The Internet is providing attorneys with valuable information about individuals in many types of cases, including, but not limited to, the areas of employment, family, criminal and personal injury law. In fact, evidence obtained from public online sources of information is often the deciding factor that can make or break a case. It makes perfect sense that many attorneys and their clients have turned to social media data collection companies to outsource this task. However, careful consideration of the purpose of the search and the law must be made before using a social media data collection company.

While some attorneys search for social media data themselves or enlist the assistance of their clients, many attorneys do not have the ability or the will to conduct exhaustive searches for this key information. Further, many who search for this information or simply rely upon their clients may not have the training or skill set to find all information that is relevant and available. In some cases, it is certainly possible that the failure of an attorney to conduct an appropriate social media search may form the basis for a legal malpractice claim.

Seizing upon this trend, third-party companies are offering social media search services. For a fixed fee, these companies have developed proprietary programs that scour the Internet for tweets, posts, blogs, videos or pictures, which can be used as evidence. These programs can search all publicly accessible websites, blogs, message boards and networks, including capturing information from the sites of friends or family members who discuss the intended target. For example, even if an individual customizes his or her own privacy settings on Facebook not to permit access by the general public, his or her friends and family members may be posting with or about these individuals to the general public.

At first glance, using a third party to conduct these online searches would seem to be a preferential method. Many of these companies have perfected the process of mining for social media information. However, one downside that is often overlooked is that attorneys and their clients who utilize such services may be unwittingly violating the Fair Credit Reporting Act (FCRA), because such companies are often considered “consumer reporting agencies” under that act.

The FCRA was first enacted in 1970 and was extensively amended both in 1996 and again in 2003. The FCRA governs the collection, assembly and use of consumer report information – which includes background checks and other reports commenting on an individual’s general reputation, personal characteristics or mode of living – and provides the framework for the credit reporting system.

Since 2011, it has been clear that the FCRA governs the actions of companies that collect and aggregate an individual’s social media data. Thus, attorneys and their clients who use third-party services to collect such information must be sure to comply with the FCRA (and likely, state mini-FCRA laws where applicable).

Obtaining a consumer report for litigation purposes is not automatically permissible under the FCRA. Several courts have held that parties may have a “permissible purpose” for obtaining a consumer report if the transaction that gives rise to the potential litigation would provide a permissible purpose for obtaining a consumer report. For example, a party seeking to sue on a credit account would have a permissible purpose to obtain a credit report. In contrast, there are situations where litigation would not be a permissible purpose to obtain a consumer report under the FCRA. For example, conducting a background check to see if a potential defendant is worth suing would not be a permissible purpose for obtaining a consumer report. Further, a consumer report may not be obtained solely for locating a witness or for use in discrediting a witness at trial. Obtaining a consumer report without a permissible purpose may lead to an FCRA lawsuit.

In the employment context, an employer must provide a legally sufficient disclosure and authorization form, and obtain an employee’s written permission, to obtain a third-party consumer report for general purposes (e.g., making hiring or promotion decisions), with extremely limited exceptions. Now, this equally applies whether the consumer report sought is a formal background check, or a social media search. An employer can avoid the FCRA if it conducts a social media investigation itself, uses a software program to access information on its own, or appropriately obtains information from a governmental agency.

Governmental agencies tasked with enforcing the FCRA are concerned with protecting the privacy interests of individuals and ensuring that information reported about individuals is accurate, and have not hesitated to challenge practices that violate the FCRA. For instance, in 2012, data broker Spokeo paid $800,000 to settle claims that it failed to adhere to several of FCRA’s technical requirements. Lawsuits by individual employees allegedly aggrieved by FCRA violations have also become more common.

Attorneys must be vigilant when using third-party providers who provide social media background reports. These third-party providers may not even be aware of the application of the FCRA to their activities. Penalties for violating the FCRA include actual damages or statutory damages up to $1,000. Punitive damages, reasonable attorney fees and costs are also recoverable.

Alexander Nemiroff is a shareholder with the Philadelphia office of Ogletree Deakins. Nemiroff regularly advises clients and litigates in the areas of employment discrimination, workplace technology law, social media, non-competition and other matters.