Accounting for policy and legislative requirements

The following policy and legislative requirements are combined as they share commonality in the risk of non-compliance. The changing nature of social media and the myriad of applications requires that each case be assessed on it merits as well as the terms of use for the chosen social media tool at the time. The recommendations in these guidelines are provided for consideration and agency legal advice should be sought as part of the business case for establishing an official social media channel.

Information security

Information Security is a necessary part of managing any use of social media in Queensland Government departments. Information Standard: Information Security (IS18) requires that agencies employ an approval mechanism to control the access of official personnel representing the agency through its official social media accounts. It is recommended that a central register of official social media accounts be maintained including the accounts purpose and the officers with access permission. It is also recommended that agencies nominate a central contact point for social media matters.

All social media planning should be done in accordance with the departments Information Security and Information Management policies and procedures.

Potential risks

• Sharing your personal login details with others.

Avoiding security

• Implement tools that allow multiple personnel to access the same account.

Intellectual property infringement

The term 'intellectual property' covers the various legal rights to protect the result of original and creative effort. Intellectual property created by a Queensland Government agency representing the state, is owned by the State of Queensland, rather than by a particular agency. However, if an agency has a 'beneficial use' delegation an agency may authorise reproduction/use of the intellectual property that it creates.

Potential risks

• re-tweeting or sharing content without acknowledgement to the original author
• posting photos to Flickr or Facebook without consent from the agency, participants or photographercopying work such as songs, articles, movies, or software, from a source without being authorised to do so is a breach of intellectual property
• posting government content on social media sites whose terms of service do not comply with government policy
• social media sites may have royalty-free licence on intellectual property to use, copy, reproduce, adapt, modify, publish, transmit, display and distribute your content.

Avoiding intellectual property infringement

• complete the Intellectual Property online training course to understand intellectual property policies and guidelines
• produce content specifically for social media sites – if choosing to post government content on social media sites, be mindful of the potential conflict between the site's terms of use and the intellectual property requirements
• do not post third party information without permission or licence – where the third party has provided permission, check the permission is broad enough to cover posting to social media
• if in doubt, contact the Crown Copyright Administrator via email.⁵

Misrepresentation

Misrepresentation is the giving of false information by one party to the other before the contract is made, which induces them to make the contract. The false statement must be one of fact, as opposed to a statement of opinion or a promise. A misrepresentation is innocent where the trader believes that the statement she or he is making is true and consequently has no intention to deceive the buyer. It is fraudulent where the trader makes the statement knowing it to be false or without believing in its truth, or without caring whether it is true or false. In that case, the maker may be guilty of the offence of fraud as well as misrepresentation⁶.

Potential risks

• By unknowingly providing misleading information online which encourages followers, fans or subscribers to enter into a contract for participation or purchase of a product or service.
• For example, conducting an online competition to encourage the public to sign up to a new government initiative. Unknown to you, the initiative will place the entrants on a mailing list for market research. In this situation you have unknowingly misled the public into entering a competition which has placed them as a target for market research.

Avoiding misrepresentation

• ensure false impressions are not created
• ensure statements as to future events can be supported at the time they are made
• seek legal advice when considering contracts, terms and conditions.

Recordkeeping

Information that provides evidence of business activity or a business decision is a public record. The Public Records Act 2002 covers all public records irrespective of the technology or medium used to generate, capture, manage, preserve and access those records. Records created through the use of social media should be captured and managed in accordance with the Public Records Act 2002 and the associated recordkeeping Information Standards (Information Standard 40: Recordkeeping and Information Standard 31: Retention and Disposal of Public Records).

Remember that a public record may exist in any format, including emails, text messages and other digital forms.

Different agencies use different recordkeeping systems and processes. In addition, different projects or initiatives may require more detailed recordkeeping controls depending on the risk and/or visibility of the initiatives, among other factors. Therefore, consideration should be given to what records need to be kept of the business being transacted, and how these records will be managed as part of your agency's broader recordkeeping framework when planning the use of social media.

Common information about the records you are creating that may need to be captured includes:

• date of discussion or business activity
• details of your name and other stakeholders involved
• key discussion points
• details of instructions or advice provided
• aprovals, decisions and recommendations made.

Consult with your records management area to establish the best process for your department to capture and manage records created through social media applications. Further advice on managing records is available from Queensland State Archives.

