SNOPA (HR 5050) May Protect Insurance Companies From Schools and Businesses That Demand Access To Personal Password Protected Social Media Accounts

I have written how the Social Networking Online Protection Act (HR 5050) may benefit employees, job applicants, employers, students, student applicants, and schools. Now, I am going to explain how HR 5050 may benefit insurance companies.

Does the insurance industry realize that multiple schools are creating a massive database of their students' password protected social media content and activities? With access to all of this data these schools may become responsible for everything their students do online and everything that is referenced online and/or inferred online that may occur in the real world.

The Universities of North Carolina, Texas, Nebraska, and Oklahoma may not only be violating the Stored Communications Act with their student-athlete social media policies but also may be creating tremendous insurability problems for their academic institutions.

Each of the above mentioned schools have engaged a company called Varsity Monitor. In order for students to keep their scholarships and play intercollegiate sports at these public institutions, they must Facebook Friend Varsity Monitor and provide unfettered access to their password protected social media/digital content. Varsity Monitor downloads the students' social media content and creates detailed reports about all of the students' digital activities. Requiring a student to provide access to their password protected social media/digital content may violate FERPA and/or other federal and/or state laws

Varsity Monitor along with above schools are compiling vast amounts of personal data on thousands of students. What happens when there is a data breach? In Varsity Monitor's agreements and policies it clearly states that by using their service they are indemnified against any legal issues that may arise. Therefore, when a data breach occurs who will be left paying for it? The schools' insurance companies.

According to the latest Ponemon Data Breach Study, the average cost of a data breach is $194 per record and the overall average organizational cost is $5.5 million dollars. These figures appear to be focused on what I would call traditional data breach issues (compromised social security numbers, dates of births, addresses, etc...) and not personal social media data breach issues (which may include traditional issues plus a list of friends, professional contacts, personal photographs, confidential interactions, potential blackmail information, etc...). Furthermore, according to Ponemon the biggest threat to data breach are those who have access to the data. Therefore, when a student-athlete becomes famous and his social media content contains embarrassing information will Varsity Monitor and/or school employees who have access to the data leak the password protected personal content for personal gain?

Are schools prepared for the increase in legal discovery requests that will accompany all of the data they have accumulated on their students? Are schools telling their insurance companies that they are accumulating all of this unneeded personal data on their students? Do the schools that engage Varsity Monitor or similar service providers such as UDiligence, or Centrix Social know that a data breach at Ohio State a couple years ago may have cost the University $4 million dollars to resolve. These costs included: investigative consulting, notification of the breach, and a calling center to answer questions or concerns.

Ohio State's insurance company may have covered the entire cost of this incident. However, will the insurance industry be willing to cover an incident when a school and/or Varsity Monitor mishandles personal password protected social media content and/or when a school is sued for negligent social media monitoring? This type of lawsuit may contain some of the same arguments as the recent $30 million dollar lawsuit against UVA by the family of Yardley Love. However, because of digital evidence a jury in a negligent social media monitoring lawsuit may award $100 million dollars plus to a plaintiff. If you don't think this could happen you may want to ask Dharun Rhavi's lawyer about the power of social media evidence.

If the insurance industry wants to be protected from having to pay out claims against schools and/or businesses who are requiring their students and/or employees to provide access to their password protected digital content they will support the Social Networking Online Protection Act (HR 5050).

(Full Disclosure: I am working pro bono with Rep. Engel's office on the Social Networking Online Protection Act .)

To learn more about these issues you may contact me at http://shearlaw.com/attorney_profile.

Copyright 2012 by the Law Office of Bradley S. Shear, LLC. All rights reserved.

Schools May Need a Search Warrant To Access Their Student-Athletes' Personal Password Protected Electronic Accounts

According to the Penn State Daily Collegian, Penn Sate Police seized illegal drugs and paraphernalia from the home of one of their football players. Police had entered the home of a current and former student-athlete to investigate a break-in. Upon realizing there may be illegal drugs, it appears the police obtained a search warrant.

Since in the real world a search warrant is generally required to obtain evidence in one's real home, a search warrant is also generally required in the digital world to search one's password protected digital home. In order for a public school to obtain access to the password protected personal social media and digital accounts (non-school issued) of their student-athletes they may need a court order.

