13. Ethics, Law and PR Governance

Introduction and Context

Public relations depends on influence, but influence creates responsibility. PR practitioners shape reputations, frame public issues, manage access to information, and often speak on behalf of institutions whose decisions affect employees, consumers, citizens, investors, and communities. Ethical and legal competence is therefore not an optional professional virtue; it is a condition of credible practice.

Ethics concerns what practitioners ought to do, including duties that may exceed legal minimums. Law establishes enforceable standards concerning speech, privacy, intellectual property, contracts, discrimination, lobbying, data processing, and consumer protection. Governance provides the organisational systems through which these standards are translated into policies, approvals, records, oversight, reporting, and accountability. The three dimensions overlap but are not identical. An action may be legal yet misleading, ethical in intention yet legally risky, or compliant on paper while failing because organisational controls are weak.

For public relations managers, the central question is not simply, “Can this message be published?” It is, “Is the message accurate, fair, appropriately disclosed, lawfully obtained, proportionate to its purpose, and defensible to affected stakeholders?” This chapter develops that decision-making capacity.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish ethics, law, compliance, and governance in PR practice.

2. Apply professional codes and ethical decision frameworks to complex cases.

3. Evaluate disclosure, conflicts of interest, copyright, defamation, privacy, lobbying, and data-protection risks.

4. Design governance controls for transparent and accountable communication.

5. Analyse digital, influencer, automated, and AI-assisted PR practices.

6. Recommend defensible courses of action in ambiguous professional situations.

Ethics, Law and Governance: Related but Different Forms of Responsibility

Professional ethics is concerned with principles such as truthfulness, fairness, respect, independence, non-maleficence, accountability, and loyalty to legitimate client interests. A code of ethics converts these principles into professional expectations. Codes issued by bodies such as the Public Relations Society of America, the Chartered Institute of Public Relations, and the International Association of Business Communicators differ in wording, but commonly emphasise accuracy, disclosure, respect for privacy, avoidance of conflicts, responsible advocacy, and correction of errors.

Law is jurisdiction-specific and enforceable through courts, regulators, or public authorities. PR work may engage defamation law when statements harm reputation; copyright and trademark law when content or brand assets are used; privacy and data-protection law when personal information is collected or processed; election and lobbying regulation when influencing public policy; and advertising or consumer-protection law when promotional claims are made. Legal advice should be obtained for high-risk matters because general professional knowledge cannot replace jurisdiction-specific legal analysis.

Compliance means meeting applicable legal, regulatory, contractual, and organisational requirements. Governance is broader. It includes the structures, responsibilities, controls, documentation, escalation routes, and review mechanisms that ensure decisions are made responsibly. A communications approval matrix, disclosure register, records-retention policy, crisis protocol, social-media policy, and independent ethics committee are governance mechanisms.

A useful distinction is:

• Ethics asks: What is right, fair, honest, and responsible?
• Law asks: What is permitted or prohibited by enforceable rules?
• Compliance asks: Have applicable requirements been met?
• Governance asks: Who decides, how is the decision controlled, and how can it be reviewed?

Ethical PR also recognises multiple duties. The practitioner owes duties to the client or employer, the public, affected stakeholders, colleagues, media institutions, and the integrity of the profession. These duties can conflict. A client may demand secrecy while affected communities require timely disclosure. A campaign may benefit a brand while misleading consumers. Professional judgment is required precisely because rules do not eliminate ambiguity.

Core Concepts in Responsible PR Practice

Truthfulness, accuracy and material omission

Truthfulness is more than avoiding direct lies. A technically accurate statement can mislead if it omits material information, uses an ambiguous comparison, presents preliminary evidence as established fact, or places a minor qualification where audiences will not notice it. Practitioners should verify claims, identify sources, distinguish facts from opinion, and correct material errors promptly.

Transparency and disclosure

Transparency concerns the visibility of relevant interests, methods, relationships, sponsorships, and limitations. Disclosure should be clear, prominent, understandable, and timely. A sponsored influencer post, paid expert endorsement, astroturf campaign, or research report funded by an interested party can mislead if the relationship is concealed. Disclosure is not effective when hidden in dense legal language, placed after a “read more” link, or expressed through an unfamiliar abbreviation.

