Federal Video Privacy Law Could Cover Internet Streaming

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Viewers of Internet video streaming website Hulu.com could go forward with purported class-action claims that Hulu violated the Video Privacy Protection Act (VPPA) by disclosing their video viewing selections and personal information to third-party ad networks and data-tracking companies, the federal district court in San Francisco has determined. A motion by Hulu to dismiss the lawsuit for failure to state a claim was denied.

According to the court, the VPPA could cover Hulu’s business model and data practices, and the site’s viewers could have standing to sue as “consumers” under the statute. In an earlier decision (CCH Privacy Law in Marketing ¶60,779), the court had ruled that the viewers’ allegations satisfied the requirements of Article III standing by stating an injury-in-fact.

Video Privacy Protection Act

The VPPA protects from disclosure certain personal information of individuals who rent, purchase, or otherwise receive video materials. Consumers whose “personally identifiable information” was knowingly disclosed by a “video tape service provider” to third-parties may bring a private cause of action. “Personally identifiable information” includes information that identifies a person as having requested or obtained specific video materials or services. Potential remedies include actual damages (but not less than liquidated damages of $2,500), punitive damages, attorney’s fees and litigation costs, and preliminary and equitable relief that the court determines is appropriate.

Video Tape Service Provider

The VPPA defines “video tape service provider” as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Although Hulu did not deal in prerecorded video cassette tapes, Hulu could be considered a “video tape service provider,” for purposes of the VPPA, the court said. Contrary to Hulu’s contention, the phrase “similar audiovisual materials” included digital content delivery.

Disclosures “Incident to the Ordinary Course of Business”

Disclosures of personal information are not prohibited if they are “incident to the ordinary course of business” of the video tape service provider. The VPPA defines “ordinary course of business” as “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” The plaintiffs alleged that Hulu’s disclosures—done for purposes including unauthorized tracking—did not fall within this “ordinary course of business” exception.

Hulu contended that disclosure of viewers’ data to online market research, ad network, and web analytics companies all involved Hulu’s use of third-party vendors providing services like internal research, advertising, and analytics that Hulu could do on its own and thus permissibly could outsource in the “ordinary course of business.” The factual issue could not be resolved on the pleadings, the court said, so the claim survived Hulu’s motion to dismiss.

“Consumers”

The viewers could qualify as “consumers,” for purposes of the VPPA, according to the court. The VPPA defined “consumers” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”

Hulu contended that the viewers were not “subscribers” because they did not rent or purchase content or otherwise pay Hulu for services or products. However, the viewers did more than visit Hulu’s website. The website’s “resurrection” of cookies previously deleted from the viewers’ computers allegedly allowed their data to be tracked “regardless of whether they were registered and logged in.” Hulu allegedly disclosed the viewers’ “Hulu profile identifiers” to third parties and linked the identifiers to their “individual Hulu profile pages that included name, location preference information designated by the user as private, and Hulu username.”

Moreover, while the terms “renter” and “buyer” necessarily implied payment of money, the term “subscriber” did not, the court said. Hulu cited no authority to the contrary. If Congress wanted to limit the VPPA’s definition of “subscriber” to “paid subscriber,” it would have said so, the court reasoned.

The decision is In re Hulu Privacy Litigation, CCH Privacy Law in Marketing ¶60,789

Google to Pay $22.5 Million to Settle FTC Charges of Misrepresenting Internet Tracking

This posting was written by John W. Arden.

Google, Inc. has agreed to pay a $22.5 million civil penalty to settle Federal Trade Commission misrepresentation charges concerning its promise not to place tracking “cookies” on the computers of users of Apple Inc.’s Safari Internet browser and not to direct targeted ads to those users, the FTC announced today.

The Commission charged Google with violating an October 2011 settlement, in which the company agreed not to misrepresent the extent that it protected the privacy and confidentiality of any information it collected from those visiting Google and partner websites and the extent to which consumers may exercise control over the collection, use, or disclosure of such information.

