As the papal helicopter whisked Pope Benedict XVI away from the domes of St. Peter’s Basilica one last time, he officially vacated the most powerful religious position on earth. And as the first-ever pope to tweet, he also left behind more than two million Twitter users who have followed his musings in nine languages since the pope’s account was created in December 2012.

Activity on his Twitter account, @Pontifex, ceased on the day of his departure, February 28. When a new pope is chosen, he will take over the @Pontifex handle, and the account will become active again. “From choice, the Pontifex profile was not personalized, but it clearly refers to the person of the pope,” said the Vatican Radio, according to a story on CNN.com.

The Vatican is hardly known for being cutting edge. But when it comes to its Twitter policy, the organization was prescient enough to set up an account that expressly belonged to the papacy and not to an individual pope. There was no doubt that Pope Benedict’s followers did not belong to him, but to the office. “They were smart in thinking at the outset whether the handle would be associated with the current pope or with the papacy,” says Kendall Whitehouse, technology and media editor at Knowledge at Wharton. “And they made the more flexible choice.”

But not all businesses have showed the same foresight.

In December 2012, tech review site PhoneDog settled a lawsuit against a former editor and blogger, Noah Kravitz, for allegedly misappropriating the company’s Twitter followers for his own gain. Kravitz had amassed 17,000 followers during his four years at PhoneDog. When he left the company in 2010, he changed the name of the Twitter account to @noahkravitz from @PhoneDog_Noah and kept the followers, according to court filings.

PhoneDog said these were the company’s followers, not Kravitz’s. It sought damages of $340,000 for alleged misappropriation over eight months — at $2.50 a follower per month. The case garnered widespread media attention, in part because it put a hard dollar value on a Twitter follower within a legal context.

It also brought to light tricky corporate policy issues around social media: Who owns a Twitter or Facebook account when personal and business uses are blurred? When an employee quits, can he take his account — and his followers — with him? Under what circumstances can a company claim that followers and Facebook friends are its customers?

“Twitter is still relatively new,” Whitehouse says. Five years from now, when it will be more common for people to bring an existing Twitter presence with them to a new job, “it will be harder for the company to claim that the followers accreted [to an existing account] during employment are company property,” he adds. For now, the law is not clear because there is scarce, if any, legal precedent.

Is It Stealing?

For the time being, however, “it’s a situation where we would be relying on pre-social-media law analogies” for guidance, according to Janice Bellace, professor of legal studies and business ethics at Wharton.

If an employee absconded with a filing cabinet full of customer lists, it is clearly stealing, she says. But what if the employee wrote down customer names in a notebook over five years and took it with him when he resigned? He probably could keep the notebook, unless the company had a specific policy against it, Bellace notes. Higher-level employees generally could be barred from contacting customers for several years once they leave a company — but that is an issue primarily related to not competing with a former employer, she adds. It does not pertain specifically to social media.

By their very nature, most social media accounts are designed to be used by individuals — not for corporate entities. “The conditions of use for both Twitter and Facebook are for individual accounts,” Bellace says. “They are designed to be used by individuals.” So, even if Joe Smith used both his and the company’s name in his Twitter handle, Bellace argues it would still be considered an individual account and therefore beyond the grasp of the employer, assuming no corporate policy forbidding such a set-up exists.

A company can prohibit an individual from using the firm’s name in a handle to avoid the impression that the posts are official communication. But absent such a policy, the company cannot force an employee to cease and desist from using an account that includes the corporate name, Bellace notes, adding, however, that if the business set up the account in the first place and required employees to post as part of their job, a case could be made that the account is under the company’s jurisdiction. Still, it is best for the business to spell out the conditions in a written policy, she suggests.

Misappropriation of Trade Secrets

PhoneDog’s legal strategy to gain the upper hand in a murky area of law was to claim that ex-employee Kravitz’s followers were the company’s users and that his alleged unauthorized use of its Twitter account constituted fraud.

The lawsuit, filed in July 2011 in the U.S. District Court in the Northern District of California, said PhoneDog gave Kravitz the Twitter account and password, as well as the handle @PhoneDog_Noah so he could promote the company’s services using social media. As such, PhoneDog argued, the account should be considered confidential company information and be classified as a trade secret.

After Kravitz resigned, PhoneDog said it asked the employee to turn over the Twitter account. Instead, the company alleged, Kravitz just changed the Twitter handle and kept the followers. Later, he would join a rival firm and use the same Twitter account to promote his new employer. In the lawsuit, PhoneDog said Kravitz made “improper” use of the Twitter account to “compete unfairly” against the company for its customers.

