Some things you may not know… Under the default settings, when a person tags you in a status update this will appear on your profile. Therefore you may want to consider using the new tag/post review features in order to allow you to choose whether it makes it onto your wall or not. The default settings are set to “off”. When someone tags you in a post, it will be that person’s privacy settings that have final say over what is visible unless you specifically adjust the settings pertaining to posts you are tagged in. So make sure you personalize your privacy settings individually, because a “one size fits all” approach may not be in your best interests.

Do these changes require you to revisit your privacy settings? Your privacy settings should not have changed from what they were before, however some simplifications have been made. Therefore it is important that you check your settings to see what settings are now controlled “inline” (again, meaning adjustable for each separate post whether it be a picture, post or other information) and make sure that these inline controls are by default set to what you want.

What should you be doing moving forward? It is important to remember that Facebook is continually updating its layout, and this includes its privacy templates. While users should not fear that their settings will completely reset each time such changes occur, they should keep a close eye on new features that may (1) replace an existing feature; (2) remove an existing feature entirely; or (3) introduce something entirely different, which might require some tweaking from its default settings.

I’m delighted to let you know about a cool feature on Pitblado’s new website called the “Whiteboard Sessions”, which are vlogs (or video blogs). We’ve just posted a 3 minute vlog of mine entitled “Are you a spammer?“, wherein I discuss:  

• highlights of the new law
• why you should care 
• an overview of the rules  
• penalties for non-compliance; and
• proactive tips to help comply with the law

To watch “Are you a spammer?” please click here>>

Other related blog posts include Employee monitoring in today’s workplace and Social media: Is your organization’s head in the sand?

If you know of other similar articles that can help business professionals to better manage their social media activities, please share by posting a Comment below. Thanks! And thanks to my colleague, Mark Wallace, for the head’s up about the Accountingweb article.

Doing the presentation made me think that it might help your organization to highlight the following previous posts… Hope they help!

• Social media: Is your organization’s head in the sand?
• Social Media and the Workplace webinar: Watch now!
• Employee monitoring in today’s workplace
• Adam Herstein’s excellent post called That’s Just Not Acceptable – Acceptable Use Policies in the Workplace

If your answer is “no” you’re wrong. Sorry, but it was a trick question. Whether your organization admits it or not, it is in the social media world.  Clients, prospective clients, employees and even competitors are almost certainly engaging in conversations about your organization on Facebook and LinkedIn. The question is whether you’re a part (or even aware) of those conversations. The second question is what are you going to do to shape those conversations, to the extent that you can?

The reality is that Canadian employees, for example, are blogging, tweeting and accessing social networking websites with increasing frequency. And the result is increased legal risks for Canadian businesses. These risks include disgruntled employees intentionally revealing trade secrets, defaming supervisors, harassing co-workers, or posting negative information about their employers’ business. There are even additional threats resulting from loyal employees who inadvertently disclose information online that runs afoul of privacy and competition laws. These threats won’t go away if your company has its head in the sand regarding social media.

One important step to dealing with and leveraging social media is to implement a social media policy within your organization. Doing so won’t address every potential headache related to social media, but it will help to manage online discussions that are occurring during and after work hours by your own employees. And since some of the greatest risks I’ve mentioned above stem from your employees, my best advice is to implement a social media policy. Key components in a social media policy should include:

• defining the scope of prohibited activities;
• clarifying to whom the policy applies;
• addressing how infringing content should be removed from social media sites;
• spelling out who, when and how monitoring of social media sites occurs; and
• advising of penalties and enforcement of the policy.

No one knows more detailed personal information about you than your Facebook friends. So do we need new privacy laws to protect you from violations perpetrated by other individuals? Read more>>

One of the big issues in the case related to whether or not the Charter applies to universities.  The University argued that the Charter only applies to government institutions and did not apply in this particular case because the University is not part of the government and was engaged in regulating its own internal affairs when disciplining the students.  Earlier court decisions have left open the possibility that the Charter might apply to subordinate bodies created and supported by the government, including “many forms of delegated legislation, regulations, orders in council, possibly municipal by-laws, and by-laws and regulations of other creatures of Parliament and the legislatures”.  In this particular case, the court declared that “the University is not a Charter free zone”.  As a result, and considering the particular facts of this case, the court ruled that the students’ Charter rights were infringed by the manner in which they were sanctioned for their online behavior.  A University spokesman has indicated that its legal staff will review the decision to determine whether there will be an appeal.