According to the FTC complaint, Google informed Safari Internet browser users that they did not need to take any action to be opted out of DoubleClick targeted advertisements and that it would not (1) place DoubleClick Advertising cookies on a user’s browser, (2) collect interest category information about the user, or (3) serve targeted advertisements to the user.

Despite these representations, Google overrode the Safari default browser setting and placed the cookies on Safari browsers, the FTC charged. The initial cookie enabled Google to collect, store, and transmit a user’s Google account ID. After the Safari browser accepted the initial cookie, Google set additional third-party cookies onto the user’s browser, it was alleged. Setting these cookies on users’ Safari browsers enabled Google to collect information and serve targeted advertisements to the users, the FTC said.

Besides making misrepresentations about its information collection and ad targeting practices, Google misrepresented that it adhered to the National Advertising Initiative’s Self-Regulatory Code of Conduct, which required the posting of a notice describing a company’s data collection, transfer, and use practices, the FTC claimed.

The civil penalty to be paid by Google is the largest the agency has ever obtained for a violation of an FTC consent order. In addition to the civil penalty, the consent order required Google to disable all the tracking cookies it said it would not place on consumer computers.

“The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order,” said FTC Chairman Jon Leibowitz. “No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers or they will end up paying many times what it would have cost them to comply in the first place.”

The Commission voted 4-1 to authorize the staff to refer the complaint to the Department of Justice and to approve the proposed consent decree. Commissioner J. Thomas Rosch dissented.

In a statement, the Commission said that the settlement was in the public interest because there was strong reason to believe that Google violated the October 2011 consent order and the $22.5 million fine was an appropriate remedy. In his dissenting statement, Commissioner Rosch objected to Google’s denial of liability in the consent decree. Rosch saw “no reason why the more common ‘neither admits nor denies liability’ language would not adequately protect Google from collateral estoppel in [civil] lawsuits.”

The Commission strongly disagreed with the view that if it allowed a defendant to deny the complaint’s substantive allegations that the settlement would not be in the public interest.

The complaint is United States v. Google, Inc., filed yesterday by the Department of Justice in federal district court in San Jose, California. Text of the complaint and the proposed stipulated order appear on the FTC website, along with a news release on the case.

Further information will appear in CCH Trade Regulation Reporter.

Myspace Joins Social Networking Sites Whose Privacy Claims Have Been Challenged by the FTC

This posting was written by Jeffrey May, Editor of CCH Trade Regulation Reporter.

Today, Myspace joined other popular social networking websites—such as Facebook, Google Buzz, and Twitter—in pledging to refrain from making false consumer privacy claims in light of a Federal Trade Commission challenge.

The operator of myspace.com has agreed to settle FTC charges that it violated Section 5(a) of the FTC Act by misleading users about what information third-party advertisers received about them. The FTC complaint alleged that Myspace made numerous promises to its users regarding the extent to which it shared consumers’ personal information with third-party advertisers.

Myspace's privacy policy allegedly promised it would not share users personally identifiable information, or use such information in a way that was inconsistent with the purpose for which it was submitted, without first giving notice to users and receiving their permission to do so. The privacy policy also promised that the information used to customize ads would not individually identify users to third parties and would not share non-anonymized browsing activity.

According to the FTC complaint, from January 2009 through June 2010, and again from October 2010 through October 2011, when Myspace displayed advertisements on its website from certain unaffiliated third-party advertisers, Myspace and/or its affiliate provided those advertisers with the Friend ID of the user who was viewing the page.

Myspace assigns a persistent unique numerical identifier, called a “Friend ID,” to each user profile created on Myspace. The Friend ID can be used to access information about the user, including location, gender, age, display name, and, in many cases, the user’s full name, according to the agency. With this information, a third-party advertiser could take simple steps to get detailed information about individual users.

