Social Media and Employee Data Protection

Social media is becoming increasingly popular amongst employers and is used both for recruitment and to enhance the company’s reputation and visibility. However, alongside the numerous opportunities, there are also risks for employers when using social media, regardless of whether employees use them for work or personal purposes. This is because social media has a wide reach; published information spreads quickly and is difficult to delete. The posts uploaded there predominantly contain personal data as defined in Article 4 (1) of the GDPR – whether names and locations, hobbies, the content of communications, personal opinions or photos featuring identifiable individuals. Employers must therefore ensure the protection of personal data in their activities on social media. 

Background Checks during the Recruitment Process

Employers regularly tend to search for their applicants on social media platforms such as LinkedIn, Instagram or Facebook in order to assess their professional suitability and personality (so-called pre-employment screening). The subsequent collection and processing of personal data must be legitimised by a legal basis under Article 6 (1) of the GDPR. This sets out the conditions under which such research is permissible under data protection law.

Consent

Some posts on social media are published by the applicants themselves, which might lead employers to conclude that implied consent has been given. It should be noted, however, that under Section 26 (8) second sentence of the Federal Data Protection Act (BDSG), applicants are deemed to be employees; consequently, consent is only considered voluntary under the strict conditions of employee data protection set out in Section 26 (2) BDSG in conjunction with Article 6 (1) (a) of the GDPR. In particular, consent must be informed and relate to a specific purpose; however, the applicant may wish to use their LinkedIn profile solely for client contacts and not at all for job application purposes. For these reasons, the validity of consent in such cases is already undermined by the employer’s duty to provide information and the requirement for the declaration of consent to be in writing or in electronic form. 

Particularly in the case of public user profiles, applicants either do not find out at all, or only find out afterwards, that their user profile has been viewed. Some of the people who have viewed their user profile are anonymous – for example, on LinkedIn. But how should it be assessed if the applicant maintains a private user profile and accepts a networking or ‘friend request’ from an employer? Here, it is important to bear in mind the stricter regulations governing employee data protection, which stem from the hierarchical relationship between employer and employee. As the applicant might fear suffering disadvantages in the recruitment process if they do not accept a ‘friend request’ from a potential employer, it is difficult to justify that the consent was given voluntarily. (Implied) consent is therefore generally ruled out as a legal basis in such cases.

Necessity for the Decision on the Establishment of an Employment Relationship

A further possible legal basis is the pre-contractual stage or, more specifically, the establishment of an employment relationship. In this respect, the background check may be necessary for the decision on whether to establish an employment relationship under Article 6 (1) (b) of the GDPR in conjunction with Section 26 (1) of the BDSG. Similar considerations apply here to those regarding the right to ask questions during the recruitment process. The decisive factor is whether the results of the background check allow conclusions to be drawn about the applicant’s professional and personal suitability and whether they are in the employer’s legitimate, reasonable and protectable interest. 

With regard to Section 26 (1) of the BDSG, it must be assessed whether the search is necessary for the decision on whether to enter into an employment relationship. In this context, the applicant’s general right to privacy must be balanced against the employer’s interest in obtaining information about the potential employee.

In this context, consideration must be given to whether the social network is work-related or leisure-oriented. A social network is regarded as work-related if it is intended for the presentation of professional qualifications. For example, on LinkedIn, applicants present their CV or acquired skills in a similar way to how they would in their application portfolio. By contrast, leisure-oriented networks such as Facebook and Instagram tend to be used for private purposes. However, as social networks such as Instagram are increasingly being used to present oneself professionally, it is no longer possible to draw a clear distinction between professional and leisure-oriented social networks. Instead, the focus should be on the specific user profile. 

As information relating to the specific job can regularly be obtained from professional profiles, conducting research on such profiles will generally be easier to justify. Information from leisure-oriented user profiles could potentially be lawfully obtained if, for example in the event of doubts arising from the application documents, it provides insight into a lack of professional suitability – such as information regarding a civil service applicant’s membership of organisations hostile to the constitution or about criminal proceedings relevant to the role. In such cases, however, employers will regularly come across information whilst reviewing the user profile that says nothing about the applicant’s professional suitability and is of a private nature. Such data is generally not relevant to specific job roles in a recruitment process; furthermore, its accuracy and quality are difficult to verify. For this reason, the State Data Protection Commissioner for Bremen points out in his guidance on researching applicants via social media and internet search engines that there are considerable doubts as to the necessity of such research. Furthermore, it is generally reasonable to expect employers to collect the data directly from the data subject. 

It should therefore be noted that the necessity of searching leisure-oriented social media profiles can generally hardly be justified. In the case of work-related profiles, however, a link to the specific job – and thus the necessity – can be more easily justified if, for example, the aim is to uncover discrepancies found in the application documents. The lawfulness must therefore always be assessed on a case-by-case basis. 

Information Obligations and other Data Protection Obligations

If an employer decides to carry out a background check on an applicant within the limits permitted by data protection law, they are in any event obliged under Article 14 of the GDPR to inform the applicant about the data processing involved in the background check. 

Employer Branding

Social media is frequently used by employers for employer branding – that is, as a strategic corporate measure which, by applying methods and concepts from marketing and brand building, aims to present a company as a whole as an attractive employer, thereby setting it apart from its competitors in the labour market. To ensure successful employer branding, a company’s own staff are often deployed as ambassadors for the employer brand. To this end, either information about the employees is published, or they are encouraged to engage on social media themselves in the company’s interests. It is problematic, however, if employees make negative comments about their employer on their private user profiles, particularly as social media platforms are known for their wide reach and rapid dissemination of information. 