Canada’s privacy community will know that Commissioner Denham brings to her new role a wealth of experience and accomplishment. Her resume includes Assistant Privacy Commissioner of Canada and Director, Private Sector, for the Office of the Information and Privacy Commissioner of Alberta. I’ve had the pleasure of knowing Commissioner Denham for some time and have always appreciated her practicality and great sense of humour. B.C. will undoubtedly be well-served.

Of course, I’d like to thank Commissioner Denham for agreeing to engage in this online conversation.  If you’d like to learn more about Elizabeth Denhem or B.C.’s Information and Privacy Commissioner’s Office (“OIPC”), I’d encourage you to visit the OIPC’s website (www.oipc.bc.ca).

Q – You served as Assistant Privacy Commissioner of Canada until being appointed BC’s Information and Privacy Commissioner in July 2010. How are things going in your new role?

A – It is a good thing that I am a recreational runner, because I have certainly hit the ground running! This is an extremely busy office, due to the scope and nature of the work and to the fact that I have inherited one of the leanest oversight agencies in the country. I am very lucky to have a team of hardworking, enthusiastic and seasoned professionals to support me.

While I do have “in the trenches” FOI experience, that was more than 10 years ago, forcing a quick re-immersion into the duties of ensuring accountable and transparent government. Since my appointment I have issued a report on the timeliness of government responses to access requests, worked on a strategy for government-wide proactive disclosure and executed our annual tribute to open government, Right to Know Week.

However, in my view the biggest challenge facing me in this term is public sector privacy issues. The government has ambitious plans for data sharing across ministries, to create linked electronic databases. It is my immediate priority to ensure that privacy is baked into BC’s e-government programs, including e-health.

Q – I’ve long considered BC one of the most progressive privacy jurisdictions in Canada. How has this happened and what can other provinces/territories learn from BC’s privacy community?

A – I think there are a number of factors that has put BC out in front with respect to privacy. My two predecessors, David Flaherty and David Loukidelis, are without a doubt two of the top privacy experts, and their ability to break trail has benefited all of BC. The former Commissioners were very skilled at making privacy a common topic of discussion and spreading the word about privacy rights and obligations. BC also has active and engaged civil society pushing hard for access and privacy rights, and I am referring to the BC Freedom of Information and Privacy Association as well as the BC Civil Liberties Association as key thought leaders. Finally, the citizens of BC have a reputation for being politically aware and engaged, and unafraid to bring burning issues to the forefront. I think the key learning outcome for other jurisdictions is work hard at capacity building and public outreach, and encourage other groups to actively enter the policy debates around access and privacy. We need other voices. Regulators cannot do it alone.

Q – Given that BC has a provincial privacy law (PIPA) that is “substantially similar” to PIPEDA, and considering that many readers of this blog are from outside BC (and Canada), can you briefly highlight the most important things that businesses should know about BC’s private sector regime?

I think the three most important points are these:

First, make sure you have a legitimate operational need to collect any personal information. This requires ongoing monitoring to ensure the operational requirement still exists, and routinely and safely purging personal information no longer required. Personal information is both an asset and a liability, and collecting and retaining personal information when no reason exists is a huge business risk.

Second, be transparent about what you are doing with the personal information you collect in the course of your operations, and ensure that anyone that you hire on your behalf behaves in the same manner.

Finally, data safeguards, or rather the lack thereof, remain the primary source of privacy breaches and a threat to your business brand. Safeguards are much more than passwords and locked cabinets—they include proper and ongoing staff training, privacy audits and assessing the privacy impacts of new policies, programs or services. Safeguarding personal information requires ongoing attention, and a willingness and ability to adjust the safeguard strategy when needed.

Q – Your work in the area of social networking as been outstanding, which in the case of Facebook resulted in a number of changes to the social networking site—changes that were implemented on a global basis. Some readers may presume that a privacy commissioner such as you wouldn’t use social networking sites. In my case, I’m active on LinkedIn. How about you?