Independence and conflicts of interest

A conflict exists when personal, financial, professional, or organisational interests could influence—or appear to influence—judgment. Conflicts may be actual, potential, or perceived. A PR adviser who owns shares in a company being promoted, accepts expensive hospitality from a supplier, or represents competing clients must disclose the situation and follow organisational procedures. Disclosure alone may not cure a conflict; withdrawal, independent review, or refusal of the assignment may be necessary.

Confidentiality and legitimate secrecy

Confidentiality protects privileged client information, trade secrets, personal data, and information received under an agreed restriction. It does not justify concealing unlawful conduct, material risks to public safety, or information that regulation requires to be disclosed. Practitioners should clarify what is confidential, who may access it, how long it is retained, and when disclosure is legally or ethically required.

Fairness, inclusion and respect

PR messages can reproduce stereotypes, exclude communities, exploit vulnerability, or encourage harassment. Ethical practice examines who is represented, who is absent, who bears risk, and whether a campaign uses cultural symbols or personal stories respectfully. Accessibility—including readable formats, captions, language access, and inclusive digital design—is part of responsible communication.

A Decision Framework for Ethical Dilemmas

A practical framework should prevent intuition, hierarchy, or deadline pressure from becoming the sole basis of judgment. The following eight-step process is suitable for campaign planning and live issues management.

1. Define the decision. State what must be decided and by when.

2. Establish the facts. Separate verified information, assumptions, allegations, and unknowns.

3. Map stakeholders. Include direct audiences, vulnerable groups, employees, regulators, media, clients, and people indirectly affected.

4. Identify duties and rules. Consult professional codes, law, contracts, organisational policies, platform rules, and previous commitments.

5. Identify competing values. Typical tensions include loyalty versus public interest, speed versus accuracy, privacy versus transparency, and advocacy versus neutrality.

6. Generate alternatives. Do not treat the client’s preferred action and silence as the only options.

7. Test the options. Ask whether the decision is truthful, fair, proportionate, reversible, explainable, and consistent with how the organisation would wish it reported publicly.

8. Decide, document and review. Record reasoning, approvals, disclosures, dissent, and subsequent learning.

Three complementary tests strengthen the framework. The publicity test asks whether the decision could be defended if fully disclosed. The reversibility test asks whether one would accept the decision if roles were reversed. The stakeholder-impact test examines who benefits, who bears risk, and whether less harmful alternatives exist. These tests do not replace law; they help identify ethically weak conduct that may remain technically lawful.

Legal Risk Areas in Public Relations

Defamation and reputational harm

Defamation generally involves publication of a statement that harms an identifiable person’s or organisation’s reputation. The precise legal elements vary by jurisdiction, but risk commonly increases when a statement is presented as fact, is false or insufficiently supported, is communicated to a third party, and causes or is likely to cause reputational harm. Repeating another person’s allegation can create risk; adding “allegedly” does not automatically protect the publisher.

PR professionals should distinguish verifiable facts from opinion, use reliable evidence, avoid unnecessarily inflammatory language, give subjects a fair opportunity to respond where appropriate, and preserve source records. Crisis communications should not become a vehicle for retaliation. If an error is published, prompt correction, clarification, or apology may reduce harm, although it does not erase legal exposure.

Copyright, trademarks and moral rights

Copyright generally protects original expression, not mere ideas or facts. Photographs, video, music, articles, illustrations, research reports, and software may be protected even when easily accessible online. Permission, a valid licence, public-domain status, or a carefully assessed legal exception is required before reuse. Attribution is professionally important but does not by itself substitute for permission.

A campaign may also infringe trademarks by creating confusion about sponsorship, affiliation, or endorsement. Moral rights, where recognised, may protect attribution and the integrity of a creator’s work. Agencies should maintain asset registers recording ownership, licence scope, territory, duration, permitted media, exclusivity, and expiry dates. Generative AI introduces additional uncertainty because outputs may resemble protected works and training data may involve rights questions.