As a result of this alleged “trade secret misappropriation, PhoneDog has suffered damages to its business, reputation and goodwill,” the court filing said. Moreover, Kravitz was “unjustly enriched by obtaining the business of PhoneDog’s followers.”

Kravitz told a different story to The New York Times in an article published on December 25, 2011. He said he was allowed to keep the Twitter account if he would post items occasionally for PhoneDog. According to Kravitz, the company sued after he tried to claim 15% of the site’s gross advertising revenue as well as back pay. PhoneDog responded in a subsequent blog post that Kravitz sued the company based on “meritless” employment claims. What actually happened is uncertain because the lawsuit was settled and terms were not disclosed.

The settlement was a disappointing denouement for a social media world watching for a legal precedent. The court did not get an opportunity to rule on whether PhoneDog, or Kravitz, had rights to the Twitter followers. According to Bellace, cases like PhoneDog’s lawsuit are often settled because a company would not gain much by pursuing legal action against a sole employee. Typically, the threat of a lawsuit would be enough to persuade the employee from further using the account, she says. The exception would be an egregious transgression by a high-profile individual that besmirches the company name, which could force a lawsuit.

‘Owning’ Followers and Content

The good news for individual Twitter users is that a company likely cannot own an employee’s followers. The bad news is that neither can the individual.

“No one ‘owns’ their followers as a matter of property,” according to Kevin Werbach, Wharton professor of legal studies and business ethics. “I don’t [even] know my followers; they can stop following me at any time.” It costs nothing to open a Twitter account, and the service is free. “The way Twitter works, people choose to sign up and follow,” he notes. They are not the same as customers on a marketing list. “It’s not that the company is doing something internally with the names [to generate more business]. It’s not like the company’s customer list.”

The lack of legislation or legal precedent means that social media disputes like PhoneDog’s become a matter of contract law, says Andrea Matwyshyn, Wharton professor of legal studies and business ethics. “These are questions of contract law between the employee and the company,” she notes. “You need to contract very carefully and in advance” what social media practices are permissible in the workplace. If a transgression occurs before a written policy or agreement was put into place, the case stands or falls based on the facts around it.

Then there is the question of influence in developing an audience. “To what extent did you use [a company’s] trademarks as a core piece to attract followers?” Matwyshyn asks. When an established personality, such as a famous journalist, brings her own followers with her to a new job, an easier case can be made that they are her followers. However, high-profile individuals or top executives typically have employment agreements in place that spell out such rules, Bellace points out. But with rank-and-file employees increasingly facing these situations, “the issue is cropping [up in] the lower levels.”

When it comes to owning content, social media also presents a new set of challenges in classifying tweets and Facebook posts as “property.” “If I tell a company [in a tweet or Facebook post] that I love strawberry ice cream, does the company own that information? Does that mean I can’t use it anymore?” Matwyshyn asks. “I still love strawberry ice cream.” With tweets and posts, “it is not clear that this data can be owned.”

Setting up a Policy

Too often, companies go ahead and set up social media accounts without talking to the legal department. “Some companies have too much zeal and march forward without asking the general counsel,” Matwyshyn says. To head off disputes, firms should consider crafting an official social media policy, she suggests. They also could insert social media rules into new or existing employee contracts to avoid complications later on.

Not only should companies add a non-compete clause in contracts, but they should also include policies on the permissible use of generated content, as well as specifications as to how employees should refer to the company in any social media, Matwyshyn notes.

According to Bellace, a good rule of thumb is to ask employees not to discuss company information on their personal social media accounts. Firms should also specify that they “will take action, up to and including termination, if an employee misuses social media” — including racist, sexist or other discriminatory posts, as well as disparaging remarks toward the company.

When it comes to making it clear that company information is corporate property, Matwyshyn notes that the stakes are higher in tightly regulated industries such as financial services. If an executive from a publicly held company posts material, non-public information to an audience on Facebook or LinkedIn, she risks violating the SEC’s Regulation Fair Disclosure rule (or Regulation FD), which requires that such information reach the investing public at the same time. The Financial Industry Regulatory Authority (FINRA), a self-regulatory body for the financial industry, offers guidance on social media practices by member firms to avoid running afoul of the law.

Bellace believes that over time, users will become savvier about social media. For example, they will learn to be more discreet as the impact of instant mass communication sinks in. Years ago, people were posting inappropriate photos on Facebook, only to quickly discover that it could hurt their career. The same will happen with other social media posts. “People are going to learn to be more cautious,” she says.