In addition, Myspace allegedly certified that it complied with the U.S.-European Union Safe Harbor Framework, which provides a method for U.S. companies to transfer personal data lawfully from the European Union to the United States. As part of its self-certification, Myspace purportedly claimed that it complied with the Safe Harbor Principles, including the requirements that consumers be given notice of how their information will be used and the choice to opt out. The FTC alleged that these statements were false. The agency challenged similar claims by Facebook and Google Buzz last year.

Proposed Consent Order

A proposed consent order contains provisions designed to prevent Myspace from engaging in future practices similar to those alleged in the complaint, according to the FTC. Myspace would be prohibited from misrepresenting the privacy and confidentiality of any “covered information,” as well as the company’s compliance with any privacy, security, or other compliance program. Myspace also would be required to establish and maintain a comprehensive privacy program and to obtain biennial assessments of its privacy program by independent, third-party auditors for 20 years.

The complaint and proposed settlement, In the Matter of Myspace LLC, FTC File No. 102 3058, appear here on the FTC website.

Maryland Legislation Would Bar Employers from Requesting Employees’ or Applicants’ Social Media Account Passwords

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Maryland employers would be prohibited from asking employees or applicants to hand over the passwords for their Facebook accounts or other personal social media accounts, if a bill that has passed both houses of the Maryland legislature (Senate Bill 433 and House Bill 964) is signed by the governor. The two bills were reconciled and passed on April 6, 2012. If the law is approved, Maryland would be the first state to prohibit this practice.

The proposed law provides that employers may not take, or threaten to take, disciplinary actions against an employee for refusing to disclose social media account password and related information. Employers also may not refuse to hire an applicant as a result of the applicant’s refusal to disclose that information.

The bill also contains language prohibiting employees from uploading unauthorized employer proprietary information or financial data to their personal websites or other Internet sites. Employers would be allowed to conduct investigations for the purpose of ensuring compliance with applicable securities or financial laws or regulations, based on the receipt of information about the use of a personal website by an employee for business purposes or the uploading of employer proprietary information.

The proposed law would take effect on October 1, 2012.

User Failed to Allege Injury from LinkedIn’s Disclosure of Information, Browsing Histories

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

An individual lacked standing to pursue privacy-related claims against online social networking website operator LinkedIn for disclosing his personal information, including personally identifiable browsing histories, to third-party advertising and marketing companies through the use of cookies and web beacons, the federal district court in San Jose has decided.

The individual asserted that LinkedIn’s conduct violated the federal Stored Communications Act and California’s Constitution, Unfair Competition Law, False Advertising Law, Consumer Legal Remedies Act, and common law.

Tracking of Browsing Habits

LinkedIn allegedly assigned each registered user a unique user identification number. Then, LinkedIn’s website linked and transmitted the user ID number to third-party tracking cookies, allowing third parties to track users’ online activity and to aggregate data on their browsing habits. The individual asserted that LinkedIn added social information, such as the name of each user and the other LinkedIn profiles they viewed and interacted with; which enabled the third parties to determine the personal identity of the user.

Emotional Harm

The individual failed to allege that he sustained an injury that would confer Article III standing to sue. He alleged that he suffered embarrassment and humiliation, but it was unclear from the face of the complaint what information was disclosed that would cause the individual emotional harm, the court said. He did not allege that his browsing history was actually linked to his identity by LinkedIn and transmitted to any third parties. The allegation that his sensitive information might be transmitted in the future was too theoretical for purposes of establishing standing.

Economic Harm

The individual asserted that he was economically harmed by LinkedIn’s practices because his browsing history was personal property with market value, and LinkedIn took that property from him without compensating him. This purported injury was too abstract and hypothetical to support Article III standing, in the court’s view.

The individual relied on allegations that the data collection industry generally considered consumer information valuable and that he was not compensated for use of his information, but he did not describe how he was foreclosed from capitalizing on the value of his personal data or how he was deprived of the data’s economic value simply because his unspecified personal information was collected by third parties.