Accessibility

Federal and state anti-discrimination law helps protect people from discrimination and harassment. For example, the Anti Discrimination Act 1991 prohibits unlawful discrimination in certain areas including work, education and accommodation. Information Standard 26: internet (IS26) requires that 'Agency internet sites should provide for maximum accessibility and usability for all groups of the community and maintain a consistent and customer focused view of Queensland Government.' This includes conformance with Web Content Accessibility Guidelines (V2.0).

Social media offers new ways to involve and interact with the community in many aspects of their lives. Unfortunately, access to official social media accounts may be constrained by:

• lack of access to a computer
• inadequate skills to operate a computer
• lack of access to a reliable internet connection
• excessive internet access fees
• organisational restrictions on access to the social media platform
• not being a follower/friend of the official social media account
• lack of conformance of social media platforms with Web Content Accessibility Guidelines.

Where appropriate, content on official social media accounts will also be made available in an accessible alternative format on other official Queensland Government channels. In many cases, this alternative may be represented on Queensland Government internet sites, however given the social interaction inherent through social media, it may also be appropriate to refer individuals to telephone or face-to-face channels.

Example:

• promoting a new initiative via Twitter to 4,000 followers, thereby excluding a large segment of the community
• publishing online video via YouTube without an accessible equivalent such as caption or audio equivalent content.

Accessible alternative:

• using the Consistent User Experience (CUE) online video template on a Queensland Government website
• publishing the initiative on a (accessibility-conformant) Queensland Government website and syndicating the content to official social media accounts
• alerting phone/counter operators of the initiative to include as part of their service delivery of related services
• monitoring comments on social media accounts to inform possible amendments to the official channels.

Information management

It is to be expected that official social media accounts will be relied upon as authoritative sources of government information. Accordingly, it is vital that social media content aligns with that available through other official channels.

It is preferable that social media is not the primary information source. Instead, social media broadcasts or discussions should be based upon or direct users to an agency-managed point of truth. Agency websites or customer service points are the preferred single point of truth and social media posts relating to specific departmental information should reflect or direct users to the best source of truth.

Where possible, ensure content exists on agency websites or customer service points prior to announcing on social media accounts. Avoid using social media channels in isolation to release information to the public or any other stakeholder which has not already been released publicly on a Queensland Government website or customer service point.

The best way to deliver content in this way is to align it with QGEA information principles. That is delivering a consistent message through a variety of fit-for-purpose channels and ensuring that the information delivery is:

• transparent - the public has a right to information
• trustworthy - information is accurate, relevant, timely, available and secure
• private - personal information is protected in accordance with the law
• equitable - information is accessible to all
• valued - information is a core strategic asset
• managed - information is actively planned, managed and compliant.

Defamation

Defamation is the injury to another person's reputation either directly or implied through the publication of words or sounds⁷. It does not matter if the defamation was unintentional.

Potential risks

• Making false accusations about an individual on a public forum which cannot be substantiated for example 'The owner of Organisation XYZ is corrupt and their products are rubbish'.
• Defamation action may be brought, not only against the original publisher, but also against anyone who takes part in the publication or re-publication of the material.

Avoiding defamation

• Do not post information online that is a rumour or confidential relating to a business or individual.
• A government employee who has identified oneself should not complain about a business or individual online, whether information is verified or not.
• Avoid re-tweeting or commenting on posts and tweets which may be a rumour or confidential relating to a business or individual.

Negligence

Negligence is the failure to act when bound by a duty of care. You should take reasonable action to avoid acts or omissions which you can reasonably foresee would be likely to injure someone. The degree of care which the law requires is that which is reasonable in the circumstances of the particular case.

Potential risks

• If a Twitter user lodges a complaint through Twitter to a government agency, the agency acknowledges receipt of the message but does not act on the complaint and the complainant sustains injury as a result. If a Twitter complaint is acknowledged, it should be treated in the same way as a phone call or email complaint.

Avoiding negligence

• Avoid providing advice or recommendations unless part of your standard customer service scripting or information passed through your official approval processes.
• Establish systems and processes to appropriately monitor and respond to social media channels.
• Explicitly set expected response times and state any limitations to responding (such as during business hours), or disable comments if resources are temporarily unavailable.
• Recommend appropriate channels for certain types of communication (such as emergencies).

Privacy

Social media by its nature can result in the disclosure of personal information in a public way. Privacy is one of the major concerns of those using social media and the following sections provide guidance on how to make use of social media, while complying with the information privacy law.

Solicited and non-solicited personal information

When someone follows you on Twitter they provide you with information that you do not solicit. This is known as 'non-solicited information'. If the agency is not actively collecting the information, merely receiving it, there is no requirement for a collection notice. By 'pushing information out' you are only collecting the information as you would for normal web-based activity which can be satisfied through a privacy policy (example).

