Inside Privacy - Updates on Developments in Global Privacy & Data Security

Last week, U.S. District Judge Richard Seeborg dismissed a putative class action against Facebook alleging that the company violated users’ rights of publicity by using their names and pictures for its Friend Finder service.  The Judge concluded that the class failed to demonstrate that they suffered any injury as a result of the service.  The Judge emphasized that Facebook did not publicize the plaintiffs’ names or profile pictures to any audience or in any context where they did not already appear.  Rather, the names and profile pictures were merely displayed on the pages of other users who were the plaintiff’s Facebook friends. 

The decision is welcome news not only to Facebook, but also Facebook app developers, some of whom have created innovative ways to allow users to interact with the developers’ products or services using friends’ names and likenesses. 

Reversing the decision of the lower court, the U.S. First Circuit Court of Appeals recently held in Anderson v. Hannaford Bros. Co. that under Maine law, claims for breach of contract and negligence can be premised on the cost of replacing credit/debit cards whose numbers had been breached and the cost of credit insurance where the card numbers had been intentionally stolen by sophisticated thieves who actually used that data for fraudulent purposes.  In reaching this conclusion, the court’s novel opinion differentiated numerous cases in which courts have held that similar claims of damages were insufficient to allow cases to move forward.  Although reaching a novel result, the First Circuit decision in Hannaford might have limited effect on future litigation because of the rather unique fact pattern on which the court of appeals’ opinion rests.

Continue Reading

As the Electronic Communications Privacy Act (ECPA) turns 25 years old this week, calls are increasing for an update to bring this aging law into the age of cloud computing.  Senators Ron Wyden (D-Ore.) and Mark Kirk (R-Ill.) this week joined with the Digital Due Process Coalition to call for significant revisions of the law, which establishes standards for law enforcement access to electronic communications and associated data.  The Digital Due Process Coalition is composed of a diverse group of companies, associations, and privacy advocates that includes Apple, Amazon, Facebook, Microsoft, the Center for Democracy and Technology, EFF, and a number of notable academics in the field of Internet law.  The group’s guiding principles would require law enforcement to:

• Obtain a search warrant before compelling a service provider to disclose a user’s private communications or documents stored online;
• Obtain a search warrant before tracking the location of a cell phone or other mobile communications device;
• Obtain a court order based on demonstrating relevance to an authorized criminal investigation, before obtaining transactional data in real time about when and with whom an individual communicates using e-mail, instant messaging, text messaging, the telephone, or any other communications technology.
• Obtain a court order based on demonstrating relevance to an authorized criminal investigation, before obtaining transactional data about multiple unidentified users of communications or other online services when trying to track down a suspect.

Most law enforcement, industry, and consumer advocates would concede that ECPA, which was passed before the Internet was widely available, is outdated.  Efforts to modernize the bill have been made repeatedly, particularly in 1998 and 2000.  ECPA sets inconsistent and increasingly irrational standards over the life of electronic content.  For example, access to an email may depend on whether it is stored by the service provider or on a local computer, and whether it is opened by its recipient.  An electronic document may be protected by the Fourth Amendment when stored locally, but potentially available to law enforcement without a warrant if stored in the cloud. 

But differences in views with respect to how the law should be updated have complicated the legislative process.  The Department of Justice (DOJ), concerned that lawmakers may revise ECPA in a way that hinders prosecutors in expediently obtaining digital data to assist in investigations, supports only clarifications in the law that would reflect the DOJ’s interpretation of the current law.  However, Senators Wyden and Kirk, along with Representative Jason Chaffetz (R-Utah) in the House) have introduced legislation consistent with the Digital Due Process Coalition’s goals.  A similar bill was introduced by Senate Judiciary Chairman Patrick Leahy (D-Vt.) earlier this year.  Senator Leahy noted today during a floor speech that he is aiming to mark up the bill “before the end of the calendar year."

A federal district court in Michigan recently held that the federal CAN-SPAM Act preempts Michigan’s anti-spam law.  Unlike the federal law, Michigan’s statute offers individuals who receive unsolicited commercial email, or “spam,” a private cause of action.  The decision, by Judge Janet T. Neff of the Western District of Michigan in Hafke v. Rossdale Group, LLC, is one of only a few court opinions construing the scope of state laws preempted by the federal CAN-SPAM Act.

