I just read an interesting post on the Michalsons site about 3rd parties processing personal information on behalf of companies that may be collecting it from you. The post reminds me about an issue I've been thinking about for a little while now and have been chatting to one or two of my clients about. It relates largely to the growing online reputation management (also referred to as "ORM") market. You may not be familiar with these tools so here is a video by one of South Africa's ORM services, SaidWot (disclosure: SaidWot is one of this firm's clients) explaining how its service works:

Another popular ORM service is Quirk's Brandeye. Brandseye, as I understand it, is a similar tool used to monitor a brand's reputation online (I wrote about one of the use cases previously).

The question I have is what the privacy implications are for ORM providers who monitor mentions and keywords on the Web for their clients? These providers may also find themselves profiling influential individuals as part of their monitoring activities in addition to generally collecting bits of personal information about and by anyone who falls into their net. It is helpful to look at how "personal information" is defined in the Protection of Personal Information Bill which is making its way through our legislative process:

The definition is fairly broad and when it comes to ORM, parts (e) and (g) and particularly relevant to ORM services which track brand mentions in blog posts, tweets and elsewhere on the largely social Web. These mentions and tweets generally represent their authors' opinions about brands and brand owners use these ORM services to help them understand brand perception and identify areas of concern (in fact, both Brandseye and SaidWot will likely pick up on mentions of their brand in this post as part of their monitoring process).

The immediate challenge for ORM service providers is that they collect personal information pertaining to people who may not even be aware that the service exists, let alone is being used to collect their personal information. One reason why this is a challenge is that being unaware of the ORM service means that these users have quite possibly not consented to their personal information being collected. Consent to having your personal information collected is one way to address people's legitimate expectation of privacy.

One answer is simply that the blog posts, tweets and other mentions these ORM services pick up on are published on the public Web and their authors can't legitimately claim their works should be private. If they were meant to be private, they should not have been published on the public Web and these authors have no legitimate expectation that their content should be kept private. There is therefore no need for ORM service providers to obtain their consent, provided they only monitor the publicly available Web (as opposed to hypothetically hacking into semi-private or private Web ecosystems).

Another, more interesting challenge, is the potential for profiling through ORM services over time. Profiling is already a potential privacy problem depending on how it is handled (the Electronic Privacy Information Centre in the United States has some interesting information about how profiling is regarded in the United States). Many of us have fallen prey to bogus competitions and promotions, frequently at the hands of 3rd parties we never agreed may collect our personal information. When it comes to consumer facing profiling, the Consumer Protection Act has quite a bit to say about that and we should see some changes to how personal information is collected and used by these parties in the next 6 months to a year as key provisions of the Consumer Protection Act come into force.

I'm not really referring to that sort of consumer oriented profiling in this context of ORM services (although there is some overlap). Instead I am talking more about how ORM services could potentially assemble disparate aspects of a person's personal information into a more coherent profile and somehow make use of that profile in the provision of their services. Many people keep their social media activities split between different identities, spheres of activity or some other criteria. I tend to use my Facebook profile for personal social networking and my Twitter profile for business and generally public social networking. An ORM service may pick up mentions about a brand on both services and tie them together into a more complete profile of me despite my desire to keep my Facebook and Twitter personas separate.

This may not be an issue where each extension of your online identity is public but it could be an issue where a person has compelling reasons for keeping certain personas separate. An astute ORM service user could arguably connect the dots between seemingly disparate social services and associate them with a single individual, much to that individual's chagrin or even severe prejudice. While we are yet to see a practical example of how this could be problematic, it does raise some interesting questions. At the same time there are some answers and these lie with how users use the privacy settings available to them. Facebook, for example, has a fairly granular set of privacy controls that enable users to hide their profiles and activities from the public Web. Setting these privacy controls appropriately could help address some of the concerns I have alluded to.

ORM services are becoming smarter and while they provide valuable market intelligence to their users, they also raise some novel and very interesting questions. The same can be said for developments on the social Web generally. What matters more and more is how social Web users manage their privacy online (or whether they do it in the first place). It is also increasingly important for companies collecting personal information to pay careful attention to what is being collected, how it will be used and what the possible ramifications are.

