Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

Facebook recently agreed to settle charges by the Federal Trade Commission (FTC) that Facebook violated the FTC Act. The FTC-Facebook settlement, which is still subject to final FTC approval, prohibits Facebook from making misrepresentations about the privacy or security of its users’ personal information, requires Facebook to obtain users’ affirmative consent before enacting changes that override the users’ privacy preferences, and requires Facebook to prevent anyone from accessing material posted by a user more than 30 days after such user deleted his or her account. Similar to the March 2011 FTC-Google settlement, the Facebook settlement requires that Facebook enact a comprehensive privacy program and not misrepresent its compliance with the US-EU Safe Harbor Principles. As we previously reported, these two requirements are relatively new FTC settlement terms, which were first used in March 2011.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

A putative class action lawsuit against data broker Spokeo.com for violations of the Fair Credit Reporting Act (FCRA) and California’s Unfair Competition Law was recently dismissed for lack of standing.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Recently, several large retail chains have started offering customers the option to receive electronic receipts for in-store purchasers, as the New York Times reports. For instance, a cashier may ask a customer for his or her email address at check-out and then email the receipt to the customer. Paperless receipt programs offer retailers new and exciting marketing opportunities—for instance, adding a retail store purchaser’s email address to the company’s customer relationship management database, even if that customer never shops online. But with these new opportunities come potential liabilities from old laws that were not written with this new technology in mind.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Google recently settled charges by the Federal Trade Commission (FTC) that Google’s social networking service, Buzz, violated the FTC Act.  The FTC-Google settlement prohibits Google from misrepresenting the extent to which it maintains and protects the confidentiality of users’ information and from misrepresenting its compliance with the US-EU Safe Harbor Framework.  In that regard, the settlement represents two important “firsts” in FTC enforcement:

• The first time a comprehensive privacy program (as opposed to a comprehensive security program) was required by an FTC consent decree.
• The first time the FTC has enforced the US-EU Safe Harbor Principles for substantive non-compliance.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Hot on the trail of the FTC’s recent report on privacy, the GSMA, the London-based industry association representing over 800 cellular network operators worldwide, released its “high-level” Mobile Privacy Principles (the “Principles”) on January 27, 2011. The Principles were released with the goal of creating a “robust and effective framework for the protection of privacy” to promote users’ confidence and trust in mobile applications. These Principles encourage a “privacy by design” approach to mobile privacy and encourage a consistent and harmonized approach to privacy across mobile services and applications. Such Principles are highly relevant after the surge in mobile computing made possible by mobile devices, such as the iPhone, Blackberry, and Droid.

The two boldest aspects of the Principles are found in the definitions—namely, in how “personal information” is defined and in the broad responsibility of privacy espoused by the Principles.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Illinois recently enacted legislation that broadly restricts a private employer from using credit reports regarding job applicants or current employees. Subject to certain exceptions, an employer may not inquire about, order, or obtain a job applicant’s credit report, or fail or refuse to hire or recruit an individual based on the individual’s credit report or history. With respect to current employees, an employer may not discharge or otherwise discriminate against an employee because of the employee’s credit history or credit report. The law also prevents an employer from requiring an applicant or employee to waive any rights under the new law and prohibits retaliatory and discriminatory acts by the employer. Importantly, the law creates a private right of action for an individual to seek injunctive relief and damages and provides for prevailing-party attorneys’ fees.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The social networking and micro-blogging service Twitter recently agreed to settle charges with the Federal Trade Commission (FTC) regarding its privacy and data security practices. Similar to settlement terms reached with other online merchants, the settlement bars Twitter from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information. Notably, the agreement also requires Twitter to maintain a comprehensive information security program and submit to audits of the program for 10 years. The settlement agreement does not include a monetary penalty. The FTC alleged that despite Twitter’s promises on its website to protect the personal information of its users, Twitter’s practices failed to provide reasonable and appropriate security.  Unlike many of the other companies that the FTC has pursued regarding online security practices, Twitter does not sell goods online or collect financial information from its users.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The Federal Trade Commission announced today that it is once again extending the deadline for enforcing its “Red Flags” Rule, while Congress considers legislation that would affect the scope of entities covered by the Rule. The FTC is delaying enforcement of the Rule until December 31, 2010 in response to a request from members of Congress who are working to finalize legislation that would limit the scope of business covered by the Rule.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

On April 7, 2010, Mississippi Governor Haley Barbour signed H.B. 583, making his state the forty-sixth state with a security breach notification law on the books.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

            The Florida Supreme Court recently held that a commercial general liability (“CGL”) insurance policy that provides coverage for an “advertising injury” covers a violation of the Telephone Consumer Protection Act (“TCPA”). Penzer v. Transp.  Ins. Co., No. SC08-2068, 2010 WL 308043 (Fla. Jan. 28, 2010). The definition of “advertising injury” in the CGL policy at issue provided coverage for an “injury arising out of” the “[o]ral or written publication of material that violates a person’s right of privacy.” Id. at *4. The policy at issue had no relevant exclusions. Id. at *5-6.

• Email This
• Print
• Comments
• Trackbacks
• Share Link