Ben Mones: Why HR Can’t Ignore Online Behaviour Anymore

The Evolving Landscape of People Risk: From Traditional Checks to Digital Footprints

Historically, people risk management primarily focused on tangible factors such as criminal background checks, verification of educational credentials, and professional reference calls. These methods aimed to prevent issues like fraud, incompetence, or a history of workplace misconduct. While these foundational elements remain crucial, the digital age has introduced new dimensions that transcend traditional boundaries. The risks themselves—harassment, poor judgment, unethical behavior, and the cultivation of toxic work environments—are not novel. What has fundamentally transformed is their visibility, permanence, and potential for rapid escalation. The proliferation of social media platforms such as LinkedIn, X (formerly Twitter), Reddit, Discord, and even TikTok has created a vast, immutable record of individuals’ public expressions, opinions, and interactions.

This shift has been exacerbated by the widespread adoption of hybrid and remote work models, which have normalized digital communication as a primary mode of professional and personal interaction. With as many as six generations now active in the global workforce, each with varying degrees of digital native fluency and online behavior norms, the potential for missteps or problematic conduct to emerge in these spaces has significantly amplified. When an incident occurs online, it rarely remains contained within a small circle. A single controversial post, an ill-advised comment, or a pattern of inappropriate engagement can ripple instantaneously across internal teams, professional communities, and into the broader public domain. The consequences can be severe, ranging from immediate damage to employer brand and internal culture to long-term reputational harm that affects talent acquisition, customer perception, and investor confidence. Data from various industry reports consistently indicates that a company’s reputation can be significantly impacted by employee social media activity, with some studies suggesting that up to 70% of consumers consider a company’s social media conduct when making purchasing decisions. Furthermore, approximately 60% of job seekers research a company’s online reputation before applying, emphasizing the direct link between digital conduct and talent attraction.

The Erosion of Boundaries: Online Conduct as Professional Conduct

A critical implication of this digital transformation is the blurring of lines between what constitutes "at work" behavior and "outside work" conduct. Regulators and legal frameworks are increasingly recognizing that an individual’s public online presence can be an extension of their professional identity and, by extension, their employer’s. In certain regulated sectors, such as financial services or healthcare, this shift is particularly pronounced, with professional bodies imposing stringent guidelines on how employees represent themselves online, even in personal capacities. For HR leaders, this represents a significant erosion of the long-standing legal and ethical distinction between private and professional lives. Organizations can no longer afford to disregard publicly visible behavior that might signal potential risk, even if it occurs outside traditional working hours or on personal accounts. The "always-on" nature of digital interaction means that an employee’s actions, even if intended for a private audience, can quickly become public and reflect directly on their employer.

Legal experts infer that the increasing scrutiny on online behavior stems from a need to protect organizational integrity and prevent potential liabilities. While employee privacy remains a critical consideration, the argument is often made that when personal online conduct directly impacts workplace safety, professional reputation, or legal compliance, employers have a legitimate interest in addressing it. This nuanced position necessitates a delicate balance between respecting individual freedoms and safeguarding organizational assets. The challenge for companies is to navigate this complex terrain without infringing on privacy rights or fostering a climate of surveillance, which can erode trust and negatively impact employee morale. The timeline of this shift has largely paralleled the rise of mainstream social media:

• Early 2000s: Emergence of social media platforms (e.g., MySpace, Facebook) primarily for personal use. Employer monitoring was rare and legally ambiguous.
• Late 2000s – Early 2010s: Increased professional networking on platforms like LinkedIn. First instances of employees being disciplined or terminated for online conduct (e.g., critical posts about employers, inappropriate photos). Legal cases began to test the boundaries.
• Mid-2010s: Growth of "always-on" culture and mobile internet access. More widespread recognition of the "digital footprint." Regulatory bodies begin to issue guidance, particularly in highly regulated industries.
• Late 2010s – Present: Proliferation of diverse platforms (TikTok, Reddit, Discord). Hybrid work models accelerate the blurring of lines. AI tools for screening emerge. Data protection regulations like GDPR and CCPA come into force, adding complexity.

Navigating the Regulatory Maze: GDPR, FCRA, CCPA, and Beyond

The legal landscape governing the collection and use of public online data for employment purposes is fragmented and complex, varying significantly across jurisdictions. This necessitates a robust understanding of key regulations:

• General Data Protection Regulation (GDPR): In the European Union, GDPR sets stringent standards for data privacy and protection. Any collection and processing of personal data, including publicly available social media information, must have a clear legal basis (e.g., explicit consent, legitimate interest) and adhere to principles of data minimization and purpose limitation. This means employers must be transparent about what data they collect, why they collect it, and how long they retain it. Penalties for non-compliance can be severe, reaching up to €20 million or 4% of global annual turnover, whichever is higher.
• Fair Credit Reporting Act (FCRA): In the United States, the FCRA governs the use of "consumer reports" for employment purposes. If social media screening is conducted by a third-party vendor and the information is used to make an adverse hiring decision, it may fall under FCRA, requiring specific disclosures and consent from the candidate. This ensures fairness and accuracy in background checks and provides candidates with rights to dispute inaccuracies.
• California Consumer Privacy Act (CCPA): California’s CCPA provides consumers with significant rights regarding their personal information, including the right to know what data is being collected about them and to opt-out of its sale. While there have been ongoing discussions about employment-related data under CCPA, its principles of transparency and consumer control are highly relevant. The California Privacy Rights Act (CPRA), which expanded the CCPA, also introduced new provisions impacting employee data, further complicating compliance for businesses operating in California.
• Other State and Local Laws: Many U.S. states have laws restricting employers from demanding access to employees’ or job candidates’ private social media accounts, though public-facing information is generally treated differently. Globally, other countries have their own unique data protection laws that HR departments must be mindful of, such as Brazil’s LGPD or Canada’s PIPEDA.

The implication for organizations is clear: any approach to social media screening must be meticulously compliant with applicable laws. Failure to do so can result in substantial fines, legal challenges, and severe reputational damage. This regulatory complexity underscores the importance of seeking legal counsel and partnering with specialized technology providers who understand and embed compliance into their solutions. HR leaders often express concern over the potential for legal pitfalls, emphasizing the need for robust internal policies reviewed by legal counsel and clear communication with candidates about any screening processes.

Proactive Strategies for Mitigating People Risk in the Digital Age

Rather than defaulting to intrusive monitoring or surveillance, a more effective and ethically sound approach to managing people risk centers on prevention through clarity. As Ben Mones emphasized, a critical first step for many organizations is to update and clarify their codes of conduct. Many existing frameworks are outdated or overly vague, failing to adequately address the nuances of digital behavior.

1. Modernized Codes of Conduct: Policies must explicitly outline expectations for digital conduct, encompassing professional networking sites, personal social media, and online forums. These guidelines should cover:

   • Confidentiality: Prohibiting the sharing of proprietary information, trade secrets, or client data.
   • Respectful Communication: Defining what constitutes appropriate and inappropriate language, especially concerning harassment, discrimination, bullying, hate speech, or defamatory remarks.
   • Brand Representation: Clarifying how employees’ personal online presence can reflect on the organization, especially when identifying as an employee of the company.
   • Conflict of Interest: Guidelines on engaging with competitors or clients online in ways that could create perceived or actual conflicts.
   • Clear Consequences: Detailing the repercussions for violating these policies, ranging from verbal warnings to termination, aligning with existing disciplinary frameworks.

2. Consistent Communication and Training: Simply updating policies is insufficient. These new frameworks must be communicated consistently and reinforced through ongoing training and awareness programs. Employees need to understand not only what is expected of them but why these expectations matter, fostering a sense of shared responsibility for maintaining a positive digital presence and protecting the organizational brand. This includes educating employees on privacy settings, responsible sharing, the permanence of online content, and the potential for even "private" posts to become public. Regular workshops, online modules, and clear policy documentation can help embed these principles.

   

3. Contextual Evaluation Frameworks: Not every negative online signal carries the same weight, and treating them uniformly can lead to unfair or indefensible decisions. HR teams must develop frameworks for evaluating behavior in context, considering factors such as:

   • Frequency: Is this an isolated incident or part of a recurring pattern of problematic behavior? A single ill-judged comment years ago might be viewed differently from a consistent stream of offensive posts.
   • Recency: Did the behavior occur yesterday or five years ago? Older content may hold less relevance, especially if there’s evidence of personal growth or a change in circumstances. Some companies establish look-back periods (e.g., 3-5 years).
   • Severity: How egregious was the behavior? Does it involve violence, hate speech, illegal activities, or is it merely an instance of poor judgment or unprofessional language?
   • Intent: While difficult to ascertain definitively, understanding the apparent intent behind a post can inform decision-making. Was it a joke taken out of context, or a deliberate act of malice?
   • Job Relevance: Is the online behavior directly relevant to the requirements or responsibilities of the role? A different standard might apply to a public-facing role (e.g., marketing, sales) versus a highly internal technical position.
     Such a nuanced approach enables HR to make balanced, defensible decisions that protect both the organization’s interests and the individual’s rights, minimizing risks of discrimination claims.

The Ethical Integration of Technology: AI as an Enabler, Not a Replacement

Technology, particularly AI-powered platforms, is increasingly integral to managing people risk. Tools like Fama are designed to help organizations surface job-relevant insights from publicly available data, efficiently flagging potential risks such as threats, harassment patterns, or indicators of violence. However, a crucial tenet, as Ben Mones underscored, is that these tools must support human judgment rather than replace it. Industry figures in HR technology widely agree that AI’s strength lies in its ability to process vast datasets and identify patterns, thereby augmenting human capabilities, not supplanting them.