Privacy and data protection

Privacy is not limited to secrecy. It includes control over personal information, freedom from unjustified intrusion, contextual integrity, and respect for sensitive circumstances. Data-protection regimes commonly require a lawful basis, purpose limitation, data minimisation, accuracy, storage limitation, security, transparency, and mechanisms for individual rights. Sensitive data—such as health, biometric, financial, political, or precise location information—requires heightened care.

A responsible PR data process asks: What information is needed? Why is it needed? Was it collected fairly? Did individuals receive meaningful notice? How long will it be kept? Who can access it? What happens if it is breached? Consent should be specific, informed, freely given, and capable of withdrawal where consent is the legal basis. Purchased lists, scraped profiles, facial-recognition tools, and behavioural targeting can create serious legal and ethical exposure.

Lobbying and public affairs

Lobbying is legitimate participation in democratic decision-making when conducted transparently and lawfully. Risk arises when organisations conceal their identity, channel money through front groups, provide improper benefits, or present paid advocacy as independent public opinion. Many jurisdictions impose registration, reporting, gift, revolving-door, procurement, or political-finance requirements.

PR practitioners should identify the real sponsor, accurately represent evidence, disclose relevant relationships, distinguish research from advocacy, and maintain records of meetings, expenditure, submissions, and third-party organisations. Astroturfing—manufacturing the appearance of spontaneous grassroots support—undermines public trust and may violate law or platform rules.

Consumer protection and promotional communications

Where PR content promotes products, claims must be substantiated and material commercial relationships disclosed. Testimonials should reflect genuine experience and should not imply typical results without evidence. Health, environmental, financial, and safety claims require particular scrutiny. Greenwashing occurs when environmental benefits are exaggerated, vague, irrelevant, or unsupported. Influencer campaigns should provide conspicuous disclosures that audiences can understand before relying on the message.

Governance in the PR Function

Governance converts principles into repeatable organisational practice. A mature PR function normally has a written code, a risk classification system, approval thresholds, training, monitoring, incident reporting, and periodic review. Governance should be proportionate: a local internal announcement does not require the same process as a public health claim, political campaign, or crisis involving personal data.

A useful governance architecture includes four layers. First, ownership assigns responsibility to named roles: account lead, legal adviser, data-protection officer, senior executive, and final approver. Second, controls include fact-checking, rights clearance, disclosure review, privacy impact assessment, accessibility review, and stakeholder consultation. Third, evidence includes source logs, approval records, consent records, contracts, versions, and corrections. Fourth, assurance includes audits, complaints analysis, independent review, and board-level reporting.

A risk register can score likelihood, impact, reversibility, affected populations, and regulatory sensitivity. High-risk communications should have escalation triggers, such as allegations against individuals, use of sensitive data, public safety implications, political advocacy, or unverified claims. Governance must also protect internal challenge. Staff should be able to raise concerns without retaliation, and seniority should not substitute for evidence.

Digital Media, Automation and Artificial Intelligence

Digital PR accelerates publication and multiplies the consequences of error. Platforms reward speed, emotional intensity, and personalisation, while screenshots make retraction difficult. Social listening can identify emerging issues but may process personal information without users understanding the purpose. Automated sentiment analysis can misclassify dialect, irony, or minority language. Influencer metrics may be inflated by bots or purchased engagement.

AI tools can assist with drafting, translation, monitoring, summarisation, image creation, and audience analysis. They should not be treated as authoritative sources. Practitioners remain responsible for factual accuracy, confidentiality, bias, intellectual-property compliance, disclosure, and human review. Confidential client information should not be entered into an unapproved system. Organisations should document approved tools, permitted data, human-approval requirements, testing procedures, retention settings, and incident responses.

Synthetic media creates special disclosure obligations. A digitally altered image, simulated voice, or AI-generated spokesperson can deceive audiences if presented as authentic. The ethical standard is not merely whether manipulation is technically detectable; it is whether a reasonable audience is likely to misunderstand the nature or source of the content.

