Privacy is dead the birth of social media background checks

Privacy is Dead: The Birth of Social Media Background Checks Sherry D.. With a recent “stamp of approval” by the Federal Trade Commission FTC, credit reporting agencies CRA may also gath

Privacy is Dead: The Birth of Social Media Background Checks

Sherry D Sanders*

“Privacy is dead, and social media hold the smoking gun.”1

INTRODUCTION

Many people believe social media background checks are today‟s weapon in the murder

of privacy.2 These background checks are a one-stop shop for anyone eager to dig up incriminating evidence on another person Consider the following scenarios:

1) Prospective employee one and a friend return to his car after an exciting night out on the town As the designated driver, he drank only soda and water while his friend partied like

it was 1999 As he enters the car, his friend hands him an empty beer container and snaps

a picture The friend later posts the picture on Facebook Does this make prospective employee one a drunk driver?

2) An imposter hacks into prospective employee two‟s Twitter account As he peruses her profile, the anonymity and thrill of expressing his ideas without punishment guide his hands as he types away on the keyboard He tweets comment after comment filled with profanity and derogatory statements about blacks and Mexicans One tweet calls for all blacks to return to the motherland so the U.S crime rate can decline Prospective

*

Sherry Sanders, 2013 J.D Candidate, Southern University Law Center; B.J University of Texas at Austin Thanks

to Gail Stephenson, a professor at Southern University Law Center, Stefanie Lee, Renashia Mullin, Floyd Price, and Chauntelle Wood for their invaluable comments on this article

1 Mirna Bard, 99 Favorite Social Media Quotes and Tips, SOCIAL MEDIA (Apr 6, 2010),

http://www.mirnabard.com/2010/04/99-favorite-social-media-quotes-and-tips/ (quoting Pete Cashmore, Mashable CEO).

2 Kashmir Hill, Feds Okay Start-up That Monitors Employees‟ Internet and Social Media Footprints, FORBES, June

15, 2011, at 1, social-media-footprints-gets-gov-approval/

http://www.forbes.com/sites/kashmirhill/2011/06/15/start-up-that-monitors-employees-internet-and-employee two has not been on Twitter in months and has no idea her profile has been hacked Does this make her a racist?

Employers are no longer the only ones who may determine a current or prospective employee‟s fate with a click of the mouse and browse of a profile page With a recent “stamp of approval” by the Federal Trade Commission (FTC), credit reporting agencies (CRA) may also gather information about an employee from social networking sites (SNS), such as Facebook and Twitter.3 Based on the subjective judgment of a CRA or human resources employee, a prospective employee could hear “you‟re fired” before he even sets one foot in the office door

To add insult to injury, information posted on an employee‟s site within the past seven years is fair game.4 Although both employers and CRAs must comply with the Fair Credit Reporting Act (FCRA),5 this practice raises serious questions about invasions of privacy, inaccurate reporting

of information, and liability for all players involved in the practice

The purpose of this article is to look at the legal ramifications of social media background checks and show why this practice is detrimental to prospective and current employees The first section of this article will focus on the purpose of social media and the FCRA The second section will focus on what CRAs are reporting to potential employers and when they may be liable for inaccurate information due to their failure to use reasonable procedures The third section will look at employers and when their use of SNSs may be considered discrimination or

an invasion of privacy and how a failure to check these sites may result in a claim for negligent hiring Next, this article will focus on whether SNSs must abide by the FCRA, and if not, when

3 Jennifer Preston, Social Media History Becomes a New Job Hurdle, N.Y TIMES, July 21, 2011, at B1

4 Preston, supra note 3, at B1

5

Hill, supra note 2, at 2

they may be liable for invasions of privacy The final section will address whether employees may be guilty of contributing to an invasion of their own privacy

HISTORY

I THE BEGINNING OF THE END OF PRIVACY: THE BIRTH OF SOCIAL MEDIA

Social networking sites, such as Facebook, Twitter, and LinkedIn, have seen an increase

in usage over the past few years.6 Seventy-five percent of individuals between the ages of eighteen to twenty-four have a profile on a SNS.7 One-third of individuals between the ages of thirty-five to forty-four have an active account posted online.8 Additionally, nearly twenty percent of individuals between the ages of forty-five and fifty-four have a profile posted on a social network.9

