Part 4: Regulation and social media

Learning from public entities' use of social media.

4.1
During our work, some entities asked questions about specific social media issues. The most frequent questions were about:

the Department of Internal Affairs' social media guidance;
official information requests;
privacy issues; and
indemnities.

4.2
To answer some of these questions, we discussed the implications of social media with, and sought advice from, the:

Department of Internal Affairs;
Office of the Ombudsman; and
Office of the Privacy Commissioner.

Department of Internal Affairs' social media guidance

4.3
The Department of Internal Affairs has an all-of-government strategic leadership role for information communications technology. Part of this role is to help build online capability throughout the public sector.

4.4
One of the Department's approaches to building capability is through releasing all-of-government guidance and providing advice on the best online practices.

Social media guidance

4.5
With increasing expectations about the quality and effectiveness of online service delivery, the Department has improved and extended the resources it provides to entities. In late 2011, the Department issued guidance that aims to help organisations plan and implement social media.

4.6
The guidance is intended to encourage best practice in social media use by government agencies, provide useful templates and tools for planning, and give an overview of the strengths, weaknesses, benefits, and risks of this important and rapidly growing medium.

4.7
The guidance consists of four elements, each with a specific purpose and audience. These are:

High-level guidance – aimed at helping senior management think about the strategic issues of using social media, such as benefits, risk, and resourcing. It also includes business case templates.
Hands-on Toolbox – aimed at providing tools (such as draft policies) to help practitioners set up social media. It also provides an analysis of the strengths and weaknesses of the different types of social media.
How to Handle a Mishap – aimed at advising entities on how to deal with potential issues arising from social media use, for example, dealing with abuse.
A Case Study – shows how the Ministry of Health uses Facebook to support breastfeeding women. It provides information on, for example, resourcing, performance metrics, and realised benefits.

4.8
The Gartner Group, a global information technology research advisory company, endorsed the Department's high-level guidance and the hands-on toolbox as the:

… best government social media guidelines so far … [They] provide very down-to-earth, actionable decision frameworks ... [with] enough information [for staff] to formulate their own decisions about whether and how to venture into social media ... these are must reads for any public sector organization.⁹

How the guidance is being used

4.9
Some of the public entities we spoke to were using the guidance to improve their social media capability. The entities were using it in different ways, such as:

for its intended purpose – the guidance has been useful when public entities are thinking about, or just beginning to use, social media;
in place of internal policy – using the guidance as interim policy while they prepare their own policy and procedures; and
supporting existing social media use – some entities that have been using social media for some time are using the guidance to validate what they are already doing.

4.10
Some entities thought the guidance was more helpful for organisations starting their social media use, and of less value to more experienced users of social media.

Stakeholder feedback

4.11
Our senior management survey asked a question about the level of awareness of the Department's social media guidance. The high-level guidance document is intended to be useful to managers and leadership teams, so we were interested in the level of awareness. Figure 9 shows that only 28% of respondents were aware of the guidance.

Figure 9
Awareness of the high-level guidance for using social media among our survey respondents

4.12
Before we carried out our survey, some entities told us that they thought the Department had not promoted the guidance well enough. In our view, there is scope to increase the level of awareness of the guidance among senior managers in the public sector. The Department told us that it is taking steps to increase the awareness of its guidance.

4.13
In our survey, we also asked senior managers about their opinion of the effectiveness of the Department's leadership of social media throughout the public sector. Figure 10 shows that 13% of respondents thought that the Department provided effective leadership of social media.

Figure 10
Our survey respondents' level of agreement with statement that the Department of Internal Affairs provides effective leadership of social media

4.14
The results suggest that more visible leadership is needed, which could encourage more widespread and effective use of social media in the public sector.

Official information requests through social media

4.15
Under the Official Information Act 1982 and the Local Government Official Information Management Act 1987, official information requests can be made through any communications channel.

