Last month, the Securities and Exchange Commission sued Tesla founder Elon Musk, in part on the basis of leaked online messages—resulting in a $20 million fine and Mr. Musk stepping down from the position of chairman of Tesla’s board of directors. Justine Sacco, a PR executive, was fired after a tweet to her 170 followers, “Going to Africa. Hope I don’t get AIDS. Just kidding. I’m white!” went viral. Earlier this week, The New York Times published a feature about a software developer who had died by suicide after a viral video of him throwing a sandwich at a fast food employee rendered him unemployable.

2.9 billion people are projected to use social networks by 2020—and the reputational risks to corporations and individuals abound. BRINK News spoke with Emma Sadleir, founder of The Digital Law Company in South Africa and expert on social media law, about the broad landscape of risk on social media and the blurring—or perhaps nonexistent—line between private and professional life.

BRINK News: To start us off, can you tell us a bit about the biggest threats facing employees and organizations that use social media?

Emma Sadleir: So I think that the biggest threat from the corporate point of view would be the reputational risk posed by employees. In the old days, you could almost manage your company’s voice by determining who could speak on its behalf. You can do that now to a certain extent, but the way we self-regulate in today’s online world is different. The first thing we do in South Africa when we see somebody’s got it wrong, is we find out where that person works and then we try and get that person fired: “Have you seen what your employee said? Are you happy to be associated with this kind of person?” I think that we’ve seen that this sort of reputational harm is more powerful than any legal or disciplinary consequence could be.

We just had a recent case of this in South Africa with a guy called Adam Catzavelos. He was on a beach in Greece, taking a selfie video, and he used the K-word, a racist slur in South Africa. It was fascinating how quickly the mob worked out exactly who he was, where he worked, which companies he’s been associated with, which ones his family has been associated with. His wife was a merchandiser for Nike, and even Nike stores in South Africa had to close because they were concerned about the safety of employees. That was this guy’s wife. The school his children attend released a statement saying that the father was not allowed to step foot on their premises.

BRINK: When it comes to reputational risk, should an employer be worried about the relatives of an employee? Should an employer be worried about friends and connections of employees?

Ms. Sadleir: If I’m in South Africa and my husband is in Greece and murders somebody, should that mean that I get fired in South Africa? There has to be more in that case. But I am starting to see companies include spouses, children and people who are direct beneficiaries of the employee in their social media policies. Employees must educate the family, educate the people around them to make sure that nobody is compromising the interests of their employer on their social media accounts.

If we go back to the Catzavelos case, compared to the murder example, racism is such an endemic thing in a person. If Mr. Catzavelos is capable of this kind of content when relaxed on the beach, this isn’t his first rodeo. It’s not the first time he’s used this kind of word. That’s part of his daily parlance, I would say. And that was really why I think the family was brought into it in such a dramatic way in this case.

If you look at the strict fundamentals of labor law, if you bring the company into disrepute, then you can be disciplined. If people are calling for a boycott of your company, then you have brought the company into disrepute. Things spread like wildfire, and we live in a post-truth era. One of the tasks of any company is to act swiftly and look after their reputational concerns—but then also to make sure that they investigate every single matter instead of just reacting.

BRINK: There have been several high-profile examples of people acting in bad faith, dredging up old tweets or organizing a brigade of people to get somebody fired. In an instance where something like this happens, what is a user’s responsibility?

Ms. Sadleir: I often say that the best thing about social media is that it gives everyone a voice, and the worst thing about social media is that it gives everyone a voice. If you find yourself a victim of false news, somebody dredging up old content, you lose context, you lose time, you lose control of your audience. This is why I think you have to be so hyper-aware of what you’re saying in digital format. One of the things you can do is you can use the voice that social media gives you to correct what the mob is getting wrong. In the old days, you’d have to rely on sympathetic media or journalists or somebody who knew a journalist or a PR person, but now we all have this voice.

There is no such thing as “personal capacity” on social media. Or anywhere. If you hurt the reputation of your company, you can be disciplined.

Ultimately, it’s not a question of a potential employer potentially checking you out online. I think if they don’t, they’re acting negligently. Because, as soon as a person starts working for you, their online reputation is inextricably linked to the reputation of your company. Before any of my clients ever meet with my employee, they’re going to Google them. We need to appreciate that we’re all celebrities in the digital age. For me, an online CV is actually more telling than a real-world CV.

