Inside Privacy - Updates on Developments in Global Privacy & Data Security

On April 29, Craigslist was successful in fighting off a motion to dismiss filed by three screenscraping sites (3Taps, Padmapper and Lovely) in its pending litigation in the Northern District of California.   In Craigslist Inc. v. 3Taps Inc., No. CV 12-03816 (N.D. Cal.), Craigslist sued these sites, alleging that their scraping of Craigslist content violated the federal Computer Fraud and Abuse Act (and the Act’s California analogue); the Copyright Act, and the Lanham Act, and constituted a trespass to chattels.  Although not all of Craigslist’s claims survived the defendant’s motion to dismiss, its claims under the Computer Fraud and Abuse Act, some copyright claims, the reverse passing off claim, and the trespass claim did satisfy the required facial plausibility standard.  

The decision adds to the growing case law around screenscraping, and serves as a timely reminder of the fact that the language of a Web site’s terms of use (TOU) is an important factor in such cases.  In this case, Craigslist faces questions over whether it has standing to sue for copyright infringement because of the drafting of the content license in the Craigslist TOU.  The license grant provision in the Craigslist TOU is arguably ambiguous as to whether it provides for an “exclusive” license from users to Craigslist.  Citing Ninth Circuit case law, the order noted, “[O]nly the owner of an exclusive right under the copyright is entitled to sue for infringement.”  TOUs are often drafted with a non-exclusive license to user created content or with ambiguity as to exclusivity, and thus some Web site owners  may lack sufficient standing to bring copyright infringement claims in relation to some of the content on their sites.  Of course, it may not always be appropriate to request an exclusive license from users, but it is a question that all Web site owners should consider when preparing or maintaining their TOU.

The Federal Trade Commission has released its much anticipated revised COPPA FAQs.  Although these FAQs are not legally binding, they provide informal guidance to industry on staff's interpretations of the COPPA Rule. 

For the most part, the FAQs reiterate past guidance and emphasize key provisions of the new COPPA Rule and its Statement of Basis and Purpose.  However, here are 5 key things that the revised COPPA FAQs clarify:

1. Operators are not legally required to obtain parental consent for certain information that was collected before the effective date of the new COPPA Rule and that was not considered “personal information” under the original COPPA Rule.  Specifically, parental consent is not required for the following categories of information that were collected before July 1, 2013:  (1) photos, videos, and audio files containing a child's image or voice; (2) screen or user names that function as online contact information (unless the operator combines them with new information after July 1, 2013); and (3) persistent identifiers (unless the operator continues to collect the persistent identifiers or combines them with new information after July 1, 2013).  (FAQ 4)
2. Operators of child-directed sites and online services that do not target children as their primary audience may not block children from participating in the site or service altogether, although the operator may offer different activities to users based on age. (FAQ 38) This would seem to allow an operator to block the child from all interactive features that could enable the sharing of personal information, as long as the child can continue to use portions of the site that do not require or enable the sharing of personal information. 
3. Third-party services that are integrated on child-directed sites will be deemed to have "actual knowledge" if, in the future, a formal industry standard or agreed-upon convention is developed under which sites or services signal their child-directed nature to integrated third parties.  However, the mere collection of a URL from a child-directed site or service is unlikely to constitute actual knowledge.  (FAQ 39)  This guidance builds on a blog post published by the FTC's Chief Technologist, Steve Bellovin.
4. An operator of a child-directed site or service does not need to notify parents or obtain parental consent before collecting pictures from children, as long as it either blurs the child's facial features or prescreens and deletes photos of children before posting them online.  (FAQs 43-45)  (But don't forget to scrub for metadata as well -- photo metadata that contains precise geolocation information may trigger the COPPA Rule.)
5. A third party who is integrated on a child-directed site may rely on the "support for internal operations" exception to support the third-party's own internal operations.  There actually was text in the final COPPA Rule's Statement of Basis and Purpose supporting this point, but the revised COPPA FAQs make this point crystal clear.  (FAQ 77)

