Misuse of social media to harass,
intimidate or threaten NHS staff
May 2016
Contents
1. Background ................................................................................................. .2
2. Purpose ....................................................................................................... 2
3. Risks ........................................................................................................... .2
4. Legal framework ......................................................................................... .3
5. Precautionary measures ............................................................................. .8
6. Dealing with an incident ............................................................................. 10
7. References................................................................................................. 11
8. Contact details ........................................................................................... 12
1
1.
Background
Social media allows people to interact with one another, to share information, knowledge
and opinions; social media now penetrates every facet of our society, with few workplaces
exempt from its influence.
It has evolved quickly and is now considered to be an invaluable communication tool, used
as much for social and political commentary as it is to keep in touch with family and friends.
However, it can expose staff to various security risks if sufficient care and safeguards are not
employed to help protect the individual.
Patients and the public may seek to use social media to identify personal information about
NHS staff with a view to embarrassing, discrediting, harassing, threatening or blackmailing
them or their families for their own benefit.
2.
Purpose
Staff working in the NHS, due to their role and the public nature of their position, are
vulnerable to incidents involving the misuse of social media by patients and members of the
public.
This short guide has been developed to provide advice to Local Security Management
Specialists (LSMS) to enable them to support and advise NHS staff working within health
and social care settings of their position when there has been a misuse of social media. It
will also assist LSMS in raising awareness of the issues within their trusts and provide good
practice advice to assist in developing or updating local policies and procedures in relation to
the use of social media.
This document is meant as guidance only and nothing in it constitutes legal advice. It
will be for individual trusts to obtain their own legal advice on any specific case.
The NHS Security Management Manual (Chapter 9) refers to non-physical assaults and
nuisance behaviour via telephone, written communications or electronic media. This
document highlights some of the potential offences which may be committed when social
media is misused to harass, intimidate or threaten NHS staff.
Finally, this guide is not intended to provide detailed guidance on the standards of behaviour
expected of NHS staff when using social media. This should be covered in an organisation’s
HR policies and within a staff member’s Professional Codes of Conduct.
3.
Risks
The safe use of social media channels requires an appreciation of the associated risks.
Revealing personal information, beyond just your name, exposes NHS staff to the risks to
personal safety mentioned above.
2
Information placed on social media can potentially end up in the public domain and be seen
and used by people it was not intended for. Furthermore, even content uploaded
anonymously can, in many cases, be traced back to its author.
Staff are cautioned against making any comment or posting any images (e.g. of
inappropriate behaviour) which might place them in a compromising position or threaten their
safety.
Staff who post their images or their personal information online do so at their own risk. NHS
staff should be mindful of the viral nature of social media where, potentially, the smallest
piece of seemingly innocuous information can be seen by patients and members of the
public. Where staff choose to post images or personal information about a third party, these
actions may constitute a criminal offence or attract civil liability in their own right.
NHS staff should be mindful of using social media when their judgment is impaired, for
example after consuming alcohol.
4.
Legal framework
A number of criminal offences may be committed against NHS staff by reason of the nature
or content of a communication sent on social media. This also applies to the reposting (e.g.
re-tweeting) of such communications.
In determining whether a communication sent on social media may amount to a criminal
offence, the content of the communication together with the conduct in question are both
relevant considerations.
The Crown Prosecution Service (CPS) guidance ‘Prosecuting cases involving
communications sent via social media’1 distinguishes between four categories:




Communications which may constitute credible threats of violence to the person or
damage to property.
Communications which specifically target an individual or individuals and which
may constitute harassment under section 2 or section 4 of the Protection from
Harassment Act 1997 or stalking falling within section 2A or 4A of that act. Stalking is
not limited to following the aggrieved but includes contacting, or attempting to
contact, by any means or publishing any statement or other material relating to the
aggrieved.
Communications which may amount to a breach of a court order.
Communications which do not fall into any of the preceding categories and fall to be
considered separately, as being grossly offensive, indecent, obscene or false.