A – I have several accounts with social networks, including Facebook and LinkedIn. I first joined the networks because I wanted to deeply understand the services, and their functionality; this was critical to my work. But Facebook also helps me keep track of my far-flung 20-something children who live their lives on-line! But I am a savvy consumer of these services, and obviously avail myself to all of the privacy controls they offer. I do not post anything on either of those sites that is not already publicly available or any information that I would not hesitate to make public. I am very careful before downloading any third party application—carefully scrutinizing their privacy policies beforehand.

Q - In your view, what kind of privacy developments should we watch for in the coming year in British Columbia?

A – On the government side, I think the primary issues will be an increase in the development of linked data networks containing personal information bringing risks to transparency, appropriate access, use and disclosure and a heightened risk of transmission of inaccurate and incomplete information.

On the private sector side, I know we will see more collaboration and cooperative oversight between the federal and provincial commissioners. New technologies and business models challenge the ability of any office to “go it alone”. Canada is a leading voice on privacy and new technologies. I look forward to working with my colleagues on smart, relevant and timely oversight.

Related information on this blog that may be of interest to you includes this audio link to my recent CJOB|68 radio interview with Human Resources specialist Barbara Bowes in which we discuss privacy issues in the workplace. You may also want to read this article I penned with my colleague Andrew Buck entitled Monitoring Employee Email: A Privacy Primer. And, of course, you can use the blog’s “Tags” to navigate to specific content of interest.

The “fuel” for many gadgets currently in the workplace is data, which may or may not relate to the employer. And I’m not just thinking of Smartphones provided by the employer.  I’m also thinking of social media websites such as Facebook and Twitter, which are often accessed after work hours on employees’ home computers.

What happens when an employer uses data gleaned from a company-owed iPhone or Blackberry to monitor an employee in the workplace? What about monitoring an employee’s Facebook page? After all, it’s not uncommon for information about an employer or its clients to appear on an employee’s Facebook page. Further, some employees have no second thoughts whatsoever about posting personal messages during paid company time. Many employers are introducing social media policies to mitigate the resulting legal risks. But how far should employers go to protect their interests?

Today’s post is the first in a series that I’ll publish in the coming weeks to provide you with an overview of legal developments regarding monitoring in the workplace, with a focus on employer monitoring of employee social media and Smartphone activities. Upcoming posts will also examine workplace privacy issues related to email, video and GPS monitoring. Stay tuned… 

In the meantime, click here to listen to my recent CJOB|68 radio interview with Human Resources specialist Barbara Bowes in which we discuss privacy issues in the workplace. You may also want to attend a complimentary Social Media in the Workplace webinar that I’ll be providing with a few of my colleagues next week (May 19th). Click here for info and to register (space is limited so register soon).

Yours truly was interviewed by Canadian Business Online for this article and, as you’ll see, I comment that I’m not aware of whether, or to what extent, the big banks and credit card companies are using personal information that’s publicly available on social networking websites to determine credit worthiness.  That being said, in the insurance industry “using information from social-networking sites has already become commonplace”. The message that I’d take from this article is that Canadians’ understanding of privacy, and the ground rules for managing publicly available personal information that we willingly post online, is rapidly evolving.  

Read the Canadian Business Online article here>.

I’ve previously commented on social networking websites and employer-employee relationships.  This BBC report is just one more example of a situation which may have been prevented with better employee training and a clear social networking policy.  Common sense should, and typically does, guide employees in determining what to post online. Yet, if an Israeli soldier can’t think twice before posting the details of a planned operation it’s easy to see how some employees of Canadian businesses – perhaps yours - unintentionally post valuable corporate information online.

The identities of the teachers have been widely reported. Now the question is: Could the teachers sue the students for violating their privacy?

Read more>>

While the OPC’s Facebook investigation should be a “must read” for all Facebook users, it also provides some insightful information for Canadian organizations regulated by PIPEDA. The lessons that can be learned from the investigation can be applied by Canadian businesses regardless of whether their activities are online or offline. 