If a response is invited, it is incumbent on the agency to inform people that when they are responding to the agency's invitation, the potential exists for that response to be disclosed to 'the world at large' and a collection notice satisfying the Information Privacy Principles is required. The following is provided as an example:

Photos

If the agency is disclosing personal information (such as photos) on official social media accounts, consent must be obtained from the individual/s concerned.

Some people may avoid using or engaging through social media due to privacy concerns. Others, who may actively use social media, may not feel confident in publicly sharing their opinions about government. When establishing and using official social media accounts,consider additional channels, both online and offline that complement the purpose of your social media account.

One alternative to using social media is the use of consultation tools such as the Queensland Government 'Get Involved' website, which enables people to submit their ideas privately, anonymously or with a greater assurance of security. If the consultation subject matter is particularly sensitive (e.g. adoption/child abuse) or where the public sharing of views is not in the interest of the consultation outcome, consider using more private community engagement methods. Social media can then be used to promote online consultation opportunities, directing traffic through official government websites.

The Queensland Office of the Information Commissioner (OIC) has developed guidelines for managing privacy in accordance with the Information Privacy Act 2009 and the Information Privacy principles. The Information Sheet: Personal Information: Disclosure, the World Wide Web and Section 33 (PDF, 1 MB) detail requirements for personal information and the internet.

The Department of the Premier and Cabinet has produced guidance material on the consent to use photos of individuals by the Queensland Government and may be relevant depending on the terms of use for the chosen social media tool. Refer to The Queensland Government Image Library project (Queensland Government employees only).

The Australian Public Service Commission has set up interim protocols for online media participation, refer specifically to Annex A – Principles for participation online.

Potential risks

• Posting photos of an individual or public event without signed consent to use the ima ges of the people in the photo online.
• By not providing adequate notice of how personal information will be used, transmitted, accessed or protected.

Avoiding breaches of privacy

1. Comply with the Information Privacy Act 2009, for example:
   
   1. link to a collection notice detailing how personal information will be used, who will have access to it and how it is protected
   2. seek consent before posting photos or other personal information to official social media accounts
   3. seek the consent to the personal information being transferred out of Australia. Social media by its nature will result in the transfer of personal information out of Australia via official social media accounts.
2. If in doubt, contact the Queensland Office of the Information Commissioner for guidance⁸.

Other risks to be aware of when using social media

Posts are viewable around the world instantly

Posts through Twitter, Facebook or any other application you may be using should be accurate, approved and proof read for grammar and spelling errors. The message is instant and may be seen by readers around the world within a moment.

Advertising and uncontrolled content may be placed around content

Readers may associate advertising appearing around your content as your agency endorsing the products. Similarly, content submitted by other parties may appear alongside your content without your control and appear inconsistent with your own communication messages.

Consider: Below is an example of what may appear around your content on Facebook. If your content related to starting a small business or financial scams, how might they be viewed in combination?

Research

Social media sites may collect and use information from profiles and sites may use your details for third party research.

Unless specified in the settings, Facebook can access and use your profile picture for advertising to your network. Facebook advertising targets demographic groups based on your age, sex, entries in your hobbies, music and previous employment and education.

Other users

You have no control over other users' content or what they will do with your content.

The internet is a free space and many social media sites, like Twitter, do not have approval requirements for posting about, or to other participants. Twitter users are able to post anything they want about your brand without a process to remove the comments. In your business plan, consider all possible scenarios that could affect your campaign and prepare for how you are going to react to these.

Services are provided 'as-is' or ;'as available'

If you are relying on social media to deliver your message, the services are 'as is' which means Twitter or Facebook may not be available when required.

Social media is normally provided through a third party and content stored on servers around the world.

Name squatting

Social media sites can reclaim the account if inactive for more than six months. It is advised to not create a social media profile with no intention of using it. Users will be frustrated by finding the account inactive if they are interested in following or joining your group. Twitter terms and conditions state that they can reclaim accounts that have been inactive for more than six months.

Deleting content

Removed or deleted accounts and content may remain in searches or backup files indefinitely.

If incorrect information is delivered through a social media application, deletion is not always the best option as the content may have already been viewed by users and possibly saved.

Find out more

Refer to Appendix G – Privacy and Security Tips.

⁵ Contact, Training
⁶Definition of misrepresentation from the Legal Services Commission website.
⁷ Defamation Act 1889 (Qld)
⁸ Office of the Information Commissioner