1
The Crown Prosecution Service - Guidelines on prosecuting cases involving communications sent via social
media http://www.cps.gov.uk/legal/a_to_c/communications_sent_via_social_media/
3
The general approach
As a general rule, cases falling in any of the categories above should be robustly prosecuted
where they satisfy the Full Code test in the CPS’s Code for Crown Prosecutors.2 Cases that
fall within the final category are subject to a ‘higher threshold’ and therefore in many cases a
prosecution is unlikely to be in the public interest.
For further detailed information on offences referred to in this guidance please see the NHS
Security Management Manual.
Category considerations
1) Credible threats
Communications which may constitute credible threats of violence to the person may fall
to be considered under section 16 of the Offences Against the Person Act 1861 (threats
to kill) if the threat falls within the provision of the section.
Other credible threats of violence to the person may fall to be considered as conduct
causing fear under section 4 of the Protection from Harassment Act 1997 or stalking
involving the fear of violence or serious alarm or distress, under section 4A, if they
amount to a course of conduct within the provisions of the relevant section.
Credible threats of violence to the person or damage to property may also fall to be
considered under section 1 of the Malicious Communications Act 1988, which prohibits
the sending of electronic communications which convey a threat, or section 127 of the
Communications Act 2003, which prohibits the sending of messages of a ‘menacing
character’ by means of a public electronic communications network.
It is important to note that threats which are not considered credible will not, as a general
rule, be considered suitable for prosecution unless they form part of a campaign of
harassment specifically targeting an individual.
2) Specifically targeted individual(s)
Communications sent on social media that target a specific individual or individuals will
fall to be considered under this category if they fall within the scope of the protection
from harassment legislation and constitute harassment or stalking.
Harassment can include repeated attempts to impose unwanted communications or
contact upon an individual in a manner that could be expected to cause distress or fear
in any reasonable person.
Stalking is not defined in statute, but a list of behaviours which might amount to stalking
for the purposes of the Protection from Harassment Act 1997 are contained in section
2
th
The Code for Crown Prosecutors - 7 Ed. (2013)
https://www.cps.gov.uk/publications/docs/code_2013_accessible_english.pdf
4
2A(3) of the act. Behaviour which, in particular circumstances, can be associated with
stalking includes ‘contacting or attempting to contact a person by any means’.
When considering an offence under the Protection from Harrassment Act, it will be
necessary to prove that the offender pursued a course of conduct which amounted to
harassment or stalking. The Act states that a ‘course of conduct’ must involve conduct
on at least two separate occasions. The smaller the number of incidents, the less likely a
finding of harassment will be reasonable; current case law states that the two occasions
should not be separated in time by more than 6 months.
A course of conduct may often include a range of unwanted behaviour aimed towards an
individual and a communication sent on social media may be just one manifestation of
this. Where an individual receives unwanted communications from another person on
social media in addition to other unwanted behaviour, all the behaviour should be
considered together in determining whether or not a course of conduct is made out.
Hate crimes
Where there is evidence, at the time it is considered that an offence has been committed
(in either of the above categories) or immediately before or after, of hostility or prejudice
demonstrated towards the victim:
a) based on the victim’s membership (or presumed membership) of a racial group;
or
b) the offence was motivated (wholly or partly) by hostility towards members of a
racial group based on their membership of that group
Consideration should be given, wherever possible, to pursuing the more serious racially
or religiously aggravated offence. Similarly, increased sentences following a successful
prosecution should also be sought for aggravated offences related to disability, sexual
orientation or transgender identity.
3) Breach of court orders
Court orders can apply to those communicating on social media in the same way as they
apply to others; therefore any communication on social media that may breach a court
order falls to be considered under the legislation granting the order.
Careful consideration should also be given to whether the communication in question
has breached the requirement of another accompanying order, such as a restraining
order (e.g. one which is designed to protect a person from harassment, stalking or
violence) or if it would constitute a breach of bail conditions.
4) Communications which are grossly offensive, indecent, obscene or
false
Communications which do not fit within any of the categories outlined above fall to be
considered under either section 1 of the Malicious Communications Act 1988 or section
127 of the Communications Act 2003. These provisions refer to communications which
5
are grossly offensive, indecent, obscene, menacing or false (please note that menacing
communications should be dealt with under category 1 above - credible threats).
