Data Privacy Monitor - Commentary on Data Privacy, Security and Social Media Subjects

Co-Authored by: Theodore J. Kobus III

A tempting response to the Cybersecurity Executive Order (the "Order"), announced by President Obama at his State of the Union address, is to ignore it.  It is vague in key particulars, such as which companies are part of the "critical infrastructure" and therefore subject to the Order.  The only immediate effect of the Order is to require various departments and agencies, led by the Department of Homeland Security ("DHS") to: (i) study issues; (ii) identify powers that can be exercised under existing laws; (iii) and come back with proposed plans of action.  Maybe if we ignore it, it will go away.

But it won't.  If you are a significant player in a regulated industry that that has already been identified by DHS as part of the critical infrastructure (which includes energy, health care, transportation, financial services, heavy manufacturing, food and drugs), if you are a government contractor, or especially if you are both - the Order is a statement of intent that should not be ignored.

The Administration has identified cybersecurity as "one of the most serious economic and national security challenges we face as a nation, but one that we as a government or as a country are not adequately prepared to counter."  The Executive Order focuses on two solutions: 1) enhanced security standards; and 2) better sharing of information between government and the private sector.

While the Executive Order describes these security standards as "voluntary," it also directs regulators to identify "incentives" for adopting these standards. Incentives under consideration include potential preferred treatment for government contractors who participate.

With respect to information sharing, the Executive Order only specifically discusses the government sharing information with industry about identified threats. But the Administration has acknowledged that the achieving the goals of the Executive Order "will by necessity involve increased collaboration with the private sector and a whole-of-government approach." Initially this sharing may take the form of responding to questionnaires from the National Institute of Standards (NIST), or requests by the government to a company's security expert. Ultimately, be ready for requests for information related to cybersecurity threats coming from your regulators and government procurement officers.

What should you be doing now to prepare for the impact of the Executive Order on your company?

(1) Review your incident response policies and, if necessary, update them to address the concerns of this Executive Order. Historically, breach reporting obligations have focused on lost personally identifiable information and protected health information because state and federal laws have focused on these losses. The Executive Order focuses on "infrastructure threats" and includes risks posed by trade secret theft, cyber terrorism and hacktivism. Make sure that your policies in place adequately address identifying infrastructure threats and escalating those issues to the appropriate people within your organization. There are going to be "whistleblowers" waiting to assist you with making these disclosures if you are not willing to confront these issues head on.

(2) Look at your vendor lists and contracts. If you are not considered to be critical infrastructure, are your business partners? Are your business partners at risk for certain cybersecurity events like hacktivism and foreign government sponsored attacks? Are your key vendors demonstrating their readiness to you and should you be better protecting yourself in your contracts with these business partners?

(3) Establishing or upgrading security audits should be considered -- not just of your own house, but of your business partners as well. Increasingly government is not just looking at an organization, but an organization's business partners as well.

(4) Finally, develop a regulatory strategy. Just like any other government relationship, figure out how you are going to leverage your existing relationships to guide you through this process and what their expectations are. Government, whether as a regulator or a partner in the war against cyberterrorism, expects transparency, cooperation, and a good attitude. Think about reaching out and starting a dialogue about these challenges and concerns as we figure out how to combat these cyber attacks.

Give Facebook credit for candor. Facebook does not call the policy describing what it does with your personal information a “privacy policy”, but rather a “Data Use Policy”. The nomenclature is appropriate. The Facebook Data Use Policy is not so much about protecting the privacy of the information you share on Facebook as it is about Facebook’s plans for making money from that information. And the latest revision of the Facebook Data Use Policy, scheduled to go into effect this week (the “Proposed Policy”), suggests that Facebook’s plans include buying an ownership interest in an advertising agency and giving your personal information to that agency.

