Social Media Policy

Click here to Download the Social Media Policy

The Social Media Retention Policy aims to establish clear guidelines and procedures for the management, retention, and disposal of content posted on social media platforms. This policy ensures compliance with legal and regulatory requirements, supports effective record-keeping, and promotes transparency and accountability in our social media communications.

The purpose of the Social Media Retention Policy is to ensure compliance with all relevant legal, regulatory, and organizational requirements for record retention. It promotes accountability by establishing clear responsibilities for the creation, management, and disposal of social media content. The policy aims to support effective record-keeping, safeguard sensitive information, and maintain transparency in our social media communications. By managing the lifecycle of social media content, we can enhance the integrity and reliability of our communication channels and mitigate risks associated with improper handling of digital records.

This Social Media Retention Policy applies across the entire diocese, including all individual parishes and departments and are expected to adhere to the guidelines and procedures outlined in this policy. The policy covers all social media platforms and accounts operated by or on behalf of the diocese, including but not limited to Facebook, Twitter, Instagram, YouTube, LinkedIn, and any other platforms used for official communications. All clergy, employees, volunteers, and any individuals or entities acting on behalf of the diocese are required to comply with this policy. It governs the creation, management, retention, and disposal of all types of content, including posts, comments, messages, multimedia, and interactions on social media platforms.

• Ownership and Account Creation

• Accounts once approved must either have 2 active employees administering the account(s) or have at least 1 Chancery staff member within the Technology, Communications, or Development department as an administrator.
• Only designated employees or authorized representatives of the organization are permitted to create, manage, or oversee social media accounts.
• In cases where an employee or authorized representative who manages an organization’s social media account leaves the organization or changes roles, the responsibility for the account must be transferred to a new authorized individual.

• Access and Security
  • Access to the organization’s social media accounts is restricted to individuals who have been specifically authorized by the social media oversight committee or designated authority. Authorized users include social media managers, content creators, and administrators.
  • Each authorized user must have a unique login account. Sharing login credentials among users is strictly prohibited to maintain accountability and security.
  • All passwords must comply with the Password Protection Policy 
• Training and Awareness
  • Regular training sessions should be provided to all authorized users on best practices for social media security, including recognizing phishing attempts, maintaining secure passwords, and following the organization’s social media policies
• Federal and State Laws
  • COPPA/CIPA
    • Children under the age of 18 have specific laws which you must agree to before posting any information or pictures on these individuals. Children under 13 have additional regulations that must be met. Please review these laws to ensure that you are not held liable for violations of these laws
  • FTC (Federal Trade Commission) Guidelines
    • The FTC requires that all advertisements must be clearly disclosed. All Diocesan Identities must be transparent about paid partnerships and sponsorships.
  • Common Law Defamation
    • Please be aware and NJ any and all Common law libel cases have to fill at least one or more of these criteria:
      • False Statement
        • The statement must be objectively false
      • Defamatory in Nature
        • The statement must be defamatory in nature
  • Employment and Labor Laws
    • Employees, volunteers, etc. generally have a right to privacy concerning their personal information and images. This includes not disclosing personal details or images on social media without their explicit consent.
  • Intellectual Property Laws
    • Copyright Law: Ensure that any content posted on social media does not infringe on the copyright of others. This includes images, videos, music, and written content.
    • Trademark Law: Avoid using trademarks of other entities without permission to prevent trademark infringement.
  • New Jersey Open Public Records Act (OPRA)
    1. If your parish receives public funding (including but not limited to grants), certain records may be subject to transparency requirements for social media accounts. Please review these before deleting any records on your social media page
• Incident Reporting
  • In the event of a privacy or compliance violation the employee in question must be retrained 
    1. If the event occurs once more termination may be required in order to ensure the safety and stability of those within the Diocese
  • In case of any phishing or social engineering attempts occur the technology department must be notified in order to properly report them to the appropriate authorities
  • In the event of a security breach, the Data breach response plan must be followed
    1. The technology department must be notified by email at [email protected]
• Record Retention and Disposal of Records
  • In case of local, or federal laws all posts, comments, messages, and associated metadata, must be retained for the required period of those laws
  • Certain records, such as those related to ongoing legal matters or significant events, may need to be retained for longer periods as specified by legal or regulatory obligation

The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the Standard owner. 

All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance. 

An employee found to have violated this Standard may be subject to disciplinary action, up to and including termination of employment.