Section 1 of the Malicious Communications Act 1988 deals with the sending to another
of an electronic communication which is indecent or grossly offensive (these words were
held to have their ‘ordinary everyday’ English meaning), which conveys a threat or which
is false, provided there is an intention to cause distress or anxiety to the recipient. It is
important to remember the offence is one of sending, delivering or transmitting, so there
is no legal requirement for the communication to reach the intended recipient.
Section 127 of the Communications Act 2003 makes it an offence to send or cause to be
sent through a ‘public electronic communications network’ a message or other matter
that is grossly offensive or of an indecent, obscene or menacing character. It is also an
offence to send or cause to be sent a false message “for the purpose of causing
annoyance, inconvenience or needless anxiety to another”. For example, a message
sent on Twitter is sent on a “public electronic communications network” because it is
accessible to all who have access to the internet.
It is important to remember that what is prohibited by the two Acts is the sending of a
communication that is grossly offensive. A communication sent has to be more than
simply offensive to be contrary to the criminal law. Just because the content expressed
in the communication is in bad taste, controversial or unpopular and may cause offence
to individuals or a specific community, this would not in itself be sufficient reason to
engage the criminal law.
The offender must be shown to have intended the message to be grossly offensive,
indecent or menacing, or be aware that it was; this might be inferred from the terms of
the message or from the offender’s knowledge of the likely recipient. The offence is
committed by sending the message; there is no requirement that any person see the
message or be offended by it.
What is meant by ‘higher threshold’ (at the evidential stage)?
Millions of communications are sent on social media daily. Therefore the application to them
of section 1 of the Malicious Communications Act 1998 and section 127 of the
Communications Act 2003 creates the potential for a very large volume of criminal cases to
be brought before the courts.
This would inhibit or discourage free speech and the legitimate exercise of natural and legal
rights because of the threat of legal sanction. Prosecutors therefore have to exercise
considerable caution in deciding whether to bring charges under the above legislative
provisions, based on whether the higher evidential threshold is met and it is in the public
interest to pursue. Even if the higher evidential threshold is met, in many cases a
prosecution is unlikely to be required in the public interest.
Since the relevant provisions of both the Malicious Communications Act 1988 and the
Communications Act 2003 will often engage Article 10 of the European Convention on
6
Human Rights (right to freedom of expression), prosecutors must interpret these provisions
consistently with the free speech principles in that article.
As the European Court of Human Rights has made clear, Article 10 not only protects speech
which is well-received and popular, but also speech which is offensive, shocking and
disturbing (Sunday Times v UK (No.2) [1992] 14 EHRR 123):
‘Freedom of expression constitutes one of the essential foundations of a democratic
society…it is applicable not only to ‘information or ideas’ that are favourably received or
regarded as inoffensive or as a matter of indifference, but also as to those that offend, shock
or disturb…’
However, freedom of expression is not an absolute right. Article 10 may be restricted in
accordance with the conditions set out in the article itself, but only where a restriction can be
shown to be both necessary and proportionate.
The grounds for restricting Article 10 rights can include those prescribed by law and
necessary in a democratic society for the protection of the reputation and rights of others.
Exceptions to ECHR rights must be narrowly interpreted and the necessity for any
restrictions convincingly established.
Context and approach
The context of the communication is vitally important, as communications on social media
takes place in quite a different context than on other channels. Banter, jokes and offensive
comments are commonplace and often spontaneous. Communications intended for just a
small restricted audience may, through no fault of the author, reach millions.
Against this background, cases will only be considered for prosecution under the relevant
provisions of the Malicious Communications Act 1998 and the Communications Act 2003
where there is sufficient evidence that the communication in question is more than:



offensive, shocking or disturbing; or
a satirical, iconoclastic or rude comment; or
the expression of unpopular or unfashionable opinion about serious or trivial matters
or banter or humour, even if it is distasteful to some or painful to those subjected to it.
If this is satisfied, then consideration can be given as to whether a prosecution is required in
the public interest.
The issue in social media cases can be whether the whole message or communication is
grossly offensive, indecent, obscene or false. For example, an image that in itself falls short
of being offensive or obscene may become offensive when considered in the context of the
message as a whole (e.g. the circumstances in which it was sent or the people to whose
attention it was brought).
