STL has not been tested before this year, when one law firm filed several similar cases based on STL, each with a derivative Unfair Competition Law ("UCL") claim based on the STL claim.    The cases were filed as purported class actions, and most were filed in or removed to federal court. The stakes are high: if there is a violation, STL provides for damages, as well as discretionary civil penalties which could be as much as $3,000 per violation for a willful, intentional, or reckless violation, or $500 otherwise.

STL requires that companies that share California consumers’ information for third party marketing purposes either give the consumers an ability to request and receive a list of the third parties with whom the company has shared their information, or, in the alternative, commit to sharing information in this way only on either an opt-in or opt-out basis. If a company chooses the first option, the company must designate contact information for customers to use to make such requests. The company can choose from three ways to provide customers with that contact information. The business can: (i) instruct personnel to provide the contact information upon request, (ii) put certain information in its Web site privacy policy, or (iii) have the contact information available in certain places of business in California.

The Complaint focused on an alleged failure by XO Group to satisfy option (ii), i.e., to include the required information in its Web site privacy policy. It alleged that the other two options (instructing personnel and having information available at places of business) are not available to XO Group, as an Internet-based business. The Complaint also alleged that XO Group did not adequately instruct its employees to provide contact information for making information requests. The Complaint did not address a business’s option of complying with STL by offering consumers an opt-in or opt-out right for information sharing.

Judge Stock sustained XO Group’s demurrers on several grounds:

• A statute that is designed to provide useful information to a customer, upon request, cannot be violated if there is no request made. The Complaint alleged that the plaintiff subscribed to services with XO Group and had no further contact.
• A business may comply with Civil Code § 1798.83(a) by giving customers an option to opt-out of information sharing in its privacy policy under Civil Code § 1798.83(c)(2). The Complaint did not and could not state that XO Group had failed to comply with Section 1798.83(c)(2). 
• The failure to allege a violation of the STL also meant that plaintiff had failed to allege she was injured by reason of a violation and lacked standing to sue under the STL.
• Civil Code § 1798.83(b)(1) gives covered businesses three alternative ways to comply with the STL’s customer education requirement: internal instruction to personnel under Section 1798.83(b)(1)(A), privacy policy posting under Section 1798.83(b)(1)(B), and making information available at places of business under Section 1798.83(b)(1)(C). The Complaint focused on alleged deficiencies in XO Group’s website privacy policy without addressing the STL’s allowance for alternative means of customer education.
• Plaintiff did not have standing to pursue the UCL cause of action because she had not lost money or property as a result of an alleged unlawful act or practice.    

This first trial court final decision in Regueiro v. XO Group, Inc. comes on the heels of the first STL ruling on a motion to dismiss, which federal District Court Judge Dale Fischer granted in a June 14, 2012 order. (Boorstein v. Men’s Journal LLC, 2012 WL 2152815 (C.D. Cal. June 14, 2012).) Judge Fischer dismissed the Complaint with leave to amend, and an amended complaint was filed on July 6, 2012. Judge Fischer’s decision, like Judge Stock’s, held that offering an opt-in/out option and providing disclosures are independent ways of complying with STL. Judge Fischer then went on to hold that each of the plaintiff’s three theories of injury fail under STL. First, diminution in value of personal information due to its sale is not recognized as legal “injury.” Even if it were, STL does not prohibit the sale of customer information (it merely gives consumers the right to find out about it), so any diminution in value of that information is not the “result of” a violation of STL, and therefore cannot convey standing. Second, a violation of STL is not, in itself, injury—there must be independent harm resulting from the violation. Third, there was no implied promise in the magazine subscription that Men’s Journal would comply with all laws such that a violation of STL, without actual harm, qualifies as an injury because it breaks that promise. Judge Fischer also held that the Unfair Competition Law claim failed, both as a derivative of the failed STL claim and independently because there was no injury to support it.

Proskauer will continue to monitor STL litigation and post updates here.

We thank Mira Serrill-Robins, an associate in our litigation department who assisted in our defense of these claims, for preparing this blog post.

Romanosky, Hoffman and Acquisti examined, for example, what factual and legal characteristics made a company more likely to be sued for a breach of personal data, and what made a data breach lawsuit more likely to settle.

As an interesting example, they found that the odds of a company being sued over a data breach are six times lower when the company offered free credit monitoring following the breach. They also examined the probability of lawsuit and settlement as a function of the causes of the breach and the types of data lost.

The researchers provided some very interesting summary data. For example, by coding data within the federal complaints, they found 87 unique causes of action brought by plaintiffs' attorneys. They also provided information on settlement amounts, attorney's fees awards and cy pres awards.

Any lawyer who handles data breach cases would likely find this article to provide valuable insights.

California has long taken privacy – including technology-related privacy – seriously. Article 1, Section 1 of the California Constitution recognizes privacy as an inalienable right. California’s Online Privacy Protection Act of 2003 (“CalOPPA”) provides substantial consumer privacy protection by requiring any “operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California” to post a conspicuous privacy policy detailing, for example, the categories of personally identifiable information collected from users and the categories of third-parties with whom the information may be shared.

