Nearly everyone uses some form of social media these days, and your employees are no exception. They are tweeting, friending and linking-in all the way from the stockroom to the boardroom, and in every office or cubicle in between. It therefore follows that your company should institute a social media policy to govern the appropriate scope of social media use amongst employees.

Every company should have a social media policy designed to protect the company from improper social media use by placing employees on notice of what they can and can’t do when communicating on the Internet. Ideally, the policy should provide specific guidelines that are designed to protect the company’s reputation, business relationships, trade secrets and intellectual property, as well as avoid liability associated with employees that post harassing, confidential, and/or other inappropriate material concerning other employees. An effective policy will provide employers with peace of mind that it has officially communicated what is a punishable or terminable offense in the event an employee misuses social media in violation of the policy. At the same time, employees will a have a clear understanding of what they can and can’t do online, and therefore can use social media without fear of repercussion so long as they follow the guidelines set forth in the policy. Sounds simple, right?

But, there’s just one problem (you knew this was coming). The National Labor Relations Board (NLRB) has adopted a strong stance against broad social media policies. Over the past few years, the NLRB has struck down numerous policies that it believes pose a threat to employees’ right to engage in protected activities under Section 7 of the National Labor Relations Act (NLRA). Broadly speaking, Section 7 of the NLRA protects “concerted activity,” which generally entails two or more employees acting together in support of matters of mutual interest, such as compensation, benefits, or workplace conditions. Social media policies may be held to violate Section 8(a)(1) of the NLRA if it interferes with, restrains or coerces employees in the exercise of this right.

For example, blanket prohibitions on employee social media postings that cast the employer in a negative light will be found to violate the NLRA. So too will policies that employ broad terms like “appropriate” or “inappropriate” communications without the use of limiting language or examples of what would be considered “inappropriate.” In one such instance, the NLRB recently struck down the following policy in Costco Wholesale Corporation and United Food and Commercial Workers Union, Local 371:

Employees should be aware that statements posted electronically (such as [to] online message boards or discussion groups) that damage the company, defame any individual or damage any person’s reputation, or violate the policies outlined in the Costco Employee Agreement, may be subject to discipline, up to and including termination of employment.

The NLRB explained, “by its terms, the broad prohibition against making statements that ‘damage the company, defame any individual or damage any person’s reputation’ clearly encompasses concerted communications protesting [Costco’s] treatment of its employees.” Since protected communications were not excluded from Costco’s broad policy, the NLRB determined that employees would reasonably conclude that the policy required them to refrain from engaging in protected communications.

While the NLRB in the Costco decision did not go so far as to provide guidance as to how to craft social media policies that will survive NLRB scrutiny, it reinforces a critical component to any social media policy: Be specific. Broad restrictions on sharing confidential information about the company or co-workers without defining the nature and scope of confidential information could be problematic. Instead, policies should specifically prohibit the disclosure of personal information, such as social security numbers and protected health information. Also, policies prohibiting employees from engaging in controversial discussions or airing complaints online may not pass muster. Alternatively, a policy could prohibit employees from engaging in sexually or racially harassing comments. These distinctions are critical to crafting a policy that can protect the company without violating protected concerted activity.

So, where do you go from here? If your company does not have a social media policy, institute one. An appropriate social media policy will help insulate the company from certain legal liabilities in the event an employee is terminated for violating a specific restriction due to improper social media use. If your company already has a social media policy, review it. Use a careful eye to determine whether the provisions within the policy comply with the NLRB’s recent decisions. And if you need further guidance, just think back to what we learned as children after reading “Goldilocks and the Three Bears”: The policy must not be too narrow as to omit certain types of harmful online activities; not too broad as to violate to the NLRA; but must be “just right” to strike the appropriate balance between company protection and employee rights in this social media driven society.