In addition, the COPPA FAQs clarify how the COPPA Rule applies in the classroom:

Continue Reading

Employees’ use of social media and other online services in their professional and personal lives has increased the risk of an employee bringing claims against a current or former employer.  In the past three years, for example, employers have had to defend against claims related to ownership of social media accounts used by former employees and claims that an employer’s social media policy violates the National Labor Relations Act.  “Bring-your-own-device” policies that allow employees to use personal smartphones, tablets, and other devices to access the employer’s e-mail systems and computer networks have raised questions about employees’ rights to privacy and employers’ obligations to comply with law and protect their confidential information.  Employer-employee disputes may increase as states adopt legislation prohibiting employers from requesting that employees provide access to personal online accounts, such as social networking profiles, instant messages, e-mails, and texts.  California, Illinois, Maryland, and Michigan each have passed laws restricting employer access to employees’ online accounts, and similar legislation has been introduced in more than thirty states. 

Ensuring that your company has appropriate insurance coverage is a critical step in managing the risk of these kinds of claims.  Join us, along with Marsh Risk Consulting ― a global leader in insurance broking and risk management, for an interactive discussion that will cover the legal and practical issues facing corporate policyholders in connection with employment-related claims and liabilities.  The presentation will be held on Wednesday, April 17, 2013, from 3:00-4:30 pm at Covington & Burling, New York Times Building, 620 Eighth Avenue, New York, New York, 10018-1405.  A cocktail reception will follow the presentation.  There is no charge, but please RSVP to 202-662-6440 or RSVP9@cov.com by April 12th if you wish to attend.

Yesterday the FTC released its annual report of consumer complaints, highlighting identity theft as the leading category of complaints, with 18% of the total.  The 2012 report analyzes complaints received by the FTC, certain other federal agencies, state law enforcement agencies, and non-governmental organizations such as the Better Business Bureau.  After identity theft, consumers filed the most complaints about debt collection (10%); banks and lenders (6%); shop-at-home and catalog sales (6%); prizes, sweepstakes and lotteries (5%); impostor scams (4%); Internet services (4%); auto-related complaints (4%); telephone and mobile services (4%); and credit cards (3%).

Despite the close attention of regulators and the press to the privacy policies of Internet sites and services, including mobile applications, the number of consumer complaints concerning these entities remains relatively low.  Of the total number of complaints, Internet information services received 1.79%, social networking services received 0.25%, Internet gaming received 0.12%, and mobile applications and other mobile downloads received just 0.02%.  Consumers appear to be far more troubled with identity theft and fraud-related issues, which, combined, accounted for 70% of consumer complaints in 2012.

Path, a social networking mobile app, has agreed to enter into a settlement with the Federal Trade Commission (“FTC”) regarding charges that the company deceived consumers by collecting contact information from users’ mobile address books without notice and consent.  The agreement also resolves charges that the company violated the Children’s Online Privacy Protection Act (“COPPA”) by collecting personal information from children under  13 years old without parental notice and consent.  Path did not admit any liability by entering into the consent decree, which is for settlement purposes only.

The FTC alleged that the Path application included an “Add Friends” feature that allowed users to make new connections within the app.  Users were given three options when using the “Add Friends” functionality:  “Find friends from your contacts,” “Find Friends from Facebook,” or “Invite friends to join Path by email or SMS.”  Regardless of which option was chosen, Path automatically collected and stored contact information from the address book on the user’s mobile phone.  The FTC argued that this practice was contrary to representations made in the company’s privacy policy that only certain technical information, such as IP address, browser type, and site activity information, was automatically collected from the user.  Under the settlement, Path agreed to implement a comprehensive privacy program and obtain biennial, independent privacy assessments for the next twenty years. 

Continue Reading

New Jersey earlier this month became the latest state to bar college and university officials from demanding access to students’ or applicants’ personal online accounts.  Gov. Chris Christie signed the law, which takes effect immediately, on Dec. 3.

