If an associate attorney in our law firm tweets a message critical of our bonus practices, we can discipline her, right? Not necessarily. As social media continues to morph and multiply, so do the legal complexities for employers seeking to monitor and curb “online” statements about the workplace.

Historically, employers have maintained strict rules to discourage public discussion about the workplace. Most of us, as employers, think of these as “private” matters to be discussed and resolved internally. We don’t want customers, clients or competitors viewing our dirty laundry. The risk we face is that our efforts to maintain the company’s privacy may conflict with our employees’ rights to engage in “protected concerted activity,” that is, to join together and talk about the terms and conditions of employment that affect them all.

Over the last few years, the National Labor Relations Board (NLRB) has become increasingly active on behalf of workers in this arena. The NLRB enforces employees’ rights under the Depression era National Labor Relations Act — the landmark legislation that codified the right to unionize. Under the Act, union and non-union workers alike must be permitted to share among themselves their questions and concerns about the terms and conditions of their employment situation. While social media may reach a very broad audience, part of that audience likely includes co-workers. So, according to the NLRB, improper restrictions on what an employee can or cannot say could run afoul of his right to share concerns with co-workers.

So, anything goes? No. There are limits between social messaging that deals with substantive issues and messaging that is merely personal griping. Employees don’t have carte blanche to be vulgar or insubordinate, or to publish information that is necessarily confidential or highly sensitive.

What should employers do? First and foremost, review your existing policies. They may need to be updated with carefully tailored language designed to restrict specific conduct without creating a blanket prohibition against social media communication. If you don’t have a policy, you need to create one. Once the right policy is in place, make sure you educate workers and supervisors alike to ensure that no one unwittingly runs afoul of either the policy or the law.