• According to the California AG’s interpretation of CalOPPA, applications that collect personal user data must conspicuously post a privacy policy detailing, clearly and completely, how the application collects, uses, and shares personal data.

• The Companies agree to include optional data fields for an application’s privacy policy – via hyperlink or text – in the submission process for new or updated apps so that users will be able to access the provided policy information from the application store.

• Users will have the ability to report to the Companies applications that do not comply with applicable terms of service and/or laws, and the Companies will implement a process for responding to such reports.

These principles will apply globally to any mobile application that may impact a California consumer.

App developers that do not comply with CalOPPA by posting a privacy policy for their app can be held accountable under California law.

This blog post was written by Michelle Arnold, associate in our litigation department.

For now, the Consumer Privacy Bill of Rights is still a blueprint and does not include enforceable rules, but the Administration is pursuing implementation through legislation and a multistakeholder rule-making process.

The Consumer Privacy Bill of Rights adopts seven general principles as a guide for future rule-making and legislation:

1)      Individual Control. Companies should present consumers with clear choices about personal data collection, use, and disclosure, including the ability to withdraw or to limit consent. The Administration has already begun action on this principle. Internet and online advertising companies including Google, Yahoo!, Microsoft, and AOL, in response to calls from the Administration and the Federal Trade Commission (“FTC”), have committed to use Do Not Track technology from the World Wide Web Consortium in most major web browsers. 

2)      Transparency. Companies should clearly disclose to consumers the scope of information collected, how it is used, when it is deleted, and whether it is shared with third parties.

3)      Context. The use and disclosure of personal data should be commensurate with the relationship between company and consumer, as well as with the age and sophistication of the consumer.

4)      Security. Companies should maintain safeguards to control loss, unauthorized access, and improper disclosure of consumer data.

5)      Access and Accuracy. Companies should provide consumers with reasonable access to their personal data as well as the ability to correct data, request its deletion, or limit its use. 

6)      Focused Collection. Related to the context principle, companies should collect only as much personal data as needed to further contextually appropriate purposes. Once data is no longer needed, it should be deleted or de-identified.

7)      Accountability. Companies should conduct full audits where appropriate, and companies that disclose personal data to third parties should ensure the recipients are under enforceable obligations to adhere to the Consumer Privacy Bill of Rights.

In the coming months, the Administration envisions a multistakeholder rule-making process convened by the Department of Commerce’s National Telecommunications and Information Administration. The process would involve companies, industry groups, privacy advocates, consumer groups, academics, international partners, State Attorneys General, and other relevant groups in drafting a set of rules based on the Consumer Privacy Bill of Rights. Companies would then voluntarily commit to follow the rules, and those commitments would become enforceable by the FTC.

The Administration is also encouraging Congress to pass legislation implementing the Consumer Privacy Bill of Rights and granting the FTC and State Attorneys General authority to directly enforce the Consumer Privacy Bill of Rights.

As these implementation efforts continue, watch this blog for further developments.

This blog post was written by David Munkittrick, an associate in our Litigation Department.

Texas recently amended its breach notification law so that its consumer notification obligations apply not only to residents of Texas, but to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.  Texas's amended law (H.B. 300) specifically requires notification of data breaches to residents of states that have not enacted their own law requiring such notification (that is, Alabama, Kentucky, New Mexico and South Dakota). 

The law only applies to persons who "conduct business in" Texas, although the law does not elaborate on what that might include. 

The amended law also increases the penalties for a failure to notify consumers of a data breach from a maximum of $50,000 (under the old law) to $100 per individual per day of failed or delayed notification, not to exceed $250,000 for a single breach.

What does this mean for entities that have suffered a data breach?  Many companies that suffer nationwide data breaches already elect to notify individuals who reside in states that do not have breach notification laws, simply to avoid negative public relations scrutiny for not doing so.  However, for companies that conduct business in Texas, there could now be a price tag of up to $250,000 for not notifying non-Texas residents whose sensitive personal information was subject to a data breach.

Texas's new law will become effective September 1, 2012. 

Texas's H.B. 300 also amends Texas' Health and Safety Code to impose privacy and data security requirements that go beyond HIPAA (the Health Information Portability and Accountability Act), and it applies to entities that are neither a "covered entity" nor a "business associate" as defined by HIPAA.  Instead, Texas's definition of "covered entity" would cover any entity that handles PHI (protected health information), with some exceptions.  We will blog about these amendments separately.

Yesterday, we blogged about the FTC’s report released last week, “Protecting Consumer Privacy in an Era of Rapid Change.” But if the FTC’s recommendations become requirements, how would they change what the typical company is doing today? 

Our keynote speaker is Barbara Anthony, the Undersecretary of the Office of Consumer Affairs and Business Regulation of Massachusetts.