The use of SNSs has expanded tremendously since SixDegrees.com, the first recognizable SNS, launched in 1997.10 A SNS is a service that allows “individuals to create a personal or business network.”11

Between 1997 and 2001, users were able to set up professional, personal, and dating profiles on various SNSs, such as “Friends, AsianAvenue, BlackPlanet, and MiGente.”12

Friendster was launched in 2002 to provide friends-of-friends with an avenue to meet, date, and become romantic partners.13 Since 2003, new SNSs have continuously launched

6

Jordan B Yeager & Ronalyn K Sisson, USER BEWARE: Maximizing the Possibilities, Minimizing the Risks of

Using Social Media, 33-OCT Pa Law 26, 26 (2011)

7 JAY E GRENIG & JEFFREY S KINSLER, HANDBOOK OF FEDERAL CIVIL DISCOVERY AND DISCLOSURE E-DISCOVERY AND RECORDS § 5:7 (West Group ed., 3d ed 2011), available at Handbk Fed Civ eDisc & Records § 5:7 (3d ed.).

8

Grenig, supra note 7

9 Grenig, supra note 7.

10 Danah M Boyd & Nicole B Ellison, Social Network Sites: Definition, History, and Scholarship, JOURNAL OF

COMPUTER-MEDIATED COMMUNICATION, (2007), available at

in an attempt to replicate earlier successful SNSs.14 Users of these online sites are able to (1) create a public or semipublic profile, (2) assemble a network of friends, and (3) post comments, messages, images, and videos to their page.15 Flickr allows users to share photos, Last.FM provides users with a forum to share music, and YouTube is designed to share videos.16

MySpace launched in 2003.17 MySpace was unique because it allowed users to personalize their pages and add features based on demand.18 MySpace became a global phenomenon as it became popular with teenagers.19 In 2004, Facebook launched; however, it was designed for use by college students only.20 Facebook expanded its services to include high school students in 2005.21 Eventually, everyone was allowed access to Facebook in 2006.22 As the number of people using SNSs continues to climb, privacy concerns have become the focus of much of the press coverage of SNSs.23 Many people are concerned with whether the Fourth Amendment to the United States Constitution covers invasions of privacy via SNSs.24

Two recent cases accused Facebook of invading the privacy of its users; these claims have been brought under the Federal Wiretap Act.25 The court in In re Facebook Privacy

Litigation held that users of Facebook‟s networking site could not recover under the Wiretap Act

because the Act clearly states that “an entity providing an electronic communication service to the public shall not intentionally divulge the contents of any communication…to any person or

14 Boyd, supra note 10

15

Funk, supra note 11, at 8.

16 Boyd, supra note 10.

17 Boyd, supra note 10.

18 Boyd, supra note 10.

19

Boyd, supra note 10.

20 DAVID KIRKPATRICK, THE FACEBOOK EFFECT: THE INSIDE STORY OF THE COMPANY THAT IS CONNECTING THE WORLD 30-31 (Simon & Schuster Paperbacks 2010).

21 Kirkpatrick, supra note 20, at 16

22

Kirkpatrick, supra note 20, at 16

23 Boyd, supra note 10

24 Boyd, supra note 10.

25 In re Facebook Privacy Litig., No C-10-02389-JW, 2011 WL 2039995, at *1 (N.D Cal May 12, 2011); Bill Lodge, BR class-action suit targets Facebook, THE ADVOCATE, October 11, 2011, at 1A

entity other than an addressee or intended recipient of such communication.”26

The court concluded that the plaintiffs failed to prove that Facebook intentionally provided advertisers with users‟ information.27

Additionally, a resident of Baton Rouge, Louisiana, recently filed suit against Facebook alleging that Facebook is violating the Federal Wiretap Act and other laws “by collecting information on users‟ Internet habits.”28

A court ruling has not yet been reached in this case

As the debate over what constitutes an invasion of privacy continues, it is obvious that the use of SNSs has expanded from its original purpose of uniting people with similar interests Although initially SNSs were designed around online communities, the focus now revolves around the individual, who is at the center of his own community.29 This new structure has been referred to “egocentric networks.”30