Public interest test
Since section 1 of the Malicious Communications Act 1998 and section 127 of the
Communications Act 2003 will often engage Article 10 of the European Convention on
7
Human Rights, no prosecution should be brought unless it can be shown on its own facts
and merits to be both necessary and proportionate.
A prosecution is unlikely to be both necessary and proportionate where one or more of the
following conditions apply:




the suspect has expressed genuine remorse
swift and effective action has been taken by the suspect and, or others (e.g. service
providers) to remove the communication in question or otherwise block access to it
the communication was not intended for a wide audience, nor was that the obvious
consequence of sending the communication (particularly where the intended
audience did not include the victim or target of the communication in question)
the content of the communication did not obviously go beyond what could
conceivably be tolerable or acceptable in an open and diverse society which upholds
and respects freedom of expression.
This is not an exhaustive list, and each case must be considered on its own facts and its
own individual merits.
In particular, where a specific victim is targeted and there is clear evidence of an intention to
cause distress or anxiety, careful consideration should also be given to the effect on the
victim where there is a hate crime element to the communication(s). A prosecution for an
offence under section 1 of the Malicious Communications Act 1998 may be in the public
interest in such circumstances, particularly if the offence is repeated; alternatively a
prosecution may be merited for an offence under section 127 (2) of the Communications Act
2003 in respect of the persistent use of a public electronic communications network for the
purpose of causing annoyance, inconvenience or needless anxiety to another, assuming the
higher evidential threshold for a prosecution has been passed.
Public order legislation
Although some cases falling within categories 1 or 2 above may fall to be considered under
public order legislation, such as Part 1 of the Public Order Act 1986, particular care must be
taken in dealing with social media cases in this way because public order legislation is
primarily concerned with words spoken or actions carried out by a person in the presence or
hearing (i.e. in the physical proximity) of the other person being targeted.
5.
Precautionary measures
This section sets out some general principles for the protection of NHS staff. While it is not
intended to cover every social media situation, it aims to provide LSMSs with guidance on
how staff may use social media and social networking sites responsibly and what they
should do if they find themselves the target of unacceptable behaviour by patients or
members of the public.
The principles can also be applied to other kinds of online communications, such as
personal websites and blogs, discussion boards and general content shared online,
including text, images, and video and audio files.
8
Professional conduct
The NHS Employers website lists social media guidelines for various regulators and
professional bodies. Each professional body has its own Code of Practice which contains
statements on the conduct expected of NHS staff.
http://www.nhsemployers.org/your-workforce/need-to-know/social-media-and-the-nhs/socialmedia-guidelines
In some NHS professions an individual’s registration may be at risk if they act in any way
that is unprofessional or unlawful. This includes their behaviour on social media.
What staff should consider before using social media
Staff should consider the following advice:










read your organisation’s social media policy and, or your profession’s social media
guidance
familiarise yourself with how social media applications work and be clear about the
advantages and disadvantages
think carefully about any information that you may post online: sharing information
online can potentially be more damaging than sharing it verbally due to the speed at
which it can be shared and the size of the potential audience
consider whether the information being shared could in any way compromise your
professionalism or your reputation
recognise the potential for the misuse of social media, through threatening,
harassing, prejudicial, discriminatory or offensive comments and behaviours (see the
Legal framework section above)
consider your association with the people you interact with or the content that is
being posted: acknowledging someone else’s post can imply that you endorse or
support their point of view
have clear professional boundaries at all times with your work colleagues and people
in your care (including those who have been in your care in the past), their families
and carers
always demonstrate respect and professionalism towards, patients or service users
by respecting their dignity, right to privacy and confidentiality
do not make allegations of misconduct and/or illegal practices against a member of
staff on social media; these matters should be reported to a line manager, senior
management or the LSMS
in cases of suspected wrongdoing by fellow members of staff, independent advice is
available from the National Whistleblowing Helpline (http://wbhelpline.org.uk/) or the
whistleblowing charity Public Concern at Work (http://www.pcaw.org.uk/
9
What staff should do when using social media
Staff should consider the following advice:










6.