Tuesday, December 14, 2010
8:00 a.m. - 8:30 a.m. Breakfast and Registration
8:30 a.m. - 11:45 a.m. Program

One International Place
Boston, MA 02110-2600

Click here to register.

 

Regulation 201 CMR 17.00 ("Standards For The Protection of Personal Information of Residents of  the Commonweath") was previoulsly amended in August in response to industry backlash. 

This week's final amendments make very few changes to the regulations that were released in August:

• The regulations apply to persons who "store" personal information in addition to those who receive, maintain, process, or otherwise have access to personal information
• Service Providers include persons who "store" personal information through their provision of services directly to a person that is subject to the regulations (in addition to those who receive, maintain, process, or otherwise are permitted access to personal information)
• The express carve-out of the U.S. Postal Service from the definition of "Service Providers" has been removed
• The amendments clarify that Service Provider agreements that are entered into before March 1, 2010 do not have to be amended to comply with the regulations until March 1, 2012.

The March 1, 2010 effective date of the regulations has not changed.

One case on point has dragged on since late 2007, when Ameritrade reported that a database of its customers’ contact information (including names, physical addresses, email addresses and phone numbers) had been compromised. A class action law suit quickly followed, and the third settlement attempt was rejected just recently by the court on the grounds that, in the judge’s view, it provided an inadequate remedy for the affected consumers.

• Post notices on its Web site warning customers about “stock touting spam”
• Retain independent experts to conduct biannual penetration tests on its systems
• Seed its email address databases with monitored email addresses for the purpose of detecting data compromises
• Offer to pay for one year’s worth of a spam or virus filtering service for each of the 6 million customers whose email addresses were compromised
• Retain an analytics specialist to perform analyses of whether the compromised data has been used to commit identity theft
• If identity theft is detected, offer class members identity theft remediation services
• Donate $55,000 to two anti spam projects
• Pay plaintiffs’ counsel $1.9M in attorney’s fees

Since these settlement terms did not satisfy the judge, the parties will reconvene at a hearing on December 10, 2009.

The Ameritrade case has served as a reminder that companies should not ignore the importance of keeping contact information secure while focusing primarily on more sensitive information such as Social Security Numbers and financial account numbers. However, applicable laws that require companies to protect the security of individuals’ information generally do not apply to mere contact information. For that reason, it is still appropriate to classify contact information as “confidential” as long as your policies provide for reasonable protections for such information. As an example, since customer databases compile all customer contact information into one place, and are an attractive target for hackers, such databases should be afforded greater protection than individual documents that contain just one customer’s name and contact information. Similarly, when disposing of paper files containing customer contact information in mass, it would be a best practice, although not required by U.S. law, to shred such documents upon disposal.

The American Bar Association, represented by a Proskauer team led by partner Steven Krane, argued that the rules would impose a serious burden on law firms, and sought an injunction and declaratory judgment finding that lawyers are not covered by the rule. The FTC contended that lawyers should be covered, because many of their billing practices, such as charging clients on a monthly basis rather than up front, made them “creditors.”

The American Bar Association's complaint, prepared on a pro bono basis by Proskauer Rose, said that the application of the Rule to practicing lawyers is “arbitrary, capricious and contrary to law,” and that the FTC has failed “to articulate, among other things: a rational connection between the practice of law and identity theft; an explanation of how the manner in which lawyers bill their clients can be considered an extension of credit under the FACTA; or any legally supportable basis for application of the Red Flags Rule to lawyers engaged in the practice of law.” 

The FTC has not yet indicated whether it will appeal Judge Walton's ruling.

Here is a link to the court’s order.

Here is a link to the ABA’s press release.

Most privacy practitioners would not consider a legal entity to have privacy rights. Rather, a legal entity may have trade secrets or contractual confidentiality protections. However, in its novel holding, the Third Circuit found that a corporation (AT&T) was protected by an exemption in the Freedom of Information Act (FOIA) that applies to “unwarranted invasions of personal privacy.” Specifically, FOIA exempts “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information … could reasonably be expected to constitute an unwarranted invasion of personal privacy…”(emphasis added). This exemption, combined with FOIA’s definition of “person” to include legal entities, enabled AT&T to successfully argue that a corporation has a right to privacy. (After all, the court said, “it would be very odd indeed for an adjectival form of a defined term not to refer back to that defined term.”) As a result, AT&T’s competitors have not been able to obtain information about an FCC investigation of AT&T regarding AT&T’s alleged overcharging of some of its customers.

Whether this ruling will be followed in other FOIA cases, or used to expand the concept of privacy rights under other statutes, remains to be seen. For now, when submitting information to regulators in connection with investigations, companies should consider submitting such information as confidential, since doing so could help the company to later challenge attempts by competitors or other third parties to obtain such information from the regulator under FOIA.

This post was contributed to by Amy Crafts, a senior Associate in Proskauer's Boston office and a member of Proskauer's Privacy and Data Security Practice Group.