An Illustrative Case: The Unverified Safety Campaign

Background

A fictional consumer-health company, VitaNorth, hires a PR agency to launch a campaign for a new supplement. The client supplies a draft report claiming that users experience a substantial improvement in concentration. The report was commissioned by VitaNorth, uses a small non-representative sample, and has not been independently reviewed. The marketing team wants the agency to place stories with health journalists and engage influencers before a competitor’s product launch.

Situation and problem

The proposed press release describes the supplement as “clinically proven” and includes a photograph of a participant obtained from a stock-image site. The participant is not a user of the product. The client also proposes sending product and a paid fee to influencers, asking them to describe their “personal results” without requiring disclosure of the payment. The agency account director is told that legal review will delay the launch.

Analysis

Several risks interact. The phrase “clinically proven” may be an unsupported consumer claim. The commissioned study creates a potential conflict and requires transparent description of methodology and funding. The stock photograph could imply a false testimonial and may violate the licence if used outside its permitted purpose. Undisclosed influencer payment is deceptive and undermines audience autonomy. The campaign also risks health-related harm if consumers abandon appropriate professional advice.

The ethical decision framework identifies affected consumers, influencers, journalists, health professionals, the client, and the agency. Relevant duties include accuracy, disclosure, consumer protection, copyright compliance, and avoidance of harm. The publicity test shows that the campaign would be difficult to defend if the study limitations and payments became public.

Approach and solution

The agency should refuse the proposed wording and pause publication until claims are independently reviewed. It should recommend describing the research accurately, including sample limitations and funding, and removing the misleading photograph. Influencers should receive written disclosure instructions and contracts requiring truthful statements based on actual experience. If an influencer has not used the product, the person should not provide a personal testimonial.

The agency should conduct rights clearance, obtain specialist legal and scientific review, create an evidence file, and establish a correction and complaints process. If the client refuses these safeguards, the agency should escalate internally and consider withdrawing from the assignment. A deadline does not make an unsafe claim acceptable.

Outcome

In this illustrative case, the campaign is delayed. An independent review finds that the evidence supports further research but not the proposed efficacy claim. VitaNorth revises the campaign to focus on product ingredients and ongoing research, with clear limitations and disclosures. Although the launch generates less immediate publicity, the organisation avoids avoidable legal exposure and establishes a more credible basis for future communication.

Learning points

The case demonstrates that ethical PR is not anti-business. It protects long-term trust by challenging weak evidence, separating genuine advocacy from concealed promotion, and treating legal clearance as part of strategy rather than an administrative obstacle. It also shows why governance must operate before publication, not only after a complaint.

Common Failures and Professional Safeguards

Frequent failures include publishing first and checking later, assuming that online material is free to use, confusing a client’s preferred narrative with established fact, relying on vague disclosure, collecting excessive audience data, ignoring minority stakeholders, and treating a disclaimer as a cure for a fundamentally misleading message. Another failure is “ethical fading,” in which commercial targets make practitioners stop recognising a decision as moral or public-interest question.

Safeguards include independent challenge, pre-mortem risk reviews, documented evidence, plain-language disclosures, rights and consent registers, privacy impact assessments, role-based access to data, crisis escalation plans, and regular training. Senior managers should reward accurate counsel rather than only media volume. Measurement systems should include correction rates, complaints, disclosure compliance, stakeholder trust, accessibility, and harm indicators—not merely impressions and reach.

Current Developments and Strategic Implications

Regulatory attention is increasingly directed toward platform accountability, influencer marketing, environmental claims, political advertising, automated decision-making, cybersecurity, and cross-border data transfers. Organisations are also expected to explain how they use personalisation and AI. The practical implication is that PR leaders need interdisciplinary capability: communication judgment must be combined with legal literacy, data governance, information security, behavioural insight, and stakeholder accountability.

Transparency is evolving from a publication practice into an organisational capability. It includes explaining uncertainty, correcting mistakes, revealing sponsorship, documenting decision processes, and making evidence accessible. Accountability is similarly moving beyond crisis apology toward measurable responsibility for foreseeable effects. These developments favour PR professionals who can advise senior leadership, challenge unsafe instructions, and design systems that make ethical conduct easier.