The federal Controlling the Assault of Non-Solicited Pornography And Marketing Act (or CAN-SPAM Act), enacted in 2003, regulates the transmission of spam email.  For violations meeting specified criteria, it provides for criminal penalties and permits civil enforcement by the Federal Trade Commission and other federal agencies, Internet Service Providers, and state attorneys general.  It does not, however, permit individuals who have received unwanted email to bring suit. 

Therefore, those who have wished to bring suit for receiving unwanted spam have looked to states’ anti-spam laws, such as that of Michigan.  However, CAN-SPAM contains an express “preemption” provision, meaning it specifies the circumstances under which states may or may not regulate the same subject matter as the federal statute.  CAN-SPAM states that it supersedes state law “that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception.”  It also states that it does not preempt state laws “that are not specific to electronic mail” or those that “relate to acts of fraud or computer crime.”

In Hafke, the court had to interpret whether CAN-SPAM preempted the Michigan anti-spam law.  To reach a decision, the judge first reviewed the handful of prior cases on the scope of CAN-SPAM’s preemption.  Those cases, relying on CAN-SPAM’s preservation of state laws that prohibit “falsity or deception,” have differentiated state laws regulating “base error” from state laws regulating tortious conduct or material misrepresentations -- the courts have held that CAN-SPAM preempts the first kind of laws but not the second.  Building on those decisions, the judge held that because the Michigan law does not by its text require falsity or deception and because the plaintiff alleged only “technical” violations, CAN-SPAM barred the plaintiff’s claim.

Earlier this week, California became the latest state to restrict the use of consumer credit reports in the employment context, as Gov. Jerry Brown signed into law A.B. 22.  As we previously have blogged, a growing number of states--including Connecticut, Hawaii, Illinois, Oregon, Washington, and Maryland--have augmented the protections provided by the federal Fair Credit Reporting Act ("FCRA") with laws that further limit the ways in which credit reports may be used in making employment decisions. 

Continue Reading

By David Fagan & Steve Satterfield

Yesterday, the SEC’s Division of Corporation Finance issued a guidance document regarding public companies’ disclosure obligations relating to cybersecurity risks and breaches.  The guidance responds to a request by Sen. Jay Rockefeller that the SEC clarify its position on this increasingly important issue. 

The Division noted that as companies have turned to digital technologies to conduct their operations, cybersecurity risks--and incidents--have increased.  Although there is no disclosure requirement under the federal securities laws that specifically addresses cybersecurity, the Division explained that existing regulations may require disclosure of cyber risk assessments and the costs stemming from incidents.  It is important to note, as the Division does, that this is guidance, not a rule, regulation, or order (as some headlines have suggested).

We provide an overview of the guidance after the jump.  For additional information please see this E-Alert prepared by members of our Global Privacy & Data Security and Securities & Corporate Finance practice groups. 

Continue Reading

Jonathan Mayer of Stanford’s Center for Internet and Society unveiled the Center's latest research report, “Tracking the Trackers: Where Everybody Knows Your Username,” at the National Press Club Tuesday morning. The event also featured remarks from Federal Trade Commission Chairman Jon Leibowitz and Senior Counsel to the U.S. Senate Committee on Commerce, Science and Transportation Christian Fjeld and a panel discussion on potential harms facing users from data collection.

In the study, Mayer and his fellow researchers looked at whether data collected and shared by major websites remained anonymous. The team specifically looked for evidence of “leakage," that is, the sharing of identifying information that can connect browsing activity with a user account or discrete individual. Where such a connection can be made, Mayer says, the information collected is no longer anonymous, or solely indicative of browsing activity in a particular moment in time. It is instead “pseudonymous,” because it is connected in a "clickstream" to past and future browsing activity.

The team opened user accounts with 185 websites to analyze the data provided by those websites to third parties (for example, advertising and data collection partners). The team found that 113 websites, or 61%, shared a username or user ID when sharing browsing data. Mayer noted that this sharing may be in conflict with some of the websites’ privacy policies, which disclaim the sharing of user information linked to “personally identifiable information.”

Mayer emphasized that there was no indication any of the sharing uncovered was intentional; in fact, he said it was “reasonable to infer that in the majority of cases it wasn’t intentional.” The study’s take away, Mayer said, is that “the web is suffused with identity,” and industry and consumers should recognize that this sort of sharing occurs.

Continue Reading