Networks focused solely on one individual provide others with the unique and easy opportunity to conduct research on a particular person and potentially dig up incriminating evidence on that person

II THE FCRA AND THE ATTEMPT TO BREATHE NEW LIFE INTO PRIVACY

This section will first look at the important aspects of the FCRA and will then focus on how the courts have interpreted the statute

A Important Provisions Governing CRAs and Employers

On October 26, 1970, Congress passed the FCRA.31 The purpose of the Act is to promote fairness and accuracy in credit reporting.32 Consumer CRAs play an important role in

26 In re Facebook Privacy Litig., 2011 WL 2039995, at *5

27 Id

28

Lodge, supra note 25, at 1A

29 Boyd, supra note 10

30 Boyd, supra note 10

31 Fair Credit Reporting Act, 15 U.S.C § 1681 (2010)

32

§ 1681

“assembling and evaluating” a consumer‟s credit, as well as other information gathered on a consumer.33 It is the responsibility of CRAs to respect consumer privacy and ensure that they are fair and impartial when gathering and reporting information to others.34 All “reasonable procedures” must be used to assure the accuracy of the information reported.35

Information may be assembled on a consumer bearing on his credit, character, reputation, personal reputation, and mode of living.36 This information may be used for employment purposes in order to evaluate a consumer for employment, promotion, reassignment, or retention

as an employee.37 A CRA may provide an employer with a credit report containing information about a prospective or current employee only if the employee is informed in writing that a background check may be obtained for employment purposes.38 The employee must authorize consent to the background check in writing.39 If the employee will be denied employment or fired based on the information assembled, the employee must be provided with a copy of the report and a document outlining the employee‟s rights under the FCRA.40

A CRA may report information that includes up to seven years of adverse information.41 If a CRA willfully or negligently violates the FCRA, it will be liable to an individual for damages.42

B Federal Court Cases Interpreting the FCRA

1 Appropriate Use of Consumer Report for Employment Purposes

Section 1681b(b)(2)(A)(i) provides that an employer may conduct a background check on

an employee for employment purposes if the request is made in writing “at any time before the report is procured.”43

In Kelchner v Sycamore Manor Health Center, the Third Circuit held that

the phrase “at any time before the report is procured” is unambiguous and clearly means a report may be obtained at “any time during the employment relationship.”44

This means that an employer is authorized to acquire an individual‟s credit report based on a blanket one-time authorization form.45 Additionally, no provision in the FCRA prohibits an employer from firing

or disciplining an employee who refuses to allow an employer to procure his credit report.46

2 CRA‟s Liability for Inaccurate or Unverifiable Information

Many courts allow CRAs to use the “technically accurate” defense to avoid liability, because there is no requirement of “maximum possible accuracy” under section 1681e(b).47

However, in Koropoulos v Credit Bureau, Inc., the Court of Appeals for the District of

Colombia rejected the technically accurate defense.48 The court instead conducted a balancing test to determine whether there was a 1681e(b) violation.49 The court weighed the possibility of the information leaving a misleading impression on the recipient against the availability of accurate information and the burden on the CRA to obtain this information.50

48 Vanderwoude, supra note 47

49 Koropoulos v Credit Bureau, Inc., 734 F.2d 37, 42 (D.C Cir 1984)

50

Id

3 Willful and Negligent Violations of the FCRA

Section 1681n(a) provides that a person is liable for damages caused to another if he willfully fails to comply with the FCRA.51 A CRA willfully violates the FCRA when it

“knowingly and intentionally commit[s] an act in conscious disregard for the rights of others.”52

In Saenz v Trans Union, LLC, the court adopted the Third Circuit‟s mens rea requirement to

determine what level of intent a CRA must possess to prove it willfully failed to comply with the statute.53 The Saenz court held that a CRA acts willfully when it consciously or recklessly

disregards the law.54 Willful has also been interpreted to mean “deliberate and purposeful.”55 A showing of actual “malice or evil motive” is not a requirement for recovery under 1681n.56

Willful violations typically occur where a CRA intentionally misleads or conceals information from an individual.57 However, the failure of a CRA to delete incorrect information after it has been reported or the insertion of inaccurate information after it has been deleted does not give rise to liability for a willful act.58

