Data protection and social media

Background

Social media provides important opportunities for staff and students to communicate and engage with a wide range of audiences and stakeholders. There are, however, a number of data protection risks associated with the use of social media which could impact on the University’s reputation.

These guidelines complement existing policies and guidance from Human Resources and Information Services.

Human Resources, in consultation with key stakeholders, has recognised the benefits of social media the University and endorsed the use of social networking for positive engagement within our working environment and as a communication tool to share important news, updates and events. The statement can be found here:

Human Resources social media policy

Information Services have developed guidelines to ensure that use of social media are used safely and responsibly. These guidelines can be found here:

Information Services social media guidelines

Social media and research

Re-tweeting posts

It is acceptable to re-tweet posts within your School or department Twitter account, provided this would not be detrimental to the data subject and that the data subject is unlikely to object to the post being shared. In the case of re-tweeting, the information is already out in the public domain and an individual who has created an account on Twitter will have acknowledged at the time of creating their account what can and can’t be done, thus will have the expectation that their tweet will be re-tweeted. Of particular importance is also the Twitter Privacy Policy, which can be found here:

https://twitter.com/en/privacy

Harvesting social media posts for research

Many research projects involve harvesting and analysing social media posts. While many of these will be in the public domain, the data protection requirements must still be adhered to. This means that the authors of the social media posts must be provided with a privacy notice within one month after harvesting them. That can be through, for example, a tweet to them. The same applies to all research using publicly available data – you still have to adhere to the fairness principle and provide a privacy notice.

Tagging individuals when creating posts

You can tag individuals when creating social media posts as a person who has created a Twitter or public Facebook account will have acknowledged at the time of creating their account what can and can’t be done. However, you should only do this where the individual is unlikely to object to being tagged/associated with the post. You should not add or create any further identifiable or personal data about the individual that is not already publically available without the individual’s consent.

Social media and marketing

It is not acceptable to link to individuals' personal data (such as graduates’ publicly available Linked In profiles) to market programmes. Although an individual’s Linked In profile is publicly available, you cannot create any marketing materials that link to these profiles (which contain personal data) without the individual’s consent.

You can publicise staff or student successes on your School social media site. Your legal basis will be legitimate interest and specific consent is not required, however if you are publishing a photograph of the individual, then consent for use of the photograph will be required (if not already obtained as part of staff/student photograph use).