top of page

Originally published in June 2020.


Fashion Choices


Today you might notice that I am not wearing my signature bow tie, untied or not. Rather, I am wearing a golf shirt with my company’s name and logo on it. In this episode, we’ll consider the significance of such fashion choices and how it can impact the fortunes of dealerships, agencies, and businesses in general.


Social media is a fact of modern life, and the line between what one posts on Twitter or Facebook as an individual and as an employee is becoming increasingly blurry, and may disappear completely.


Let’s begin with a short video that has garnered over 2.6 million views as of this recording.


The young man who created that video did not intend for it to go viral; he made it and sent it to a friend. That friend posted it, and mayhem ensued. As you could see from the clip, behind the young man’s entry-level AR-15 was a golf shirt with his employer’s logo. That employer was a car dealership in Scottsdale, Arizona where the man worked as a salesman. Internet sleuths quickly tracked down the dealership and demanded that he be fired. He was.


Bad Publicity


But that was not enough. In a demonstration of what is referred to as cancel culture, the internet mob hit the dealership’s Yelp page with 1-star ratings. This is not the kind of publicity any dealership wants, or any company for that matter.


Is this an isolated incident? Recently I learned about another dealership whose employee posted an absolutely racist rant on Twitter. The dealership fired him. But that dealership is currently involved in a class action lawsuit alleging discrimination in its lending practices. You can be sure that offensive tweet will find its way into the jury room and increase the odds of punitive damages.


In an age of both widespread social media engagement and an increase of cancel culture, what’s a dealership to do? Social media can be a powerful marketing tool for the dealership, and telling employees they can’t post to Facebook as private citizens can create more problems than it solves.


I don’t believe there is any single step a dealership can take to eliminate the consequences of its employees’ actions, but the following can help.


Social Media Policy Best Practices


First, have a written social media policy in place. Make it clear under what circumstances an employee may identify as a dealership employee. That should be limited to the dealership’s official Twitter, Facebook, and similar accounts. And it should go without saying that any posts are business-related. Be sensitive to the fact that not everyone share’s the dealer’s political party, religious beliefs, or favorite sports teams.


Second, be sure every employee receives, reads, and acknowledges the policy. The policy should stress that employees should not identify themselves as a dealership employee or wear employer-logo’d attire in pictures or videos they post. That policy should stress that as employees and just decent citizens, disparaging anyone for their race, political views, sexual orientation, or anything else is unacceptable. What one person considers a joke another person may reasonably find inflammatory.


What’s done one your own time can impact your employer and your coworkers’ livelihoods. When it comes to social media, be smart, and just be nice.


Third, and most important, is training. Remind your employees that the line between personal and business posts is as good as gone in our current culture. One way to train your employees is to send them all a link to this presentation. Mosaic is developing content on this topic, and will add it to our all-hands curriculum for all of our client dealerships.


For guidance, we have made a copy of Mosaic’s social media policy available through the link below. Of course, any policy you implement should be vetted by local counsel, but this can give you a place to start.








A Risk Assessment should tell you what needs to be done. Implementing Safeguards is the doing. Some Safeguards are mandatory. The ones I consider most important include:


Encryption


Customer data needs to be encrypted both in transit and at rest. Fortunately, many software applications have system settings that can be configured to accomplish this at no cost. A review of the systems inventory should shed some light on where the data resides the requires encryption.


Multi-Factor Authentication (MFA)


This is a big one. The factors include:

  • Knowledge, such as knowing a password.

  • Possession, such as a one-time code sent to a smartphone that you possess

  • Inherence, such as a fingerprint, facial, or retina scan.

Access to customer data requires the use of more than one type of factor. For example, a Knowledge Factor like a password and an Inherence Factor like a fingerprint. Two knowledge factors won't do.


Continuous Monitoring


What the rule calls Continuous Monitoring is commonly called Endpoint Detection and Response or EDR in the IT world. It involves engaging a Security Operation Center or SOC to monitor your network 24/7/365 to detect intrusion attempts and shut them down. It is not cheap but it's very effective.




bottom of page