The beauty of social media is that it gives us greater opportunities to express ourselves. But with these outlets comes the burden of managing the multiple ways by which people to get to know us. And that type of exposure has as many consequences as benefits. Balancing those consequences and benefits is particularly relevant in the employment context. Because most people spend their time working for organizations whose business interests may be inconsistent with their fullest self-expression, it’s important that employers and employees be clear about how to navigate an ever-expanding social media landscape.

Social media now plays a role in two major aspects of the employment relationship: first, in recruiting and screening candidates, and second, in monitoring and investigating employees.

As of 2013, twenty percent of organizations used social media or online search engines to screen candidates, and over three-quarters (77%) of organizations used social media to recruit. Employers should use caution, however, when using social media to tap and vet candidates. Beside the possibility of making a hiring decision based on the wrong social media profile, employers must be sure not to gain knowledge of information that would not otherwise be revealed in the application process, like applicant characteristics protected by Title VII of the Civil Rights Act of 1964 and other laws.

There are a couple ways that employers can manage this process responsibly. One approach is to use an in-house human resources professional to manage the social media screening.  Alternatively, employers may turn to third-party companies that specialize in such screening. Either way, the basic goal is to shield the hiring decision-maker from information that should not be considered, or otherwise sift out that information from the application process. Application materials, including permission for background checks, should clearly notify applicants of the company’s social media policy and screening practices. And employers should use objective criteria in the job description, being certain to document reasons for hiring decisions based on those criteria.

Under a number of relatively new state laws, applicants can refuse to disclose certain information about their social media presence. This includes whether they have social media accounts at all and the passwords to accounts they maintain. Candidates likewise cannot be compelled to add an administrator or employee to their friends or follower lists or to change privacy settings, and they have the right to be free from adverse action for refusing to do any of the above. Legislation with similar provisions introduced at the federal level and in dozens of other states suggests that these protections will soon become the norm nationwide.

Employees are generally entitled to the same rights, but things can get more complicated once the employment relationship begins. As far as the law is concerned, the role that social media plays in the employment relationship is primarily a matter of privacy.

Whether and to what extent an employer may access and review an employee’s electronic communications depends on whether the employee has a “reasonable expectation of privacy” in those communications.  That expectation is highest when an employee maintains a “private” social media account, and an employer who accesses a private account could face civil and criminal liability under the Stored Communications Act.  An employer may be justified, however, in acting on information volunteered by a coworker who also happens to be a “friend” with authorized access to the account. But employers may not access employee accounts by a fake profile created for that purpose.

Electronic communications are not limited to social media, of course; they may include email, instant messages, and texts, and may take place on personal or employer-issued devices. As you might expect, employees are less likely to have a reasonable expectation of privacy in communications sent or received via a company email address, a company information system (like an internal chat program), or a company device.  And certain employee acts, like downloading personal files to company devices, could be interpreted as implied consent to access that information. Communications taking place via personal, web-based, password-protected accounts (like Gmail), will be viewed as having a higher expectation of privacy.

These boundaries are not fixed, however, and can be altered by a company’s social media policy. Thus, employers are encouraged to develop a clear, comprehensive policy that employees acknowledge formally at the outset of the employment relationship. The best policies tend to be specific rather than general in scope, using examples of clearly illegal or unprotected conduct, and listing prohibited actions, like discrimination and harassment. Such policies ensure that employers do not infringe employees’ “concerted activity” as protected by the National Labor Relations Act.

Employees then, must review closely their employer’s policies on electronic communications, and act accordingly to keep what they want private outside the purview of those policies. Employees should also keep in mind that employers may justify accessing certain communications when investigating conduct that is suspected to be illegal or otherwise in violation of company policies. Investigating employee misconduct is a “legitimate business interest,” much like preventing misappropriation of confidential information or trade secrets.

All of this said, it must be kept in mind that in the absence of a contract specifying otherwise, most employment is on an “at will” basis, which means an employer can terminate an employee for any reason, or for no reason at all (with exceptions, of course, for reasons that are contrary to law, like race or gender).

Social media will continue to shape the way we interact with the world, including how we work. Until the time when expressing who we are is acceptable in all places, curating our public face in certain spaces will always be necessary.