4.16
Therefore, public entities must respond to official information requests made through social media if they have a social media account. A request for official information made through Facebook should be treated in the same way as a request made in an email or by letter.

Responding to requests for official information

4.17
There are some complexities posed by social media that public entities need to be aware of when responding to requests under the Official Information Act:

Entities must respond within 20 working days from the point when the entity is satisfied that the requester meets the eligibility requirements. However, eligibility might not always be clear from, for example, a Tweet or Facebook post.
An entity might find it difficult to provide the requested information through the same channel by which the request was made. For example, there might be privacy issues or physical limitations, such as character limits. In these instances, the entity should ask the requester for a postal or email address that it can use to deliver the information.

Privacy issues

4.18
Figure 11 sets out some information from the Office of the Privacy Commissioner about the use of social media.

Figure 11
Office of the Privacy Commissioner's comments on different social media considerations

Consideration	Comments
Social media is about interaction so you need to think about how that interaction will take place.	One of social media's key strengths is its ability to reach people directly and to talk with them, not at them. It is important that entities set the terms for the discussion from the beginning. Questions for entities: Do you want to encourage people to interact with you publicly or privately? If you have a complaints function, what would happen if someone tried to lodge a complaint with you on (for example) your Facebook page – they'd be sharing their own personal information, and potentially other people's. How would you manage that risk? Can you vet posts before they get published? What comment moderation policies do you have, and can you be sure your staff adhere to them?
Who will monitor what others post in response to your agency?	Staff members should be made aware of potential privacy concerns and watch for them. Staff need to know what is acceptable and what is not, and have the authority to deal with problems quickly. Without close moderation, the entity may not respond quickly enough for your audience or to manage your risks. Questions for entities: Have you got someone with the time and the ability to manage your social networking account successfully? Are your communications staff knowledgeable enough to handle any complaints that you receive through your site? Do they know who to report a problem to – for example, if someone uses your social networking account to alert your agency to a privacy breach? Is input from staff disciplines other than communications needed to help deal with the kind of things your social networking activity is likely to generate?
Using social media means you get information about the people who interact with your accounts.	Listening is a key part of using social media, so entities need to listen to what people are saying about them and to them. Entities are likely to be interested in who their followers are and what motivates them. But entities don't need to monitor everything their followers are doing. People can choose to share information with entities through their posts, but their social media profile also holds personal information. People might not realise that personal information is available to entities that they follow. Searching through the personal profiles of people who "liked" the entity's page, or who follow the entity's Twitter account, to try and establish demographics could be an issue. Entities need to: Be clear about their objectives, that is, what do they want to do, before they start. Develop and publish a privacy policy for their account, and ensure that it is implemented as intended. Be clear why they are collecting information rather than just because it is possible. To collect detailed analytical data, entities should inform social media users of their intention to collect this.

Source: Office of the Privacy Commissioner.

Granting indemnities

4.19
Many social media sites require users to accept terms and conditions under which they are required to indemnify the site owner against improper use of the site (such as posting material that is defamatory or infringes privacy laws). Terms and conditions on Internet sites are generally offered on a "take it or leave it" basis. This means there is little (if any) opportunity for users to negotiate the scope of indemnity provisions. Agreeing to indemnify someone can be risky – depending on the context and the wording of the indemnity agreement, the liability that an entity agrees to could be unlimited.

4.20
Current legislation prohibits government departments from giving indemnities, unless:

the type of indemnity is specifically permitted by the relevant Act; and
it appears to the department that giving the indemnity is "necessary or expedient in the public interest".

How to deal with indemnities

4.21
The social media guidance produced by the Department of Internal Affairs states that indemnities should be granted by an entity's chief executive or their expressly nominated delegate.

4.22
When deciding whether to agree to the terms and conditions of use on a social media site, the chief executive or their delegate must:

consider the risks posed by any indemnity provisions before agreeing to them; and
be satisfied that it is necessary or expedient in the public interest to agree to them.

page top