In this age of changing technologies, like smartphones, remote work, AI, and social media platforms, direct access between company and consumer is at unprecedented levels. This shift has changed the way products are bought and sold, with consumer-facing social media platforms creating a lucrative tool for corporations to connect directly with the consumer base. Similarly, a product seller or other high-profile individual can post on social media and immediately engage with the public.

However, social media can present a double-edged sword, such as when individuals use social media to harass or embarrass a company or its employees. For example, consider a person who acts poorly in a restaurant, berating staff and causing management to ask the customer to leave. The now infuriated ex-patron then takes to social media to post incendiary comments on the restaurant’s Facebook page in retaliation in an attempt to tarnish the restaurant’s reputation and harass the restaurant’s employees. Does the restaurant have any options?

It is becoming more common for clients to ask their lawyers for advice in how to navigate these risks of social media. A client’s online presence can also increase the risk of a cybersecurity breach. Perhaps a company inadvertently adds a link to its Instagram post that was compromised. Suddenly, instead of customers entering their personal information to download an event or other promotional materials, the customers’ confidential information is now potentially at risk.

Cybersecurity breaches or cyber-based harassment are concerning issues for institutional and individual clients alike. Here are some considerations to help attorneys navigate their ethical obligations to their clients when these technological issues arise.

Guarding Against Cybersecurity Breaches or Cyberbullying

Attorneys can communicate with their clients regarding their clients’ level of engagement with social media and their general online presence. Not only does this knowledge assist attorneys in helping clients build their brand, but it can simultaneously alert attorneys of risks for cyber trolling or breaches of security for their clients. This can include identifying the platforms and sites used by clients, the frequency of posts, and the substance or types of posts generated.

Under the California Rules of Professional Conduct, attorneys have an ethical obligation to take competent and reasonable measures to safeguard confidential client information. See Rule 1.6. Additionally, an attorney’s duty of competence to clients includes adaptation to and knowledge of “relevant technology.” See Rule 1.1, comment [1] (“The duties set forth in this rule include the duty to keep abreast of the changes in the law and its practice, including the benefits and risks associated with relevant technology.”). Thus, attorneys may have an obligation to counsel clients in ways that their digital footprint is creating risk for them.

Under Rules 1.1 and 1.6 of the California Rules of Professional Conduct, attorneys should also take heed of these same ethical obligations in their own online presence. Attorneys are not permitted to reveal confidential client information when posting on their own individual or law firm blogs, websites, and social media.

Tips in the Event of Potential Harassment on Social Media

But what happens if a client is experiencing cyberbullying or other harassment on social media? Such harassment can come from unknown or unknowable persons, which complicates the next steps and can make it harder to take the common “real world” steps of sending someone a cease-and-desist.

If a client is being harassed on social media, the client may be able to directly petition the social media platform for assistance if a commenter’s inflammatory posts violate the site’s terms of use. Start by determining whether any rules have been broken through careful review of the social media platform’s user agreements and community guidelines. For example, many social media platforms prohibit content that violates another’s intellectual property rights. Thus, for a client who is dealing with a person posting the client’s confidential information, this could be an avenue for remedy.

Problematic posts can almost always be reported as harassment to the social media platform, but users may experience mixed results in whether the current harassment will be de-platformed—and reporting such users may not prevent future harassment.

Consider Whether Further Legal Action Is Warranted

A lawyer may need to advise their clients on whether future steps are required to address cyber bullying—but many lawyers will approach this with caution. There seems to be some general acceptance that social media platforms will lead to some amount of critical feedback from the public, so not every instance of “trolling” will justify further action. But if a social media user is specifically targeting a client’s employees, by posting their home addresses or identifying them in a way that puts them in harm’s way, it may be appropriate to contact law enforcement. This step is usually only appropriate when there are actual risks to physical safety.

Other remedies include contacting the user to ask them to stop their tirade against the client entity or individual. Although this approach can sometimes make things worse, if it leads the user to then post the cease and desist online (or risks claims by the user that they are being silenced as a “truth-teller”). But if the posts are interacting with the client’s business substantially, or are defaming the client, a lawsuit or a request for an injunction may be appropriate next steps.

Whether legal action will be successful is highly-dependent on the jurisdiction. Some jurisdictions treat online speech very protectively, and are reluctant to hold people accountable “in real life” for what they say online (particularly if there are no threats to a person’s well-being). Other jurisdictions will get involved if the online trolls are engaged in actionable defamation, personal threats of harm, or violating intellectual property. California Penal Code §653.2 criminalizes cyber harassment, which is defined under the statute as the intent to place another in reasonable fear of his or her safety by means of an electronic communication device without consent for the purpose of imminently causing unwanted physical contact, injury, or harassment. See §653.2(a).

When corporate clients express concern about social media trolls interfering with their businesses, attorneys may discuss with the client whether objecting to the social media posts—by a cease-and-desist or even a lawsuit—could even draw extra attention to an issue. This phenomenon—that taking public action in an effort to minimize the effect of a certain event may actually serve to draw attention to it—is known as the Barbra Streisand Effect (following a lawsuit she filed to prevent publicity of her Malibu home which only served to highlight such publicity). If a person with three followers is accusing a lawyer’s client online of stealing their marketing ideas or designs, would a lawsuit against that person actually provide more oxygen for such an allegation? Or should the client simply document the abuse in case it continues or escalates, but otherwise let a sleeping dog lie.

Being aware of these options can help lawyers assist their clients in building an online presence that fosters growth and engagement with the public community while simultaneously guarding against potential digital harassment.