Some of the changes in this Proposed Policy are merely clarification. Changes made earlier this year already provided that Facebook can use information posted about you on Facebook to “personalize” ads displayed to you both on Facebook and outside of Facebook. The latest Policy revisions make it clear that in “personalizing” ads, Facebook may consider using everything you do and say on Facebook and anything others say or display about you when they “tag” you. You may remove your posts and other’s tags from your timeline, but this action does not remove the information from Facebook’s database.

The significant addition to this Policy is an entirely new provision that, for the first time, permits Facebook to engage in unlimited sharing of your personal information with “affiliates” with the following language:

Affiliates

We may share information we receive with businesses that are legally part of the same group of companies that Facebook is part of, or that become part of that group (often these companies are called affiliates). Likewise, our affiliates may share information with us as well. We and our affiliates may use shared information to help provide, understand, and improve our services and their own services.

Legally, an affiliate could include a company in which Facebook owns a minority interest.  Facebook has not announced any new acquisitions, and there is no reason to believe that one is planned for the immediate future. But it is certainly plausible that this Proposed Policy is intended to pave the way for: (i) taking an ownership interest in advertising agency and (ii) immediately commencing complete sharing Facebook data with that advertising agency.

Given how much Facebook knows about its users, such an agency could be much more effective than current online ad networks which serve advertisements based upon your behavior on the Internet (which they deduce through cookies placed on your browser by websites you’ve visited and advertisments you’ve clicked).

But nothing in the Proposed Policy limits Facebook’s use of your information “off Facebook” to on-line advertising. With its facial recognition software and its location tools, Facebook could place a camera at the entrance to a department store to identify you as you enter. Then, a digital sign linked to Facebook’s database could flash to you information about in-store offerings, based on Facebook’s cataloging of your interests and desires.  Oh what a brave new world, indeed.

Authored by: Paul Karlsgodt

Editor’s Note – This article is a joint submission to BakerHostetler's Class Action Lawsuit Defense blog.

Companies that provide call center services to consumers are increasingly being targeted in class action lawsuits under an arcane section of the California penal code that provides a civil right of action and statutory damages for monitoring or recording of confidential telephone conversations without the other party’s knowledge or consent. Sections 630 et seq. of the California Penal Code were enacted in the 1960s to prevent illegal surveillance of confidential telephone calls. In the past several years, plaintiffs have attempted to use the statute to seek damages against the operator of a customer service call center that fails to include a notice at the beginning of each customer service call that the call “may be monitored or recorded” for training or quality assurance purposes. Since this type of notice is ubiquitous among call centers, the failure to provide the notice can often be the result of a system error or a design flaw in the call system. Plaintiffs’ lawyers have been taking advantage of these errors by filing class actions for statutory damages for each call that was made from California during any time period during which the warning was not provided.

The exposure in these cases can be enormous because the statute provides for $5,000 in statutory damages, an amount that the lawsuits allege is owed for each call. For example, a call center that receives 1,000 calls during a time in which the warning was not provided may find itself defending a $5 million lawsuit, and 10,000 calls means a $50 million lawsuit. The high exposure amounts, coupled with the seemingly low standard that has been adopted by the California state courts to determine what constitutes a “confidential” telephone conversation, has caused many defendants to rush to early settlements rather than face the risks of litigation.

SETTLEMENT MAY NOT BE THE ANSWER!

A defendant should not assume that there is no defense to a case filed under the Privacy Act. Defenses on the merits that have been raised in Privacy Act cases include that the call centers were intended to be exempt from the statute altogether, that the aggregation of statutory penalties violates due process and that customer service calls are not confidential in nature. Individual defenses to the named plaintiff’s claims may also exist. For example, the claims of individual defendants may be susceptible to arguments that 1) the plaintiff signed an arbitration agreement; 2) the circumstances surrounding the plaintiff’s call show that there was no expectation of confidentiality; or 3) the plaintiff knew the call was being recorded despite the lack of express notice.