Despite the fact that “[i]t’s clear that privacy issues are top of mind for Facebook…” federal Privacy Commissioner Jennifer Stoddart says that the OPC has found “serious privacy gaps in the way the site operates”. According to Stoddart, in order to comply with Canadian privacy law, Facebook must take greater responsibility for the personal information in its care.  An overarching concern of the OPC was that, although Facebook provides information about its privacy practices, it is often confusing or incomplete. For example, the “account settings” page describes how to deactivate accounts, but not how to delete them, which actually removes personal data from Facebook’s servers. The OPC recommends more transparency, to ensure that the social networking site’s nearly 12 million Canadian users have the information they need to make meaningful decisions about how widely they share personal information.

The investigation also raised significant concerns around the sharing of users’ personal information with third-party developers creating Facebook applications such as games and quizzes. (There are more than 950,000 developers in some 180 countries.) Facebook lacks adequate safeguards to effectively restrict these outside developers from accessing profile information, the investigation found. The report recommended a number of changes, including technological measures to ensure that developers can only access the user information actually required to run a specific application, and also to prevent the disclosure of personal information of any of the user’s friends who are not themselves signing up for an application.

The investigation also found that Facebook has a policy of indefinitely keeping the personal information of people who have deactivated their accounts, which is a violation of PIPEDA. The law requires organizations to retain personal information only for as long as is necessary to meet appropriate purposes. Recommendations to Facebook included the adoption of a retention policy whereby personal information in deactivated accounts is deleted after a reasonable length of time.

Click here to read the OPC’s News Release, here for the full investigation report and here to read a helpful backgrounder.  If you’d like to read more about Facebook, please click on the Facebook link under this blog’s Tags (below).

As I’ve previously discussed, Social networking websites such as MySpace and Facebook are provoking new questions about the appropriate boundaries in employee-employer relationships. This is evident in a United States Federal Court case coming to a head in New Jersey. The case pertains to the conduct of a manager who logged into a private social networking website and observed employees slandering company supervisors and customers. Those same employees were later dismissed. The case exemplifies a rapidly expanding “grey area” between an employee’s work life and personal social life. It begs the question, at what point does a “private” comment to friend made outside of the office constitute defamation, and at what point are such comments simply banter between individuals?  Of course, the answer is, it all depends on the facts. 

For an interesting discussion on the matter, check out Myrth on a Blog, a personal journal of law, technology and social media.

It’s been a thrilling week for my colleagues at Pitblado LLP as it was announced earlier this week that we were to be the 1st Canadian law firm to be a guest blogger on the must-read slaw.ca.  Yours truly, three of my colleagues from our firm’s Information & Ideas Practice Group as well as our firm’s librarian each contributed one post a day this week to slaw.ca on cutting edge legal topics.  Here’s what we covered…

On Monday, I posted “What Would Happen If One of your Employees Posted a Video of an Irate Customer on YouTube?”, which I cross posted on my blog earlier this week.  The post highlights a YouTube video of an irrate customer as a reminder to Canadian businesses of the powers of new technologies such as YouTube and the corresponding need to protect against the dissemination of this type of video through employee privacy training and the adoption and enforcement of privacy and procedures.

On Tuesday, Carol Lynn Schafer posted “Do TOS Have the Final Word on our Fundamental Rights and Freedoms?”, which discusses the controversial effects of Terms of Service on popular websites such as Facebook and Twitter.  As Carol Lynn notes, Terms of Service should be drafted with the bigger picture in mind and can no longer be seen as standard agreements that can be treated with a one size fits all approach.

On Wednesday, Jolin Spencer posted “Whose Property Is It, Anyway?”, which discusses the questions that come into play when employees leave their positions.  For example, what can an employee take, and what must they leave, when they vacate their position? As Jolin points out, no business wants its intellectual property assets walking out the door with a former employee.

On Thursday, our firm’s librarian, Karen Sawatsky, posted “Legal Research Bootcamp – Winnipeg Style”, which discusses her experience collaborating with members of the Manitoba Bar Association and the Law Society of Manitoba to create a CLE for articling students on legal research. The Legal Research Bootcamp is a first for Manitoba students, and aims to bridge the gap between when students start their articles and when CPLED begins in the fall.