The ethical deployment of AI in hiring and risk assessment demands:

• Transparency and Explainability: Avoiding "black-box" scoring systems where decision-making processes are opaque. HR teams and candidates should understand how AI arrived at its conclusions and what factors were considered. This builds trust and accountability.
• Human Oversight: AI should act as a filter, highlighting potential areas for human review, not as a final arbiter. Trained HR professionals must interpret the data within context, applying nuance and understanding that algorithms often lack.
• Clear Candidate Consent: Explicit and informed consent from candidates is paramount before any social media screening is conducted. They should be aware of what data is being accessed, by whom, and for what purpose, with clear opt-out mechanisms where legally permissible.
• Careful Data Handling: Strict adherence to data privacy principles, including data minimization (only collecting what is necessary and relevant to the job role), secure storage, and timely deletion of data once its purpose is fulfilled. Regular data audits are essential.
• Bias Mitigation: AI algorithms can inadvertently perpetuate or amplify human biases present in training data. Rigorous testing and continuous auditing are required to identify and mitigate algorithmic bias, ensuring equitable treatment for all candidates, regardless of background or demographics. This often involves diverse training datasets and fairness metrics.
• Job Relevance Filter: AI tools should be configured to identify only job-relevant information, filtering out protected characteristics (e.g., religion, political affiliation, sexual orientation) or irrelevant personal data, unless directly related to the role’s bona fide occupational qualifications.

The Future of Hiring: AI as a Skill to Evaluate

Looking further ahead, the conversation around AI in hiring is poised to become even more nuanced and transformative. An intriguing idea raised by Mones suggests a future where employers may not only tolerate but actively encourage candidates to leverage AI tools during the hiring process. In this scenario, the critical differentiator would no longer be whether a candidate uses AI, but how effectively they use it.

This represents a profound philosophical shift: from viewing AI as a potential cheat or a tool to be restricted, to an essential capability to be evaluated. It would necessitate new assessment methods that gauge a candidate’s ability to:

• Prompt Engineering: Formulate effective, precise, and strategic queries to AI tools to achieve desired outcomes.
• Critical Evaluation: Discern accurate, relevant, and unbiased information generated by AI, identifying potential hallucinations or misleading outputs.
• Ethical AI Use: Understand the limitations and biases of AI and use it responsibly, ensuring fairness and integrity in their work.
• Augmented Creativity and Problem-Solving: Leverage AI to enhance their own cognitive abilities, innovate solutions, and streamline workflows, demonstrating a symbiotic relationship with technology.
• Data Synthesis and Interpretation: Use AI to process complex data and then interpret and synthesize it into actionable insights, showcasing higher-order thinking.

Such a paradigm would signal a broader evolution in how organizations perceive technology – not merely as a threat to be controlled, but as a powerful enhancer of human potential, whose mastery becomes a core competency. This could fundamentally redefine what "talent" means in the age of generative AI, pushing HR to design assessments that test these emerging skills rather than just traditional knowledge.

Broader Impact and Strategic Implications for HR Leaders

The fundamental nature of people risk—the potential for human behavior to negatively impact an organization—remains unchanged. However, its visibility, permanence, and potential for rapid amplification have escalated dramatically. For HR leaders, the challenge is multifaceted: to develop a robust, proactive strategy that protects organizational culture and brand, while simultaneously upholding fairness, respecting privacy, and fostering a culture of trust.

Organizations that proactively recognize this shift and adapt their approaches will be best positioned for success. This requires moving beyond a reactive stance to a more integrated view of online behavior—not as a separate category of personal conduct, but as an integral component of how individuals present themselves, interact, and ultimately represent the organizations they are part of.

This strategic adaptation will necessitate:

• HR as Strategic Risk Managers: Moving beyond administrative functions to become key players in enterprise-wide risk management, particularly concerning human capital. This involves anticipating risks, developing mitigation strategies, and advising leadership.
• Interdepartmental Collaboration: Working closely with legal, IT, communications, security, and executive leadership to develop holistic policies, implement robust technological solutions, and coordinate effective crisis communication strategies when online incidents occur.
• Continuous Learning and Adaptation: Staying abreast of evolving technological capabilities (e.g., new AI models, emerging social platforms), regulatory changes (e.g., new data privacy laws), and shifting societal norms regarding digital conduct.
• Building a Culture of Digital Responsibility: Fostering an environment where employees understand their role in protecting the company’s reputation and contribute positively to its online presence, viewing their digital identity as an extension of their professional self. This involves promoting digital literacy and ethical online conduct from onboarding onwards.

Ultimately, the digital transformation of professional conduct demands a holistic and ethical response from HR. By embracing clarity over control, context over rigid rules, and human judgment augmented by responsible technology, organizations can navigate the complexities of people risk in the AI era, safeguarding their values and ensuring sustainable growth in an interconnected world.