is recorded within social media, this does not mean it is true! This is particularly important if information is being relied upon to make decisions which affect an individual, for example whether to recruit an employee or accept a customer.
  • Delete information when you no longer need it, which may be immediately if irrelevant information is found as part of your investigation.
  • Look to anonymise data which is collected for the purposes of statistics or analysis.
  • Carry out a privacy impact assessment before carrying out any regular monitoring of social media accounts.

More top tips – the employment context

The balancing test between business interests and an individual’s rights is frequently put into practice where an employer finds out that an employee (or applicant) has posted content within a personal social media account which is potentially adverse to the employer’s interests. Those interests may include its reputation, relationships with its customers and staff, or the ability of the employee to do his/her job. The employer may then wish to reject an applicant, or take disciplinary action against an employee based on that information.

  • Ensure social media research does not result in discrimination or harassment based on personal characteristics or activities. For example, social media accounts may reveal information such as age, gender, ethnic origin, sexual orientation, religion to which an employer may not otherwise have access.
  • Check that use of social media information does not compromise diversity and consistency in approach between different individuals, particularly if everyone does not have a social media account and therefore equivalent information on everyone is not available.
  • Ensure relevant employment laws are followed in relation to grounds and procedures for disciplinary action and dismissal. Appropriate grounds may include, for example, gross misconduct, breach of contract, or breach of obligations of trust and confidence. On the other hand, be aware that employees may argue that reviewing or using social media information constitutes a breach of an employer’s obligations to them.
  • Ensure that use of social media information, and the consequences for the employee, are proportionate and reasonable in context, taking into account employment laws, and, as discussed above, data protection and human rights. Take into account whether the social media activity had any business connection (or was purely personal), who else may see it (bearing in mind any privacy settings), and whether there is any actual detriment to the business in practice.
  • Take into account the business’s employment and social media policies, and the extent to which the employee is aware that his/her social media activities may be restricted (and the consequences of breaching policy). As can be seen for the example cases below, breach of a social media policy has often been a key factor where a decision has gone in favour of dismissal (although is not always a determining factor).

In drafting appropriate policies and procedures, all the above tips should be taken into account, ensuring that any restrictions on the employee’s use of personal social media, and any review or monitoring of social media activities are proportionate in consideration of legitimate business interests, and an employee’s rights under data protection, human rights and employment laws.

Examples of cases

(a) Surrey Heath Borough Council v Information Commissioner and Morley2 (2014)

Data protection and privacy rights of children prevailed in this case notwithstanding information and associations having been made public over Facebook.

A freedom of information request was made to Surrey Heath Borough Council asking for the names of members of a local youth council group (aged between 13 and 19) which had supported a particular planning application. The case went all the way to the Upper Tribunal, which was asked to decide whether the Council could refuse to disclose such names on the basis that this would breach the data protection principles3.

A key consideration was that was that some members of the youth council group had joined a Facebook group. Whilst the group was closed (i.e. discussions within the group could not be seen by the public), the names and images of several members could be viewed by the public (although it was not possible to see whether they had been members of the youth group at the time of the planning application). Therefore, a key argument in favour of disclosure was that there cannot be a reasonable expectation of privacy when the data subjects have put their names and images into the public domain.

The Upper Tribunal decided that it would not be fair to disclose the information; there were no strong and compelling reasons to disclose the identity of the individuals, plus the requestor already had the names of those on Facebook; there was therefore no interest in knowing more than had already been made public about the youth council in relation to the relevant planning application. In addition, the individuals had not consented to disclosure by putting their names on the relevant Facebook page – there was no evidence as to the understanding and expectations of those on the relevant page nor that they were responsible for putting their names on the public front page. Further, consent was only a factor in assessing fairness in any case.

The Upper Tribunal also gave some guidance on the rights of children as minors in relation to data protection, and the Human Rights Act Articles 8 (right to a private life) and Article 10 (freedom of expression). It highlighted that the decision on whether to disclose will depend on the facts of the case and it may be difficult to balance the right of privacy versus freedom of expression and public interest in publication. The interests of children cannot be treated as a ‘trump card’.

(b) Preece v JD Wetherspoons4

In this case, the interests of the business were held to override an employee’s rights of privacy on Facebook.

During a difficult shift, a pub shift manager asked a couple of customers to leave, and then had a discussion with friends over Facebook about these customers, which included a number of derogatory comments about them. Subsequently, the daughter of the customers made a complaint about the Facebook entry and, following investigation, the shift manager was dismissed. She claimed unfair dismissal, and one of her arguments was that the comments she made were on her private Facebook page (visible to friends), and were not public. Therefore she was not bringing the company into disrepute or betraying her employer’s trust and confidence.