And last but not least, today Adam Herstein posted “Manitoba: Innovative Fighter of Child Sexual Exploitation”, which focuses on Manitoba’s recent enactment of The Child and Family Services Amendment Act (Child Pornography Reporting) (Manitoba) and how Manitoba is the first province in Canada to enact legislation that makes it mandatory for a person who encounters child pornography to report it to authorities.  Adam also notes that Canada has a national tipline called Cybertip.ca for reporting the sexual exploitation of children.

Thanks to slaw.ca for the opportunity to contribute!

If you have children, I’d encourage you to visit the Internet 101 website, which provides some great information to increase your computer knowledge. The site provides excellent resources including Tutorials to help you learn more about the online world, Technical Tips to help keep your computer secure, Chat Lingo to help you learn the online lingo, Popular Online Activities to expose you to what today’s youth are doing online, and an Internet Agreement to be signed between parents and children to help your family stay safe in the online world.

Even if you don’t have children, there is some valuable information on the site worth reading.

The Lawyers Weekly

The “first wave” of privacy laws (such as the federal Privacy Act) were introduced decades ago to protect the privacy of individuals in respect of public sector government bodies. The “second wave” of privacy laws (such as PIPEDA) were introduced more recently to protect the privacy of individuals in respect of private sector businesses.  Arguably, the only missing link in this chain of privacy protection, and what could be the focus of a “third wave” of privacy laws, is protecting individuals from violations of privacy by other individuals in the non-commercial sphere.  My goal with the article was not to promote a “third wave” of privacy laws, but rather to engage Canadians in a debate about whether such laws are required. 

I hope you click here to read the full article! 

I also encourage you to share your thoughts on whether – in the era of Facebook and Twitter – the status quo is sufficient or whether a “third wave” of privacy laws are needed.

In general, the defamation (written and spoken) of a business occurs when a party lowers the reputation of a business in the estimation of other members of society or an industry.  Since a business doesn’t have “feelings”, defamation cases related to businesses focus on the damage to a business’ reputation or goodwill due to the comments of another party.   The following court cases are worth checking out, both of which confirm that a business can be defamed and, as a result, is entitled to receive monetary compensation.

In Barrick Gold v. Lopehandia, the defendant was found liable for a massive online defamation campaign initiated by the defendant against the plaintiff.  The defendant had posted comments on gold and mineral investor related online forums defaming the plaintiff.  The Ontario Court of Appeal noted that Internet defamation is different than traditional written forms of defamation since online defamation, or “cyber libel”, is often taken at face value, and is capable of instantly reaching an unlimited number of persons around the globe.  The plaintiff corporation was awarded $75,000 in general damages for damage to its reputation and goodwill, $50,000 in punitive damages, and a permanent injunction to prevent further postings.

In WeGo Kayaking Ltd. et al v. Sewid, the British Columbia Supreme Court awarded $250,000 in general damages to the plaintiff corporation in relation to “review” comments posted online that incorrectly and intentionally classified the plaintiff as a “bad” tour company.

Defamation doesn’t just happen to individuals.  These cases serve as a reminder to businesses that they are capable of being defamed and, as a result, should diligently protect their online reputations.

Website Terms of Use are important to read, especially if you’re then going to post information on or through the website.  If you’re a Facebook user, read its Terms of Use to determine if you actually agree to them.  If not, you may want to reconsider continuing to be a Facebook user or you may want to simply refrain from posting content that you don’t want to fall under the scope of its Terms of Use. 

If your business has a website, check to see if it has a comprehensive Terms of Use document that’s been customized accordingly. Terms of Use are vital documents for websites because they set out the ground rules regarding – among other things – the ownership of content, licence rights, use of the website by minors, user submissions/postings and intellectual property rights.  They are intended to serve as legally binding contracts between website operators and users, so they’re pretty important!

Facebook may have suffered a public relations setback last week, but for a commercial enterprise it was on the right path when it reviewed and tried to customize its Terms of Use to meet its business objectives.  All businesses that have websites should review and, if necessary, modify their Terms of Use on a regular basis.

Privacy ultimately your responsibility

My October 3, 2007 column in the Winnipeg Free Press emphasizes the importance of protecting your personal information by not handing it over to strangers, among other strategies.

Facebook website not all fun and games

My June 6, 2007 column in the Winnipeg Free Press examines the effect of access to social networking sites like Facebook have in the workplace.