Under the new law, which applies to public and private higher-education institutions, schools cannot require a student or applicant to “in any way provide access” to “a personal account or service through an electronic communications device,” nor may schools “in any way inquire as to whether a student or applicant” has a social-media account. Schools may not retaliate against students who refuse to provide access to their accounts, and the law voids any agreement to waive the statute’s protections.

Continue Reading

California is the latest state to enact legislation restricting the circumstances under which employers or schools can demand access to employees’ or students’ personal social media accounts.

California Gov. Jerry Brown signed two bills into law on Sept. 27.  The first, A.B. 1844, bars employers from requiring or requesting that employees or job applicants disclose personal social media usernames or passwords, access personal social media accounts in the employer’s presence, or otherwise “[d]ivulge any personal social media.” Employers are barred from firing or otherwise retaliating against anyone who refuses to comply with a request that is prohibited under the law. Employers may require employees to disclose information needed to access employer-issued devices and may request access to personal social media the employer reasonably believes is relevant to a misconduct investigation.

S.B. 1349 creates parallel protections for students, prospective students and student groups at public and private colleges and universities.

Continue Reading

A court in Texas recently dismissed a lawsuit it described as “an aspiring class action against a veritable who’s-who of social media companies.”  The Plaintiffs in Opperman v. Path claimed that the Defendants improperly used their smartphone apps to copy, upload, and store Plaintiffs’ address book information without their consent.

According to the court, the Plaintiffs’ first Complaint was over 150 pages, cited a confusing jumble of Texas, California, and federal laws, contained material that was repetitive and unnecessary, and showed “a general attitude of smug pomposity.”  Although the court had stated that it hoped the Plaintiffs’ Amended Complaint would fix these problems, it found that the Amended Complaint was more than twice as long and full of the same problems, leading the court to theorize that the Plaintiffs had “the court of public opinion in mind” when drafting it.

The court held that, because of these flaws, both versions of the Complaint violated Federal Rule of Civil Procedure 8(a)(2), which requires “a short and plain statement of the claim showing that the pleader is entitled to relief.”  Consequently, he dismissed the Complaints without prejudice, allowing the Plaintiffs to file a Second Amended Complaint within twenty days.  The judge warned, however, that if the next complaint does not comply with the “letter and spirit” of the Federal Rules, it will be dismissed with prejudice, ending the case. 

On August 1, Illinois became the second state in the country to prohibit employers from requesting or requiring employees to provide their passwords for social networking accounts.  As reported in this blog, Maryland adopted similar legislation in April.  The bill (HB 3782) was signed into law by Illinois Governor Pat Quinn and will become effective on January 1, 2013. 

The legislation amends the Illinois Right to Privacy in the Workplace Act to make unlawful an employer’s request or requirement that an employee or prospective employee provide “any password or other related account information in order to gain access to the employee’s or prospective employee’s account or profile on a social networking website….”  The term “social networking website” means an Internet-based service that allows individuals to (1) construct a public or semi-public profile within a bounded system, created by the service; (2) create a list of other users with whom they share a connection within the system; and (3) view and navigate their list of connections and those made by others within the system.  The legislation makes clear that emails are not included in the term “social networking website.” 

Legislation to prohibit employer access to employee social networking information currently is being considered in several states, including Washington, New Jersey, California, and Colorado.

Twitter has announced that it will appeal a New York state judge’s ruling that the company must hand over an Occupy Wall Street protestor’s tweets to the Manhattan district attorney.  The defendant was charged with disorderly conduct for his participation in a protest march in October 1, 2011.  Following that incident, the district attorney subpoenaed Twitter for the defendant’s tweets over several months in the fall of 2011.  The defendant unsuccessfully challenged the subpoena in trial court, and Twitter is taking up the appeal.    

The trial court judge found that the Fourth Amendment did not apply to the government’s subpoena.  The defendant had no privacy interests in his tweets, the judge held, because of the public nature of the Twitter platform.  Pointing out that the “very nature and purpose of Twitter” is to share messages with a broad online audience, the judge concluded that the “defendant’s contention that he has privacy interests in his Tweets . . . [is] without merit.”

Continue Reading