The Tribunal found that the dismissal was not unfair in the circumstances. It considered that whatever the claimant’s belief about the privacy of her communications, they were in the public domain. It is unclear how the customers’ daughter found the post, but a key factor was that the claimant had 646 friends on Facebook, i.e. it was not a small closed group. Under Article 10 of the Human Rights Act, the claimant was entitled to freedom of expression but the interference with this right by dismissing the employee was justified on the basis of damage to reputation.

Another reason in support of the dismissal was that the employee handbook had outlined action which amounted to gross misconduct, which included acts outside work which affected customer relations, and blogging which lowered the reputation of the organisation, its staff or customers.

This case also highlights the importance of appropriate privacy settings on social media. If the group of people with whom information is shared is very wide, the balance of privacy versus other interests in using information may be tipped in favour of the other interests.

(c) Smith v Trafford House Trust5 (2012)

In this case, freedom of expression and freedom of religion meant that dismissal on the basis of religious comments on Facebook was unfair.

Mr Smith (a practising Christian) worked for a Housing Trust. On his personal Facebook page (which also identified him as a manager in the Trust), he posted a link to a BBC news article about introduction of gay marriage in the UK, together with the comment “an equality too far”. This prompted a short Facebook discussion amongst him and his Facebook friends, during which he explained his viewpoint. The discussion was visible by friends (201) and friends of friends, meaning a large number of people in total. This was reported by a colleague (who was not a Facebook friend). This prompted disciplinary proceedings and alleged gross misconduct, following which Mr. Smith was demoted.

The grounds for demotion were breach of the Trust’s code of conduct (which restricted activities which may bring the Trust into disrepute, including where the employee could be identified as an employee of the Trust on web-based media such as Facebook), and acting contrary to its equal opportunities policy (which required employees not to engage in conduct which may make others feel uncomfortable, embarrassed or upset).

On the other hand, rights of freedom of expression and freedom to manifest religious beliefs were raised: interpretation of the relevant laws and issues needed to take these into account. The judge distinguished between restricting activities at work or in a work-related context (which may be legitimate) with restricting activities in a personal or social life (which would be “surprising”).

Whilst an employer may seek to control some aspects of employees’ conduct within their personal as well as work life, the Court considered that prohibitions on the promotion of political or religious views would lie very much at the work-related end of the spectrum. Even though 45 of Mr. Smith’s colleagues were also his Facebook friends, and Mr. Smith identified himself as an employee of the Trust on Facebook, this was not sufficient to make his post “work-related”. The work colleagues had chosen to be his friends and, to put the post in context of his Facebook wall being about his social and personal life, the Court also referred to a later post about wholemeal toast and apricot jam!

The Court also considered that the postings were not, when viewed objectively, judgmental, disrespectful or liable to cause offence, as they were widely held views frequently heard on radio and television, or read in the newspapers. They may cause upset, but this is a “necessary price to be paid for freedom of speech”.

This case shows that whilst provisions in the policies and staff handbooks can assist in restricting outside activities impacting employers, it will be more difficult for organisations to restrict personal views within social media used for personal purposes (even if shared with a wide community).

Having said that, whilst the decision in this case went in favour of the employee, it highlights that by naming an employer on Facebook, there may be higher risks of comments having an impact on that employer.

(d) Game Retail Ltd v Laws6 (November 2014)

This case demonstrates that employees cannot escape scrutiny of personal accounts which are used in connection with work or have an impact on their employment, but that distinguishing between private and work use of social media can be tricky.

This case was heard by the Employment Appeals Tribunal (EAT) in November 2014, and is understood to be the first EAT case concerning dismissal for social media use in respect of Twitter. In its decision, the EAT remitted back to the employment tribunal for a new decision, so the final outcome is not yet been determined, but the EAT provided some useful guidance.

The claimant was a loss prevention investigator for the retail company. Each store had its own Twitter feed. The claimant had a personal Twitter feed which he used to communicate with people outside work, but which also followed the feeds of 100 stores for which he had responsibility as part of his job. 65 of these stores followed him back. In 2013, a store manager reported 28 offensive tweets being made by the claimant on this account. Following an investigation, the claimant was dismissed, and brought a claim for unfair dismissal.

The employment tribunal (in February 2014) had held that the dismissal was unfair, taking into account the personal nature of the account, that the claimant had not posted anything derogatory about the company or that would reveal him as an employee, and that the disciplinary policy in force at the relevant time did not expressly contain a clause demonstrating that offensive or inappropriate use of social media in private time would or could be treated as gross misconduct.

However, the EAT considered that the Tribunal had not applied the tests correctly in the context. The nature of Twitter is that feeds are not restricted to particular groups of people (without specific settings) and in this case the account was not for private use only. The claimant could have had more restrictive settings, and he could have made two different accounts for different purposes. Also there was evidence that least one other member of staff had found the comments offensive.