In addition, section 1681o(a) provides that a CRA is liable for damages to another if it negligently fails to comply with the FCRA.59 In order to prevail against a CRA for negligence, four elements must be proven: “(1) inaccurate information was included in a consumer's credit report; (2) the inaccuracy was due to defendant's failure to follow reasonable procedures to

51

§ 1681n(a)

52 Pinner v Schmidt, 805 F.2d 1258, 1263 (5th Cir 1986)

53 Saenz v Trans Union, LLC, 621 F Supp 2d 1074, 1086 (D Or 2007)

54 Id

55

Casella v Equifax Credit Info Servs., 56 F.3d 469, 476 (2d Cir 1995)

56 Bakker v McKinnon, 152 F.3d 1007, 1013 (8th Cir 1998)

57 Reed v Experian Info Solutions, Inc., 321 F Supp 2d 1109, 1116 (D Minn 2004)

58 Id

59

§ 1681o(a)

assure maximum possible accuracy; (3) the consumer suffered injury; and (4) the consumer's injury was caused by the inclusion of the inaccurate entry.”60

In Thompson v San Antonio Retail Merchants Association, the Fifth Circuit held that the

reasonable procedures made by a CRA to ensure the accuracy of the information it publishes is judged based on what a reasonably prudent person would do under the circumstances.61 The failure of a CRA to maintain reasonable procedures under section 1681e(a) is an important element that must be proven before a plaintiff can bring an action for negligence A plaintiff would have to show that a CRA used information about the plaintiff for an impermissible purpose,62 or it must be shown that there was a systematic error.63 There is a systematic error when the mistake occurs repeatedly

Section 1681b(a) provides a list of permissible purposes of consumer reports.64 Included

as a permissible purpose for furnishing a third party with an individual‟s consumer report is if the information will be used for employment purposes.65 If a CRA discloses information to a third party for a permissible purpose, there will be no further discussion into whether the CRA‟s procedures were reasonable.66 Therefore, a plaintiff should not attempt to bring an action about the reasonableness of a CRA‟s procedures if their disclosure is for a permissible purpose as outlined in section 1681b.67 Additionally, a CRA may also be able to avoid liability for an

63 Ruth Desmond, Consumer Credit Reports and Privacy in the Employment Context: The Fair Credit Reporting Act

and the Equal Employment For All Act, 44 U.S.F L Rev 907, 922 (2010)

inaccurate report by showing that it followed all reasonable procedures to ensure that the information was correct.68 Many circuits leave the reasonableness question up to the jury.69

4 Invasion of privacy/discrimination

The use of credit reports for employment purposes is not a discriminatory employment practice.70 Bringing an action under the FCRA can serve two purposes: 1) ensuring the accurate reporting of information, and 2) protecting an individual from unlawful invasions of privacy.71Section 1681h(e) provides that no action may be brought for invasion of privacy against a person who supplies information to a CRA, unless it involves “false information furnished with malice

or willful intent to injure” a consumer.72

This provision means that if a company provides a CRA with credit information about a consumer, the company is protected from invasion of privacy claims unless it furnishes both false information and the information is given with “malicious or willful intent to damage the consumer.”73

DISCUSSION

During the summer 2011, the Internet was buzzing after learning from an FTC letter that CRAs may conduct background checks on potential and current employees via SNSs The letter stated:

The staff of the Federal Trade Commission‟s Division of Privacy and

Identity Protection has been investigating Social Intelligence

Corporation („Social Intelligence‟), an Internet and social media

68 Guimond v Trans Union Credit Inf Co., 45 F.3d 1329, 1333 (9th Cir 1995)

69 Guimond, 45 F.3d at 1329 (“The reasonableness of the procedures and whether the agency followed them will

be jury questions in the overwhelming majority of cases.”); Cahlin v General Motors Acceptance Corp 936 F.2d

1151, 1156 (11th Cir 1991) (“The agency can escape liability if it establishes that an inaccurate report was

generated by following reasonable procedures, which will be a jury question in the overwhelming majority of cases.”); Dalton v Capital Associated Indus Inc., 257 F.3d 409, 416 (4th Cir 2001) (“The issue of whether the

agency failed to follow „reasonable procedures‟ will be a “jury question[ ] in the overwhelming majority of cases.”)

