Employees' MySpace Posts May Create Employer Liability for Invasion of Privacy

As social networking Web sites like Facebook and MySpace become increasingly pervasive in and around the workplace, employers need to be aware of potential liability for employees’ publication of private information on such sites.

Minnesota recognizes a cause of action for invasion of privacy for publication of private facts. In a recent Minnesota Court of Appeals case, Yath v. Fairview Cedar Ridge Clinic, the Court ruled that posting information on MySpace satisfies the “publicity” requirement for an invasion of privacy claim. The case reinforces the importance of implementing and enforcing policies that restrict employees’ access to and uses of private information, especially in light of Internet sites that facilitate information dissemination.

So why should employers take notice of the Yath decision? Although the Court did not hold Fairview liable for the employee’s MySpace post, the case lays the groundwork to hold employers liable in the future. The plaintiff in Yath sought testing and treatment at the Fairview clinic for a sexually transmitted disease (STD) after commencing a sexual relationship with a new partner (not her estranged husband). A clinic employee, Navy Tek (who was related to Yath’s husband), curious about Yath’s visit, accessed her medical records. Tek shared her findings with a second employee, Net Phat, who also was related by marriage to both Tek and Yath. A MySpace page soon appeared displaying a photograph of Yath, calling her “Rotten Candy” and announcing that she had an STD and had cheated on her husband.

Yath sued Fairview, Tek, Phat, and Molyka Mao (Tek’s sister, who did not work at Fairview and from whose workplace computer the MySpace page originated). Yath claimed invasion of privacy, disclosure of medical records, intentional infliction of emotional distress, negligent infliction of emotional distress, and breach of a confidential relationship.

On appeal, the Court considered whether the MySpace posting constituted “publicity.” An invasion of privacy claim for publication of private facts requires “publicity” of a private matter that would highly offend a reasonable person and that is not of legitimate public concern. The Court suggested that any post on a publicly accessible social networking site was per se publicity and that communication via social networking Web sites is communication to “the public” because of the medium. The Court stated the number of actual viewers was irrelevant because it was enough that another’s private information was posted in a place accessible by the public at-large. Despite announcing this expansive rule, the Court ruled for Fairview on the invasion of privacy claim because there was no evidence that Fairview was involved in creating the MySpace page, which was not created on a Fairview computer. In fact, Fairview blocked access to MySpace on all its workplace computers.

The Court analyzed whether Fairview could be held vicariously liable for its employees’ intentional torts, in this case invasion of privacy. Fairview argued that it should not be held responsible because Tek’s accessing and sharing of private patient information were unauthorized actions outside the scope of employment and were not foreseeable. Tek’s conduct expressly violated Fairview’s policies and, because Fairview blocked employee access to MySpace, the Court concluded that Fairview could not have foreseen Tek’s actions. If the situation had differed slightly and the MySpace page had been created from a Fairview computer or directly by a Fairview employee rather than by a third party, the Court’s decision might have been different.

So what protected Fairview from liability in this case even though the MySpace post constituted “publicity”? In short, the protection arose from Fairview’s proactive approach of limiting access to certain Internet sites and implementing appropriate policies protecting confidential information. Had there been evidence that Tek was directly responsible for creating the MySpace page or had Fairview permitted access to Facebook during work hours, the Court’s decision might have been different. However, as social networking Web sites grow in popularity, arguing that an employer could not foresee private information from the workplace appearing on such a site may become more difficult. And as demonstrated by several recent high-publicity leaks of medical information, the ease with which employees can access and post such information may open the door to employer liability.

Ultimately, this new decision is a strong reminder that employers who deal with clients’ or patients’ private information must restrict employee access to and uses of such information through appropriate policies. Thus, revising existing policies to expressly prohibit inappropriate and potentially damaging use is prudent and necessary to limit potential liability.

Takeaway

Technology continues to change the landscape of potential employer liability. With the increasing popularity of online social networking Web sites, organizations should be aware of how employees use such technologies, especially in the workplace. Networking can be valuable, but employers must realize the potential risks and weigh the costs and benefits of allowing access to Web sites like MySpace and Facebook in the workplace.