The EAT also considered freedom of expression, and noted that, generally speaking, employees should have the right to express themselves, providing it does not infringe on their employment and/or is outside the work context.

This case also shows the importance of appropriate policies and training. In this case, for example, it appears the claimant may not have fully understood the impact and potential audience in his use of Twitter.

(e) Weeks v Everything Everywhere Ltd7 (2012)

In this case, an employee’s dismissal was held to be fair due to a breach of social media policy by comments made about the employer over Facebook.

The employee was dismissed following postings about the employer made on Facebook, and brought a claim for unfair dismissal. The company’s social media policy covered employees’ use of social media at work and in their own time and required employees to remain loyal to the organisation and not to criticise brands, products or services, working relationships (and more).

The employee had made reference on Facebook to his place of work as “Dante’s Inferno” or similar terms in several Facebook posts over about a month. A colleague who was a “friend” on Facebook reported it to the company. Following a meeting with the company to discuss, the employee refused to stop making comments as it was his life outside work. He also made some additional posts which his colleague considered were directed at her and threatening.

The employee argued that had made references to the company as “Dante’s Inferno” for a long time to the awareness of a number of colleagues and team leaders and had never had any objection.

The Tribunal decided that the employee’s comments were likely to cause damage to the company’s reputation (even though no evidence of actual damage had presented), and that the subsequent posts were threatening and intimidating. These constituted breach of the company’s policies on social media, bullying and harassment, and amounted to gross misconduct. Therefore the dismissal was fair.

(f) Trasler v B&Q8 (2012)

In this case, the employee had breached a social media policy through Facebook posts but dismissal was held to be unfair.

The employee was a customer advisor for a retailer. The employee posted on Facebook page (on one particular day) about his place of work, including comments about being overworked and action he was going to take, which referred to doing some “busting”. This was reported by someone as being contrary to work but that person did not feel threatened. Following disciplinary proceedings, the employee was dismissed for making inappropriate comments with the potential to be threatening.

The company handbook indicated that an employee would, in cases of gross misconduct, be subject to summary dismissal for (amongst other reasons) posting on social networking sites derogatory or defamatory comments about the company or its customers or employees. There were similar restrictions within the social media policy. There was, however, some uncertainty as to whether the employee had previously received the handbook with the relevant section about gross misconduct.

The employee had about 200 friends on Facebook, around 45 or 50 of which worked at the organisation, and there were no security settings restricting access to the posts. The employee had not listed his place of work on his page. It was therefore raised that other friends may not know where he worked and that the comments could have related to other jobs listed on Facebook. During the disciplinary process, the employee did not show remorse but was aware that no one had been threatened individually.

Although there was misconduct, the Tribunal considered that the employee’s actions were not threat to business and it was not within range of reasonableness to dismiss him. The employment relationship not so undermined that he could not work there.

(g) Whitham v Club 24 Ltd (t/a Ventura)9 (2010)

In this case, an employee’s dismissal for Facebook posts was held to be unfair. One factor in support of this was that the social media policy was insufficient to restrict the relevant social media activities.

The employee was employed as team leader for a company which worked on the same site as one of its clients. After a difficult day at work she posted a comment on Facebook which said “I think I work in a nursery and I do not mean working with plants”. There followed a number of comments by other employees and team members, and a particular comment from a former team which referred to working with “planks” to which the employee responded “2 true xx”. Two Facebook friends who were managers reported the posts to the company, and it was also reported to the client. Following disciplinary proceedings she was dismissed.

The employee’s Facebook profile indicated where she worked (although was slightly inaccurate as it referred to the client) although it was raised that this is not necessarily seen by people reading the post, and the language used in the post did not refer specifically to the client.

In relation to policies, the company referred to their rules on confidentiality, email and internet use. These included a statement referring to confidentiality outside the work place, which indicated that posting information about the job on the internet including social networking sites such as Facebook and Myspace may lead to disciplinary proceedings and/or dismissal. However, these provisions appeared to be trying to prevent are breach of confidence rather than the type of Facebook communication in hand.

The Tribunal considered that dismissal had not been a reasonable response in all the circumstances and was therefore unfair. It is worth noting that several other factors contributed to this conclusion, including a lack of certainty in the investigation, no actual evidence of embarrassment or harm and other mitigating circumstances for the employee.


2 [2014] UKUT 0339 (AAC)

3 in accordance with section 40(2) of the Freedom of Information Act 2000

4 ET/2104806/10 (2011)

5 [2012] EWHC 3221 (Ch)

6 [2014] UKEAT0188/14

7 ET/2503016/2012

8 ET/1200504/2012

9 ET/1810462/2010

Olivia Whitcroft, principal of OBEP, 16 February 2015

This article provides general information on the subject matter and is not intended to be relied upon as legal advice. If you would like to discuss this topic, please contact Olivia Whitcroft using the contact details set out here: Contact Details