ensure privacy settings are set at the appropriate level; keep the disclosure of
personal information to an absolute minimum
restrict and control the personal information you do disclose, such as date of birth,
personal email address or personal phone number by ensuring security settings are
set at the appropriate level
the use of an NHS email address or work telephone number is discouraged; these
should be used for business purposes only
do not post details of your employer, journey to work, or place of work, to minimise
the risk of being approached or contacted
disclosing family members’ details places them, as well as yourself, at risk
avoid disclosing details of any places you frequent or vehicles that you use
avoid posting any images (such as you wearing a uniform, or in a specific hospital
location) which may identify your place of work or residence
be aware that your location may be unwittingly embedded within photographs and
other content and available for others to see
do not post images or personal information of colleagues without their consent; any
postings about a colleague which may be to the detriment of the individual concerned
may constitute a criminal offence and be subject to legal action
do not associate in any way with any inappropriate material on social media, which
could be interpreted or deemed offensive to others and/or may, depending on the
circumstances, constitute a criminal offence or result in civil proceedings.
Dealing with an incident
If an NHS employee feels they have been the victim of a social media attack, they should
contact their line manager, HR and, or their LSMS as soon as possible. The matter should
also be reported on the organisation’s internal incident reporting system.
To assist with any internal investigation, employees should retain any available material
which may be required for evidential purposes, such as copies of messages and screen
shots.
If an allegation is received by an LSMS, they should ensure that all visual, audio and
hardcopy material is gathered, documented and secured.
The organisation should be able to advise the individual concerned about the process for
contacting the social media provider to have unfair or inaccurate posts about them removed;
however it should be noted that the service provider is not obligated to remove such posts,
unless they falls within one of the limited categories mentioned above.
Where libellous or defamatory statements have been placed on a website and the operator
has been contacted, made aware of the statements and asked to remove them, and this has
been ignored, then the operator may be committing an offence under the Defamation Act
2013.
10
Section 5(3) of the act states that an operator may be liable for an action of defamation in
respect of a statement posted on their website, if the victim can show that:
a) it was not possible for the claimant to identify the person who posted the statement
b) the claimant gave the operator a notice of complaint in relation to the statement, and
c) the operator failed to respond to the notice of complaint in accordance with any of the
provisions contained in regulations.
We strongly recommend that employees never contact the individual who posted the
personal data, as this may escalate the situation and lead to a continuation of the behaviour.
It also increases the risk of an offender using that contact as justification for their behaviour.
If the recipient finds the communication harassing, threatening or offensive they should seek
advice from their line manager, HR and, or LSMS and should be encouraged to contact the
police.
It is the responsibility of the LSMS to liaise with line managers following an incident, to
review it and decide what, if any, further internal action should be taken, or whether the
matter should be referred to the police.
For cases that can be resolved internally and where an aggrieved party consents to this
being done, organisations should have an informal resolution and internal sanctions policy
which covers social media cases.
Where behaviour escalates in seriousness and, or constitutes threats, harassment or
stalking, the police should be involved.
In the event that there is a clear and present threat to a member of staff, they should contact
the police immediately. If the staff member has not already done this, the LSMS should do
so without delay.
7.
References
NHS Employers - Quick guide for new starters – New to the NHS? Your guide to using
social media In the NHS
http://www.nhsemployers.org/~/media/Employers/Publications/NOVEMBER%20Your%20gui
de%20to%20using%20social%20media%20in%20the%20NHS.pdf
The Crown Prosecution Service - Guidelines on prosecuting cases involving
communications sent via social media
http://www.cps.gov.uk/legal/a_to_c/communications_sent_via_social_media/
Get safe online
https://www.getsafeonline.org/protecting-yourself/
Information Commissioners Office – Social networking and online forums- when does the
DPA apply?
https://ico.org.uk/for-organisations/guidance-index/data-protection-and-privacy-andelectronic-communications/
11
8.
Contact details
Any enquiries about this document should be directed to the Policy and Standards or Legal
Protection Unit email inbox ([email protected] or [email protected]).
12