70 Pettus v TRW Consumer Credit Serv., 879 F Supp 695, 698 (W.D Tex 1994)

71 Myers v Bennet Law Officers, 238 F.3d 1068, 1074 (9th Cir 2001)

72 § 1681h(e)

73

Lofton-Taylor v Verizon Wireless, 262 Fed Appx 999, 1002 (8th Cir 2008)

background screening service used by employers in pre-employment

background screening The reports sold by Social Intelligence include

public information gathered from social networking sites Our

investigation aimed to determine the company‟s compliance with the

Fair Credit Reporting Act („FCRA‟)….We have completed our

investigation and determined that no further action is warranted at this

time.74

After this statement, articles were published in newspapers, magazines, and online indicating that the FTC had given CRAs the okay to proceed with conducting background checks on Facebook, Twitter, and MySpace So, what does this mean?

A PRIVACY IS DEAD, AND CREDIT REPORTING AGENCIES ARE NOW A PRINCIPAL TO MURDER

The company at the forefront of the social media background check practice is Social Intelligence.75 Social Intelligence generates reports for employers with both negative and positive information from SNSs.76 Information that would be reported as negative includes: illegal activity such as drug use, racist remarks or participating in racist activities, and sexually explicit videos or photos.77 Positive examples include donating time for charitable or volunteer activities, participating in industry blogs, and receiving external awards or recognition.78 Social Intelligence indicates on its website that it runs a new background check on employees each time

74 Letter from Maneesha Mithal, Assoc Dir., Federal Trade Commission Division of Privacy and Identity

Protection, to Renee Jackson (May 9, 2011) (on file with the Federal Trade Commission) available at

http://www.ftc.gov/os/closings/110509socialintelligenceletter.pdf

75

Mithal, supra note 74

76 Social Intelligence, http://www.socialintel.com/social-media-employment-screening/ (last visited Jan 7, 2012)

77 Sean Charles, Social Intelligence: What It Is And Why It Matters, Social Media Sean (Oct 16, 2011),

http://www.socialmediasean.com/2011/10/16/social-intelligence-what-it-is-and-why-it-matters/

78

Charles, supra note 77

it is requested.79 Although Social Intelligence must store the information for seven years, as required by the FCRA, it provides that this old information is not reused.80

As Social Intelligence and other CRAs attempt to comply with the FCRA while gathering information from SNSs, questions arise regarding the accuracy of the information reported as well as when can CRAs be liable for negligent reporting The two hypotheticals mentioned earlier both include instances where a mere glance at a picture or profile page may not reveal the truth A potential employee‟s career may lie in the hands of the subjective judgment of someone hired by a CRA to conduct research If prospective employee one misses out on his opportunity

to become a truck driver because a picture on Facebook appears to paint his as a drunk driver or prospective employee two is not hired at a firm because her Twitter account contains racist statements, what can be done?

1 When Is a CRA Liable for Inaccurate Reporting?

The purpose of the FCRA is to protect consumers; however, the FCRA may not be as helpful in the employment context.81 A 2004 report found that twenty-five percent of credit reports surveyed included serious errors that could result in the denial of credit or employment.82Seventy-nine percent of the credit reports surveyed included either serious errors or other mistakes of some kind.83 Few cases have provided relief to consumers for inaccurate reporting,

but in Koropoulos v Credit Bureau, Inc the U.S Court of Appeals for the District of Columbia

79

Social Intelligence, Does Social Intelligence store information about job applicants that can potentially be used

against them on future job hunts,

http://www.socialintel.com/faqs/#does-social-intelligence-store-information-about-job-applicants-that-can-potentially-be-used-against-them-on-future-job-hunts (last visited Jan 7, 2012)

80 Social Intelligence, supra note 79

81

Ruth Desmond, Consumer Credit Reports and Privacy in the Employment Context: The Fair Credit Reporting Act

and the Equal Employment For All Act, 44 U.S.F L Rev 907, 916 (2010)

82 ALISON CASSADY & EDMUND MIERZWINSKI, MISTAKES DO HAPPEN: A LOOK AT ERRORS IN CONSUMER CREDIT REPORTS 4 (Nat‟l Assoc of State PIRGs ed 2004)

83

Cassady, supra note 82