Obligations for using social media

03/07/2024 – Social media help organisations bring their services or products to the attention of their target audience. However, using social media comes with various risks for those involved (read: data subjects). Does your organisation also use social media for marketing or communication purposes? This blog sets out the obligations for using social media for these purposes. 

Privacy implications  

Although you can use social media for your purposes, platforms also have their own interests in processing personal data. For example, they use personal data to customise platform products and services to preferences of their users. Social media platforms do this by making connections between personal data. In some cases, this can lead to the processing of sensitive, or even special categories of personal data. Since often it is not clear what the platform exactly does with personal data of your target group and/or staff, there is a risk that your organisation will lose control over this personal data. Having control over personal data is important for complying with obligations following from the General Data Protection Regulation ('GDPR'). For example, when responding to requests from data subjects. 

Obligations and requirements 

Since using social media for marketing and communication purposes carries risks, there are various obligations and requirements for the use of social media under the GDPR. These obligations were recently highlighted by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (‘AP’)) in an advisory opinion on the use of social media by an educational institution. Previously, the AP also advised on the use of social media by the Dutch government. Following from these opinions, organisations have some obligations: 

Legal ground 
Processing of personal data is only lawful if a legal ground applies. You as an organisation yourself must assess what legal ground you have for processing personal data. This involves distinguishing between different processing activities. For example, if you create content with photos and videos with persons, you may choose to ask for consent as a legal ground for posting the content. If you process your target audience's personal data after the content is posted on the platform, legitimate interest may be an appropriate legal ground. Make sure you have thought this through in advance, so that you can implement and document the required consent or legitimate interest test.  

(Joint) controller 
It should be clear which party is responsible for compliance with the GDPR. Your organisation and the social media platform may be involved in processing the personal data at different stages and to a different degree. Therefore, it is necessary to assess who is responsible for what part of the processing activities on a case-by-case basis. It may be required to make agreements with the social media platform in the form of a mutual arrangement.  

After uploading content on a social media platform, the platform itself often has own interests in the processing of personal data. This is another reason why it is important to make proper agreements on where the responsibility of the parties lies, for which part of the processing activities, and if the parties are jointly responsible. Conducting a Data Protection Impact Assessment ('DPIA') can help identify these responsibilities. 

Transparency 
As a data controller, your organisation is required to inform data subject(s) about processing of personal data. Therefore, it is necessary to have a good understanding of exactly which processing activities take place. This also applies to the processing carried out by the social media platform; especially if you qualify as joint controllers. Usually, information is provided in the form of a privacy notice. However, the question is whether informing on your website is sufficient to comply with the transparency principle, now that the processing takes place on the platform. 

Social media users may also include children. Processing personal data of children requires additional protection, as children are generally less aware of risks and consequences of sharing personal data. Concerning transparency, this entails the obligation that information on data processing must be made easily accessible and available in clear and simple language. 

Transfers of personal data  
Social media platforms are often located outside the European Economic Area ('EEA'). As a result, personal data of your target audience and staff may be transferred to a so-called third country. As an organisation, you should check whether you have a legally valid transfer mechanism to transfer the personal data to the relevant social media platform, if this platform is based outside the EEA. In this regard, you may need to take additional measures, such as entering into Standard Contract Clauses and/or conducting a Data Transfer Impact Assessment ('DTIA'). 

Retention periods 
The GDPR includes a storage limitation, meaning that personal data should not be kept longer than necessary. Often, an organisation has no understanding of how long personal data is kept by a social media platform. In that case, the AP recommends that the retention periods be laid down contractually with the social media platform and compliance should be monitored. 

Conclusion 

In summary, it is particularly important to make clear agreements with a social media platform about what happens to the personal data of your target audience and staff. However, it can be difficult to make agreements with large social media platforms in practice, especially if you are a small organisation. Depending on the circumstances of each case, it may be better to not use the social media platform. Need help assessing whether you can use a social media platform or if comply with the obligations under the GDPR? Feel free to contact Considerati.