Best-Practice Principles

A defensible PR programme should:

• verify material claims and preserve evidence;
• disclose sponsorship, payment, interests, and limitations prominently;
• obtain permission for creative assets and respect creator rights;
• collect only necessary personal data and protect it throughout its life cycle;
• separate fact, opinion, advertising, advocacy, and editorial-style content;
• identify vulnerable stakeholders and assess foreseeable harm;
• provide routes for correction, complaint, appeal, and remedy;
• use human oversight for automated and AI-assisted communication;
• document decisions, approvals, dissent, and post-campaign learning; and
• escalate or withdraw when instructions are unlawful, materially deceptive, or seriously harmful.

Chapter Summary

Ethics, law, and governance provide distinct but interdependent foundations for responsible public relations. Ethical practice requires truthfulness, fairness, independence, respect, disclosure, and accountability. Legal risk commonly arises through defamation, copyright, trademark misuse, privacy violations, data processing, lobbying, consumer claims, and undisclosed promotion. A structured decision process—defining facts, mapping stakeholders, identifying duties, comparing alternatives, testing consequences, and documenting decisions—helps practitioners manage ambiguity.

Governance turns principles into organisational controls through ownership, approval systems, evidence, escalation, auditing, and review. Digital media and AI increase the speed, scale, and complexity of risk, making human oversight and data discipline essential. The professional standard is not simply to avoid liability; it is to communicate in ways that stakeholders can reasonably trust and organisations can publicly defend.

Key Terms

Accountability: The obligation to explain decisions, accept responsibility, and provide remedy where appropriate.

Astroturfing: The deceptive creation of apparently spontaneous grassroots support for a sponsored position.

Conflict of interest: A situation in which personal or organisational interests may influence professional judgment.

Copyright: Legal protection for original expressive works such as writing, photographs, music, and video.

Data minimisation: Collecting and processing only the personal data necessary for a stated purpose.

Defamation: Publication of a harmful statement about an identifiable party in circumstances recognised by law as actionable.

Disclosure: Clear communication of relevant sponsorships, relationships, interests, payments, or limitations.

Ethical fading: Failure to recognise the moral dimension of a decision because attention is dominated by commercial or organisational goals.

Governance: Structures and processes that direct, control, document, and review organisational conduct.

Greenwashing: Misleading or unsupported communication about environmental performance or benefits.

Lobbying: Advocacy intended to influence public policy or governmental decision-making.

Material omission: Failure to reveal information that could reasonably affect audience interpretation or decision-making.

Moral rights: Rights protecting aspects of a creator’s personal relationship with a work, including attribution or integrity where recognised.

Privacy impact assessment: A structured evaluation of privacy risks associated with a proposed activity or system.

Professional code: A formal statement of principles and conduct expectations issued by a professional association or organisation.

Purpose limitation: The principle that personal data should be collected for specified and legitimate purposes and not misused for incompatible purposes.

Transparency: The clear and accessible communication of relevant information about decisions, relationships, methods, and limitations.

Whistleblowing: Reporting suspected wrongdoing through internal or external channels, often with legal or organisational protection.

Review Questions

Short Answer Questions

1. Distinguish ethics, law, compliance, and governance in PR practice.

2. Why is disclosure more than the simple inclusion of a disclaimer?

3. Identify two safeguards against defamation risk.

4. What is the purpose of data minimisation?

5. Why should AI-assisted PR content receive human review?

Long Answer Questions

1. Explain how professional codes guide PR decisions when legal rules do not provide a complete answer.

2. Discuss the relationship between privacy, data protection, and stakeholder trust in digital PR.

3. Analyse the role of governance structures in preventing unethical communication.

4. Explain the major legal and ethical issues involved in influencer campaigns.

5. Describe and evaluate the eight-step ethical decision framework presented in this chapter.

Analytical / Application Questions

1. A company asks its agency to publish a competitor’s alleged safety failures based on an anonymous email. Apply the decision framework and recommend a course of action.