A public school may not require a student to utilize the services of UDiligence, Varsity Monitor, Centrix Social, or any other social media monitoring company in order to keep his or her scholarship and may not retaliate against a student for refusing to provide access absent a court order.

Therefore, if a student at a public school refuses to provide UDiligence, Varsity Monitor, Centrix Social, other social media monitoring companies, or school employees their personal social media or personal digital account information and the school punishes the student in any manner for refusing to do so the student may have multiple causes of action against the school. The 1st, 4th, and 5th amendments along with the Stored Communications Act, the Computer Fraud Abuse Act, and multiple state laws may be implicated in social media monitoring.

To learn more about these issues you may contact me at http://shearlaw.com/attorney_profile.

Copyright 2012 by the Law Office of Bradley S. Shear, LLC. All rights reserved.

Multi-Milion Dollar Jury Verdict Against Virginia Tech Proves Schools Should Not Create A Duty To Social Media Monitor

The 2007 Virginia Tech massacre that left 33 dead on campus was a terrible tragedy. Earlier today, a jury found Virginia Tech negligent for its delay in warning its campus about the first shootings. Two of the families of those who were killed were awarded $4 million dollars each by a jury.

This case demonstrates why schools should not utilize the services of social media monitoring companies to review the password protected content of their students. On March 12, 2012, the NCAA stated that there is no "blanket duty on institutions to monitor social networking sites." Therefore, if there is no blanket compliance duty to social media monitor why create a legal duty to do so which may lead to multi-million dollar judgements for negligent social media monitoring?

After the the University of North Carolina Public Infractions Report was released, Varsity Monitor, a company that sells social media monitoring services responded to a Tweet that links to an article where I am quoted by Tweeting, "It is still best practice for the athletic dept to continue to monitor social media for brand and athlete protection & edu" (see below):


Now that two $4 million dollar jury verdicts have been returned against an academic institution for a delay in properly warning its students about a killer being on the loose on campus, imagine if a school follows the above advice by Varsity Monitor and a tragedy occurs that social media monitoring should have warned against but did not? Instead of multiple $4 million dollar jury verdicts would it be multiple $25 million or $50 million or $100 million dollar negligent social media monitoring jury verdicts?

To learn more about these issues you may contact me at http://shearlaw.com/attorney_profile.

Copyright 2012 by the Law Office of Bradley S. Shear, LLC. All rights reserved.

NCAA: Schools Have No Blanket Duty To Monitor Social Networking Sites Of Student-Athletes

The NCAA has stated in the University of North Carolina Public Infractions Report dated March 12, 2012 (page 11), that it "declines to impose a blanket duty on institutions to monitor social networking sites.Consistent with the duty to monitor other information outside the campus setting (beyond on-campus activities such as countable athletically related activities, financial aid, satisfactory progress, etc.), such sites should be part of the monitoring effort if the institution becomes aware of an issue that might be resolved in some part by reviewing information on a site."

In other words, an NCAA member institution's duty to monitor is the same whether its a student's online or offline activities. Nothing more. I praise the NCAA for its decision in this case. The NCAA's decision mirrors the opinion that I stated on September 2, 2011 when I said, "it may be advisable to check up on a student-athlete's public online posts in the same manner as his/her real world activity."

The NCAA's decision today has clearly stated that schools do not need to engage costly social media monitoring services that require students to provide access to their password protected electronic content. The companies that push these services are selling snake oil that is essentially a legal liability time bomb and they are preying off a school's fear. This has lead to some schools violating the constitutional rights of its students.

There is a lack of knowledge regarding social media, compliance, and the law. Unfortunately, several self-serving companies have tried to fill the void in college athletics and these companies have not only provided bad advice that may create tremendous legal liability for their clients but they also incorrectly interpreted NCAA compliance rules. These social media consultants have advised their NCAA member clients to waste tens of thousands of dollars on services they do not need. Every school that has engaged these social media monitoring services may want to demand a full refund from these consultants who do not understand social media, NCAA compliance rules, public policy, or the law.

To learn more about these issues you may contact me at http://shearlaw.com/attorney_profile.

Copyright 2012 by the Law Office of Bradley S. Shear, LLC. All rights reserved.