The Twitter world was abuzz about a week ago about a landlord, Horizon Group Management LLC, which sued a tenant, Amanda Bonnen (her Twitter account doesn't seem to exist anymore), over a retweet, alleging defamation (you can read the complaint here).

At first this case seem like yet another frivolous lawsuit but when I started thinking about it and how powerful Twitter is as a dissemination medium I remember what I wrote a while back about the Courtney Love defamation case (also defamation using Twitter). In this case Bonnen retweeted an offensive tweet (a Twitter message for anyone not familiar with Twitter) about the condition of properties the Horizon Group leased:

There is no doubt that a tweet can be defamatory. You can quite easily cause harm to a reputation in 140 characters. What is a little scary is that retweeting a defamatory tweet could also be defamatory. There is no "retweet immunity" that I'm aware of. When you retweet something you are also publishing that defamatory message to your network of followers. Things brings me to the challenge with something like Twitter (or any networked social service, for that matter):

Leaving aside the brevity of the typical Twitter post it is important to consider a Twitter user's potential reach. Many of the applications which interface with Twitter allow users to republish, or "retweet", Twitter posts to their users. It isn't difficult to imagine the effect of a defamatory tweet published and republished to thousands, tens of thousands or even hundreds of thousands of users on Twitter alone. A number of Twitter users republish their tweets on other social networking platforms automatically. These platforms include Facebook, FriendFeed and their personal blogs and static websites.

If you take into account the users or visitors who frequent those sites and who may pass those tweets along to their followers and contacts there is the potential for a single 140 character tweet to reach a substantial number of people and do irreparable harm to the person defamed.

Anyone who uses Twitter has probably had a tweet retweeted and can appreciate the dissemination potential on Twitter alone. When you add the ability to republish a single tweet on multiple services using 3rd party services like Posterous, Ping.fm and Hellotxt, the a defamatory tweet's reach could grow exponentially. The effect of that could either exacerbate the harm or have little further effect at all. One of the elements of a defamation claim, at least in South Africa, is that the people receiving the defamatory comment will associate it with the plaintiff. This means the plaintiff must be known to those people. Retweeting a tweet to a million followers who have never heard of the plaintiff may have little effect on the harm the plaintiff suffers. On the other hand retweeting to a large group of people who are familiar with the plaintiff could have a significant effect on the plaintiff's potential harm.

(Image credit: T.O.A by ^riza^ published under a Creative Commons Attribution 2.0 license)

This sort of case challenges one of the most common uses of social media, namely as s souped up word of mouth tool. Social media users actively use services like Twitter, Facebook and FriendFeed to talk openly about brands, people and services. I am one of those people. There are times when these discussions are tremendously rewarding and those brands, people and services engage with their customers or critics. Cases like this one raise a question about the desirability of this practice although the ship may have sailed on that one. People have always talked amongst themselves and I doubt very much we will see a contraction of the social Web because of the threat of a lawsuit.

Perhaps what we may see is a change in attitude towards defamation, both because of the potential backlash on the social Web where a company takes action against a user and because it is often better to engage with a critic than sue them. Taking action against a person who tweeted something critical frequently shines a spotlight on that tweet and the thing the user complained about, only exacerbating the effect of the tweet. I've seen many instances of where a company engaged with its critics and defused a potentially explosive situation.

Of course where companies insist on taking action against users the usual defamation defences are available to them. Plaintiffs do still need to prove that a comment was defamatory before a defendant would need to consider the appropriate defence. Then there is the right to freedom of expression which must also be factored into the equation. Combine this with social media and you have a pretty complicated convergence of factors and considerations and a fascinating one at that.

One thing I am sure about is that we are going to see more and more of these sorts of cases popping up going forward. Facebook posts are one of the things I am asked about the most in radio interviews and by clients and as South African Internet users use Twitter more and more, I expect questions about defamatory tweets as well.