2. An organisation wants to use customer location data to personalise crisis messages without notifying customers. Assess the ethical and governance issues and propose controls.

3. An AI-generated video shows a fictional executive announcing a product recall. Analyse the disclosure, consent, reputational, and accountability issues and design a responsible alternative.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from compliance in public relations?

A. Governance concerns only criminal law, while compliance concerns professional values.

B. Governance establishes responsibilities, controls, records, and review processes through which compliance and accountability are managed.

C. Governance means publishing all organisational information, while compliance means protecting secrets.

D. Governance applies only to public-sector communication.

Correct Answer: B. Governance establishes responsibilities, controls, records, and review processes through which compliance and accountability are managed.

Question 2

A sponsored influencer hides payment in a long block of text after the main post. What is the principal ethical problem?

A. The influencer has used too many hashtags.

B. The post may lack clear and prominent disclosure of a material commercial relationship.

C. The campaign necessarily violates copyright.

D. The audience is prohibited from reading sponsored content.

Correct Answer: B. The post may lack clear and prominent disclosure of a material commercial relationship.

Question 3

Which action most directly reduces defamation risk?

A. Repeating an allegation while adding the word “allegedly.”

B. Using more emotional language to attract attention.

C. Verifying evidence, distinguishing fact from opinion, and giving an affected party a fair opportunity to respond where appropriate.

D. Publishing anonymously through a third party.

Correct Answer: C. Verifying evidence, distinguishing fact from opinion, and giving an affected party a fair opportunity to respond where appropriate.

Question 4

Which principle requires an organisation to collect only personal information necessary for a stated purpose?

A. Purpose limitation

B. Data minimisation

C. Moral rights

D. Reversibility

Correct Answer: B. Data minimisation

Question 5

A PR agency discovers that a client’s research supports only a cautious association, but the client wants the phrase “clinically proven.” What should the agency do first?

A. Publish the claim and correct it if challenged.

B. Remove all references to research.

C. Pause the claim, verify the evidence, and recommend accurate wording with appropriate limitations.

D. Ask influencers to make the claim instead.

Correct Answer: C. Pause the claim, verify the evidence, and recommend accurate wording with appropriate limitations.

Question 6

Which situation is most clearly a conflict of interest?

A. A practitioner documents campaign approvals.

B. A practitioner owns shares in a company that the practitioner is promoting without disclosure or safeguards.

C. A practitioner asks a client for evidence supporting a claim.

D. A practitioner corrects a factual error.

Correct Answer: B. A practitioner owns shares in a company that the practitioner is promoting without disclosure or safeguards.

Question 7

Why is attribution alone generally insufficient when using a photograph found online?

A. Attribution can never be used in PR.

B. Copyright may still require permission or a valid licence.

C. Photographs are not protected by copyright.

D. Only government agencies may use photographs.

Correct Answer: B. Copyright may still require permission or a valid licence.

Question 8

Which question is part of the publicity test in ethical decision-making?

A. Will this message produce the highest possible reach?

B. Could the decision be defended if the relevant facts became public?

C. Can the campaign avoid all stakeholder criticism?

D. Will competitors use the same strategy?

Correct Answer: B. Could the decision be defended if the relevant facts became public?

Question 9

What is the central governance concern when confidential client information is entered into an unapproved AI tool?

A. The tool may generate shorter sentences.

B. The information may be exposed, retained, reused, or processed without proper authorisation and safeguards.

C. AI tools cannot produce any useful output.

D. The client automatically owns every AI system.

Correct Answer: B. The information may be exposed, retained, reused, or processed without proper authorisation and safeguards.

Question 10

Which practice most closely represents astroturfing?

A. Publishing a clearly identified organisation’s policy submission.

B. Inviting employees to disclose their employer when expressing personal views.

C. Creating a supposedly independent citizen group that is secretly funded and directed by the sponsor.

D. Holding a public consultation with an announced sponsor.

Correct Answer: C. Creating a supposedly independent citizen group that is secretly funded and directed by the sponsor.