Activities on the Company Profile

The publication of personal data is not an issue if it is necessary to fulfil employment obligations, such as the contact details of employees who have external contacts. All other data – such as staff photographs or birthdays – requires consent. 

Activities carried out by Employees in Accordance with Instructions

If the employer designates a user profile for the company as a work tool – either by paying the membership fees or by providing a digital device – the activities of the employee who merely manages the user profile are subject to the company’s instructions under Section 106 of the German Trade Regulation Act (GewO). However, this right to issue instructions only extends to the extent that there is a business-related connection. It stands to reason that employers should inform their employees about the legally compliant use of social media.

Conversely, an employee cannot be obliged to use a user profile in their own name for business purposes. The employee’s right to informational self-determination and freedom of expression are likely to conflict with the employer’s interest in corporate representation.

Employees’ Private Activities

Employees’ private user profiles are exempt from the employer’s right to issue instructions under employment law and are protected by the freedom of expression. Consequently, the employer must, in principle, also accept critical comments or negative reviews. Nevertheless, the employee is subject to duties of consideration under Section 241 (2) of the German Civil Code (BGB) in the form of duties of fidelity and loyalty. The specific nature of the employee’s user profile also plays a role in assessing whether comments are offensive – for example, whether the user profile is set up as public or private, how many ‘followers’ the profile has, and whether these include colleagues, customers or suppliers. 

Furthermore, employees may post photographs depicting company premises or colleagues, or which are otherwise related to the working environment. The decisive factor here is not only whether personal rights and copyright have been infringed, but also whether contractual or statutory duties of confidentiality have been breached. Offensive comments or photos that reveal a connection to the company may convey content that is defamatory and reprehensible. The consequences under employment law can range from claims for damages, injunctions or removal of content to (extra)ordinary dismissal. However, employers should bear in mind that the proportionality of dismissals is always assessed on a case-by-case basis. 

Admissibility of Evidence obtained through Access to Social Media Platforms

In legal proceedings, prohibitions on the use of evidence can pose an obstacle for the employer, who bears the burden of proof and must present the case. This may be the case if the content was visible only to ‘followers’ and the employer accessed it surreptitiously. However, once the posts have been published on a public user profile, they are no longer considered confidential communication and there is not necessarily a prohibition on the use of evidence. The same applies if employers, colleagues or third parties – who inform the employer about the post – are among the ‘followers’. Even a mere breach of data protection law without a serious infringement of personal rights is, in the view of the Federal Labour Court (BAG), insufficient to justify a prohibition on the use of evidence. The court ruled that recordings from open CCTV surveillance on the factory premises may be admitted as evidence, even though the employer had failed to fulfil its data protection information obligations due to the absence of notice signs (BAG, decision dated 29.06.2023 – Ref.: 2 AZR 296/22).

Social Media Policy

To counter the risks associated with the use of social media, an internal company policy may be advisable. This should not only clarify the protection of trade secrets, but also the protection of personal data belonging to customers, suppliers or colleagues. 

Contents of the Policy

It is possible to specify the standard communication channels for business-related contacts in accordance with data protection requirements and to prohibit the use of certain social media platforms for communication with customers or business partners in a work-related context. Taking employer branding into account, the usage policy may also stipulate that employees must distinguish between the expression of personal opinions and actions undertaken on behalf of the company when active on social media, and make this clear to other users. By opening up internal channels for feedback, potentially reputationally damaging statements on social media can be avoided by encouraging employees to address their concerns directly to the relevant contacts within the company. 

Following the Termination of Employment

Another aspect requiring regulation is the handover of customer data stored on a work-related user profile following the termination of employment. If the profile is a company profile that was managed solely by the departing employee, the profile must be handed over to the company. In such cases, it is advisable to change the login details afterwards. 

Conclusion

When researching applicants, employers should not assume implied consent even if the applicant accepts their ‘friend request’. However, under certain circumstances, such research may be necessary for the decision on whether to establish an employment relationship. The decisive factor is whether the applicant’s user profile is work-related and whether the information published there allows conclusions to be drawn about their professional suitability, and whether the applicant would be required to answer a corresponding question truthfully in a job interview; the relevant research must be necessary for the establishment of the employment relationship, which must be assessed on a case-by-case basis. In the event of such data processing, the information obligations under data protection law should be fulfilled.

Social media platforms are frequently used by employers for employer branding purposes. Where a user profile is provided by the company as a work tool, the employee managing it must act in accordance with the employer’s work-related instructions. An employee cannot be obliged to register a user profile in their own name. The employer has no influence over private activities and must, as a matter of principle, respect their employees’ freedom of expression. In return, however, the employee must also act in accordance with their duties of fidelity and loyalty under employment law when making private statements on social media. The legal framework sets a limit on such activities, for example where statements may be classified as insults. According to case law, prohibitions on the use of evidence should not stand in the employer’s way, at least where the party has no legitimate interest in the processing of data that goes beyond merely proving the facts put forward. 

For these reasons, it is advisable to inform employees about data protection-compliant use of social media and the potential consequences under employment law. Internal company policies enable employers to establish transparent and clear rules on the use of social media, to protect the security of personal data, to prevent damage to the company’s reputation caused by employees, and to safeguard important customer data in the event of the termination of employment of the employee who managed the company profile.