What does all of this mean for Twitter users? Well, for one thing, don't publish (or republish) anything you would not be willing to say to a person's face or you are prepared to defend if you are challenged about it.

I recently wrote about brandsquatting and what companies can when someone hijacks their brand on popular social media services. I just noticed a retweet today on Twitter pointing to a fake Standard Bank Twitter account which is pretty critical of the bank. This account uses a variation of Standard Bank's name and its sufficiently similar to be pretty easily confused with the real thing. Well, it would be if Standard Bank had actually registered a Twitter account in its name or was actually using it. The @standardbank account is presently an empty account with a couple followers.

Leaving aside the foolishness of not taking control of related accounts on social networks and either utilising them or closing them off for future use, this Twitter account presents a challenge to Standard Bank. At first glance this is a pretty simple case of trade mark infringement. A disgruntled customer has seized on a Twitter account with a similar name and is using it to criticise Standard Bank. The criticisms are not very well presented and I didn't notice the extra "l" in the account name and thought, for a moment, that this was a simple case of brandsquatting. As it stands there is also an element of typosquatting (a tactic used with domain names to create confusingly similar domains and capture traffic based on common misspellings).

Despite it being an apparent trade mark infringement on the basis, in part at least, that it constitutes passing off, it does remind me about the case of Laugh It Off Promotions CC v South African Breweries International (Finance) BV t/a Sabmark International and Another which reached the Constitutional Court a couple years ago. For those who don't remember the case, here is a useful introduction to Laugh It Off in the case (at paragraph 4):

The applicant is Laugh It Off Promotions CC, a close corporation that occupies itself with the appropriation of brands which inhere in well-known trade marks. This it does by altering the images and words on trade marks and printing them onto T-shirts. The applicant sells the T-shirts for profit in order to make social comment.

Laugh It Off sold t-shirts that used known SAB brands like "Black Labour" instead of "Black Label". It was a form of social commentary that infuriated SAB, which saw this as a form of trade mark infringement.

In the media summary of the case (a full copy of the media summary is embedded below but be sure to read the full case for a complete picture of the legal issues) contains the following extract:

This Court holds that Sabmark failed to prove Laugh It Off’s infringement of its trade marks. The “likelihood of taking advantage of, or being detrimental to, the distinctive character or repute of the marks”, has not been established. The rights of persons to express themselves cannot be lightly limited: the harm to the trade mark holder has to be material, and this is one of the internal limitations of section 34(1)(c). However, an interpretation of the section that conforms to the Constitution and the kind of society it envisions requires the one relying on the protection of the Act to show a real likelihood or probability of harm. Such harm must be of an economic sort. This is because the aim of the section is to protect the trade mark’s selling power rather than its dignity. It cannot therefore be inferred from a mere observation of the two marks that there is a likelihood of economic harm. This must be shown by adducing evidence to this end. To allow otherwise would be to permit a near-monopoly on the part of the trade mark holder. This is impermissible in a democracy such as ours.

While I am sure Standard Bank will not look too kindly on this account and may seek to have it shut down or transferred, I wonder if the "Standardcustomer" who created the account wouldn't be able to rely on the protections afforded by the right to freedom of expression in a similar way that Laugh It Off did. It may well be that Standardcustomer's right to freedom of expression may trump the bank's concerns about trade mark infringement. I also wonder whether Standard Bank could demonstrate "a real likelihood or probability of [economic] harm", which is the test the Court seems to have laid down in that matter.

In real terms, though, Standard Bank could circumvent the traditional trade mark infringment path (ie, the courts) and simply request that Twitter close the account on the basis of its existing rights. It would be a cheaper and arguably more effective option to address this specific account. What it may do is just inflame Standardcustomer and his/her sympathisers even further.

Perhaps what Standard Bank should rather do is engage with its critics better, mitigate the damage already done and proactively address customers' concerns in a more public forum like Twitter.

Here is the media release for the Laugh It Off case:

(Source: @oliviersandra via another contact on Facebook.)