There are also defenses to class certification based on factual variations, despite the uniform nature of the statutory remedy. Plaintiffs will argue that the fixed nature of the available remedy and the objective standards for determining the expectation of confidentiality and the disclosure of sensitive information simplifies the cause of action and alleviates the need for certain individualized questions. However, in cases involving recorded telephone conversations, there can be significant factual differences from caller to caller on facts ranging from the location of the caller at the time of the call, to the nature of the conversation alleged to be confidential, to the facts bearing on the caller’s knowledge or understanding that the call may be recorded. The California Privacy Act is just one of the various statutes that are increasingly becoming targeted for class action lawsuits because of the availability of a statutory penalty.

A Washington federal district court has dismissed with prejudice class action claims against Amazon alleging that the company’s use of cookies to track consumers’ personal data violated the Consumer Fraud and Abuse Act (CFAA), and has requested further briefing on a claimed violation of the Washington Consumer Protection Act (WCPA). (Del Vecchio v. Amazon). This decision highlights how important it is for website operators to clearly and conspicuously disclose how they use cookies, while raising the question of who should profit from invisible traffic in information that takes place whenever we activate our web browser.

Cookies are small units of code that website operators can send to Internet browsers accessing their sites. While cookies may be set to delete when a browsing session terminates, many cookies remain stored on a user’s browser. Each subsequent time that this browser uploads a webpage on the site, the operator can access data stored in those cookies to customize webpages based on the user’s browsing activities. The most controversial cookies are those that track a user’s activity across the Internet. The European Union has enacted regulations requiring website operators to more fully disclose how websites deploy cookies, and to give users more control over the cookies placed on the browsers. The FTC has issued a white paper calling on industry to adopt similar disclosure practices in the United States.

In Del Vecchio, the plaintiffs complained that Amazon placed cookies on their hard drives against their wishes, even after users had attempted to block cookies with their browser setting. Under the CFAA, a plaintiff can state a civil cause of action where a defendant intentionally accesses a computer without authorization, but only if such conduct causes the plaintiff loss or damages of at least $5,000 over a one-year period. In arguing that they met the damages threshold, the Del Vecchio plaintiffs claimed that Amazon derived substantial financial gain through its use of cookies to gather the plaintiffs’ personal information. Conversely, plaintiffs claimed that they lost the opportunity to realize such gain.

Assuming the factual allegations of the complaint to be true for the purposes of the motion, the court acknowledged that, in theory, a plaintiff’s lost opportunity to sell his computer usage data to marketers could constitute a monetary loss that satisfies the $5,000 damage threshold of the CFAA.  But here, the court found that the plaintiffs’ claims were entirely speculative because they did not allege facts showing that they had the capacity or opportunity to independently monetize their raw computer usage information. As a result, the court granted Amazon’s motion to dismiss for the plaintiffs’ failure to state a claim under the CFAA.

The court further found that the plaintiffs still might have a viable claim under Washington’s Consumer Protection Act (the “WCPA”). The WCPA requires a showing of injury, but, unlike the CFAA, does not require a plaintiff to demonstrate monetary damages in order to satisfy the requirement. In this case, the court stated that in order to allege an injury, the plaintiffs would need to demonstrate that Amazon accessed their computers or their information without authorization.

The court noted that Amazon’s “Conditions of Use and Privacy Notice” notifies visitors to Amazon sites that the company uses cookies and that the terms state that the plaintiffs’ use of Amazon was conditioned on their acceptance of those very terms. The court asked the parties to file additional briefings on the issues of: (1) whether plaintiffs had authorized Amazon’s use of cookies and (2) whether Amazon’s conduct was unfair or deceptive in light of Amazon’s terms.

In light of the Del Vecchio decision, the recent EU cookie regulation, and concerns raised by the FTC regarding cookies, website operators should re-evaluate the manner in which they disclose cookies deployed on their website and obtain consent from users for placing these cookies on users’ browsers. While it appears that the CFAA is not available as a vehicle for privacy class action claims, privacy class action attorneys are continuing to look for other legal bases for such claims, such as the WCDA. Increased regulatory scrutiny of cookie practices is likely to further stir such litigation.

