Businesses operating in regulated industries (that is, industries subject to rules and regulations promulgated by governmental agencies and departments) are challenged by the use of websites and other online tools which permit users and readers to interact by sharing and distributing information and content (collectively, “Social Media”). While Social Media presents new professional opportunities for building interactive communities and social networks, it also exposes a Company to potential regulatory violations. Recently, incidents in the pharmaceutical and financial services sectors arising from two companies’ impermissible use of Social Media exemplify the potential risks. Together, these incidents illustrate the need for regulated companies to address Social Media use by implementing policies and procedures that are reasonably designed to prevent violations of the statutes under which they operate.
Novartis and the FDA
The United States Food and Drug Administration (“FDA”) recently determined that Novartis violated various provisions of the Federal Food, Drug, and Cosmetic Act (the “Act”).1 The violations arose out of a Facebook “share” application located on the Novartis website for its drug Tasigna. The share application permitted Novartis to share the contents and information of the Tasigna website with consumers and members of the public through Facebook. Once shared by a Facebook user, the Tasigna-related content could easily become posted via newsfeeds and wall postings, and could even be forwarded to other Facebook users as a message.
The FDA determined that the shared content was misleading, inadequately discussed facts about the drug, and generally led consumers to believe the drug was indicated for more uses than the FDA had approved. The FDA took the position that the shared content constituted promotional materials about Tasigna. The Act requires drug promotional materials to disclose risk information about the drug. Since the shared content discussed the efficacy of the drug but did not disclose the risks appurtenant to its use, the content was misleading and was used in an impermissible manner. The FDA also found that the shared content included brief statements about the drug’s indications, which, upon review, were determined to be more expansive than the indication for which the FDA granted approval. For these and other reasons, the FDA concluded that Novartis’ statements in the shared content violated the Act, and requested Novartis cease further dissemination of violative materials.
Financial Services and Social Media
The United States Securities and Exchange Commission (“SEC”) recently brought an enforcement action against a group of individuals who the SEC alleged invited members of the public to subscribe to stock alerts received through Social Media, including Facebook in connection with a Ponzi-like scheme that they were operating.2 Relatedly, the Financial Industry Regulatory Authority (“FINRA”) recently warned investors against fraudulent investment schemes occurring through Social Media websites.3 Securities administrators and regulatory bodies governing the financial services industry are concerned that purveyors of fraud are utilizing Social Media to identify investors and create legitimacy for illegal investments.
In an effort to prevent harm to the public arising from Social Media use, FINRA imposes responsibility on FINRA-member firms to supervise the actions of their personnel in using Social Media. Similarly, the SEC imposes a supervisory requirement on non-FINRA firms that act as fiduciaries to their clients. We believe that it is possible that FINRA-member and non-FINRA firms could be held liable for securities law violations arising out of Social Media use by their personnel.
What Can Companies in Regulated Industries Do to Avoid Exposure Arising From Their Use of Social Media?
Each business should adopt a Social Media policy that is consistent with the standards of its industry. The policy should address the business’s expectations for Social Media use, establish limitations on sharing and postings (if any), address recordkeeping and marketing considerations, and discuss internal affirmative reporting obligations as may be required of the company under applicable law. Where the business operates in a regulated environment, the policy must also reflect the statutory and regulatory considerations required in order for the business to maintain regulatory compliance.
The business should then implement procedures that are necessary to effect the Social Media policy and that address enforcement of those procedures. The policy and its underlying procedures should then be reviewed on an annual basis to ensure that they remain accurate and current given the evolution of the business, changes in the regulatory landscape, and any issues which arose during the immediately preceding year.
We expect regulators to continue to adopt rules on Social Media use on an ongoing basis. We recommend contacting an attorney to assist with analyzing those rules and determining the impact that they may have on you and your business.
1 See Letter from Karen R. Rulli, Acting Group Leader, Division of Drug Marketing, Advertising and Communications, U.S. Food and Drug Administration, to Lisa Drucker, Director, Regulatory Affairs – Oncology, Novartis Pharmaceuticals Corporation (July 29, 2010).
2 See SEC v. Carol McKeown, et al., Civil Action 10-80748-CIV-COHN (S.D. Fla. June 23, 2010).
3 See FINRA Investor Alert, HYIPs – High Yield Investment Programs Are Hazardous to Your Investment Portfolio, July 15, 2010.