BRINK: It doesn’t seem as though companies or organizations are equipped to handle situations in which bad faith attacks are leveled against their employees. If you’re an organization and you see this happening to one of your employees, what is your responsibility?

Ms. Sadleir: I think it’s not to respond too quickly. You’ve got to say you take allegations seriously. If you’ve got employees caught up in one of these things, I think the first step is to say, “We take these allegations very seriously.” Then you investigate it, and you ventilate the issues, and you get the employee’s side of the story, and you understand what’s happened, and then you work out whether it’s compatible with the company’s values. Any kind of past content that could cause problems should really be picked up in the recruitment phase.

BRINK: When people post something to social media, they tend not to consider legal ramifications or any kind of ethical or compliance obligations. Should they, and what exactly should they be considering when they’re posting?

Ms. Sadleir: I always go back to two tests. The first is the tummy test, which is when you just want to post, tweet, share whatever, and you get that little feeling in your tummy that’s like, “Is this a good idea?” I also rely on what I call the billboard test, which is simply to say: If you wouldn’t put it on a massive, huge billboard next to a very busy highway near where you live and work, with a huge photograph of your face, name, and the name of the company you work for, and the logo of the company you work for, then don’t let it exist in digital format. I used to say “Don’t put it on social media,” and now I say “Don’t let it exist in digital format,” because screenshots open up the potential for content to be forwarded and distributed so quickly. Phones get hacked, phones get lost, phones get stolen.

It’s sometimes tricky trying to come up with a global standard here, because each country does their own thing, especially America. In simple terms, as soon as content’s been seen by one other person, then all the laws kick in, we treat that content legally, as if you’d published it on the front page of the newspaper. So what that really means is there’s no difference in what I say, what the laws are that apply to what I say on a WhatsApp group to three people, on Twitter to 50,000 people, on the front page of the newspaper or on Facebook. The simple rule is that if it’s illegal in the real world, it’s illegal online. All the laws that would apply to the front page of the newspaper apply to the average social media user.

Social media policies for companies can be an educational tool, a tool that you can use to say to employees “This is what it is to be on social media.” I think a lot of people think “Oh, if it’s a social media policy it doesn’t apply to me because I don’t use social media.” But we’ve seen cases where somebody messed up in the real world, and it gets documented: Even if that person is not on social media, they can still get fired.

BRINK: If somebody is working for a multinational corporation, what standards should they keep in mind, given that their work might touch the United States, Europe, Asia, and so on?

Ms. Sadleir: Err on the side of caution. I think more than just considering being part of some multinational company that’s trans-jurisdictional in nature, it’s the nature of the company that’s important. If you work for an international accounting firm, the company’s values may be much more old school and conservative than the values of a multinational advertising agency specializing in risque social media campaigns. Every company is different, every country is different, and this is why I recommend the billboard test.

BRINK: A lot of questions about what is acceptable online veer into complicated topics that employers may not feel equipped to address. What recommendations would you give to an employer if they had to address these kinds of questions?

Ms. Sadleir: I think that what social media is doing is it’s allowing the person who doesn’t have much of a voice to be able to make real change. It can be incredibly powerful; it gives everyone a voice. But I think that what we have to remind people of is that we live in a capitalist world. When I say to somebody that, if you work for a pork products company, you can’t say that anybody who eats animals should go to hell on social media, they say: “But that’s my view, and how can you censor me and my freedom of speech?” Well, yeah you can say that, but then you can’t work for this company. It’s just a complete incompatibility of values.

My bottom line is that there is no such thing as “personal capacity” on social media. Or anywhere. You are who you are in the real world when you go online. That’s who you are. If you do anything that hurts the reputation of your company, you can be disciplined. And so I get very nervous when people put in their posts the disclaimer that “These are my personal views.” There’s no magic wand that suddenly absolves you of your duties to your company.

BRINK: What are some best practices for organizational social media policies?

Ms. Sadleir: I think the first thing is to write it in very plain language. Make sure people understand what you’re saying. Make it as practical as you can for the organization that you’re in. Try to think of examples that could actually happen to an employee. Make sure people understand the principles of digital content: just how public it is, just how permanent it is.

Also, it’s got to be something that is actually read, not just another policy that gets put on page 723 of the employee handbook.

I love that Warren Buffett quote: “It takes 20 years to form a reputation and 5 minutes to ruin it.” If you keep that in mind, you’ll do things differently.

This conversation has been edited and condensed for clarity.