But the Del Vecchio decision also issues a challenge for privacy advocates looking to protect consumer web browsing practices. Under the holding in Del Vecchio, if consumers could sell their web usage information to marketers, then they could invoke the CFAA to prevent third parties from deploying cookies to take this web usage information without their consent. Rather than more class actions, consumers may be better served by the development of marketplaces where they can sell their web usage information for marketing purposes, rather than giving it away to the websites they access.

Authorship Credit: Tarsha Luke

The recent termination of a top executive of a publicly traded company is another example of some of the perils of mixing personal and workplace social media. The chief financial officer for a women's clothing retailer, Francesca's Holdings, was dismissed for disseminating non-public corporate information to his Twitter followers. After a company board meeting he tweeted about the company's earnings. Using the handle "@theoldcfo," he wrote: "Board meeting. Good numbers=Happy Board." Subsequently, the company's stock jumped fifteen percent. Strictly enforcing its social media policy, the Houston-based company decided to fire its CFO for that tweet, in addition to a series of other posts he sent from his social media accounts since 2010.

This case sheds light on the legal consequences relating to the use of social media in the workplace. Employee Internet posts not only implicate the financial rules of the Securities and Exchange Commission, as was the case for Francesca's, but they can also create compliance issues under the regulations of other agencies, including:

• Financial Industry Regulatory Authority (FINRA),
• Federal Trade Commission (FTC),
• Food and Drug Administration (FDA) and
• National Labor Relations Board (NLRB), Office of the General Counsel.

Furthermore, rogue social media use can put company trade secrets and client confidences in jeopardy. This is why it is increasingly important for all companies, not just publicly traded companies, to have a social media policy. A good social media policy should address both employee behavior on company-affiliated media, as well as employee behavior that can be traced back and imputed to the company.

Below are some considerations for creating and implementing a social media policy:

• Almost anything written on the web can be easily traced back to its author, and ultimately the place where he works. This is because online information is backed up repeatedly and often and posts in one forum are usually replicated in other forums through trackbacks, reposts or references. Therefore, social media policies should be applicable to all types of workers including employees, temporary or seasonal workers, independent contractors or anyone with access to a company computer.
• Companies with employee-generated content on company-branded websites, blogs, wikis or other social networking sites should have formal procedures to review what its employees post on its behalf. When possible, it is best practice to treat all employees' posts on company-branded sites as if they were being published in more traditional media.
• Nevertheless, a company cannot prevent an employee from using the company's name or trademark for non-commercial purposes on his or her own time to complain about wages, terms and conditions of employment, working conditions or other protected employee rights under Section 7 of the National Labor Relations Act (NLRA).
• An employer should avoid using vague language in its social media policy, such as "appropriate," "inappropriate" or "professional." Terms should be defined either by using examples or by using language that carves out an exception for employee rights protected under the NLRA.
• A company should be careful about asking an employee or prospective employee to provide usernames and passwords to personal social networking websites, without first weighing the business concerns of doing so. In addition to potentially facing serious public relations concerns for chosing to implement such a policy, there soon may be legal liability for requesting private social media passwords. Maryland enacted a law prohibiting employers from asking for social media passwords, which will take effect on October 1, 2012. Other states are also rapidly following suit, including Illinois, California, Minnesota, Michigan, Massachusetts, and Ohio. Furthermore, the federal government is also interested in this topic. Two U.S. Senators have asked the Department of Justice and the U.S. Equal Employment Opportunity Commission to look into the issue.

For more information and guidance on this issue, see a recent article published by Labor and Employment Partner Dan Guttman titled: "What Can Management Do to Protect the Organization From Inappropriate Use of Social Media?"