He did not allege that his credit card number, address, or Social Security number were stolen and published or that he was a likely target of identity theft as a result of LinkedIn’s practices, the court noted. Nor did he allege that his personal information was exposed to the public. The complaint was dismissed with leave to amend.

The decision is Low v. LinkedIn Corp., CCH Privacy Law in Marketing ¶60,695.

Privacy Claims Proceed Against Google for “Street View” Data Interception

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law.

Putative class action plaintiffs could pursue federal wiretapping claims against Google, Inc. for allegedly intercepting data from their wireless home networks during the course of its “Street View” mapping project, the federal district court in San Francisco has held.

The court, however, dismissed claims under various state wiretapping statues as preempted and under the California Unfair Competition Law for lack of standing.

Capture of Streamed Data

Google Street View featured panoramic views of various positions along streets using photos taken by vehicles equipped with nine directional cameras to capture 360 degree views of the streets and 3G/GSM/Wi-Fi antennas with custom-designed software for the capture and storage of wireless signals and data, commonly known as “wireless sniffers.”

Google’s wireless sniffers secretly captured data packets as they streamed across Wi-Fi connections, stored them on digital media, and later decoded them using crypto-analysis or a similarly complicated technology. The content of the captured data packets (payload data) included SSID information (Wi-Fi network names), MAC addressed (Wi-Fi network hardware ID numbers), usernames, passwords, and personal e-mails.

Federal Wiretapping Claim

The Wiretap Act, enacted as Title I of the Electronic Communications Privacy Act (ECPA) of 1986, establishes a private right of action against interceptors of an “electronic communication,” but creates an exception for interceptions of communications that are “readily accessible to the general public.” It also exempts an enumerated list of “radio communications,” none of which applied in the instant case.

While the statute does not define the term “radio communication,” an unrelated provision of statute stated that “readily accessible to the general public” with regard to a “radio communication” included a communication that was not “scrambled or encrypted.”

Google argued that its conduct was an exempt radio transmission because the plaintiffs did not plead that their Wi-Fi networks were scrambled or encrypted, and therefore their transmissions were “readily accessible to the general public.” The court disagreed. Both the various provisions within the ECPA, when read together, and the statute’s legislative history evidencing Congressional intent in passing the statute in 1986 supported the conclusion that the exemption for “radio communications” did not include wireless Internet networks.

Unlike traditional radio services transmissions, communications sent via Wi-Fi technology were not designed or intended to be accessible to the general public. Wi-Fi transmissions were more akin to private cellular telephone communications, a radio communication technology that existed in 1986 and purposely was left out of the ECPA’s radio communications exemption, according to the court.

State Wiretapping Claims

The court also held that the federal Wiretap Act preempted various state wiretapping statutes. While the ECPA contained no express preemptive statement, the statute was intended to comprehensively regulate the interception of electronic communications such that the scheme left no room for further regulation by the states, in the court’s view. The statute struck a balance between the right to the privacy of one’s electronic communications against the ability of radio technology users to inadvertently intercept communications.

Additional state regulation could upset that balance and could obscure the legislative scheme surrounding innovative communications technologies that Congress intended to clarify through the Act, the court reasoned. Further, the ECPA’s civil and criminal penalties provided broad protections for unlawful interceptions.

California Unfair Competition Law

The plaintiffs’ Unfair Competition Law claims were dismissed for failure to allege cognizable injury. The plaintiffs' allegations that they “suffered injury in fact and lost property as a result of the unfair and unlawful business practices” failed to meet minimal standing requirements.

Allegations of loss of personal information and invasion of privacy were insufficient to establish standing, according to the court. Intercepted data packets did not qualify as “lost property” for purposes of UCL standing. Attorneys’ fees and expenses incurred in litigation also could not be used to invoke standing.

Stay Pending Appeal

In a separate order, the court granted Google’s motion to stay the case pending immediate interlocutory appeal of the court’s interpretation of the term “radio communication” in the Wiretap Act; specifically, whether the term encompasses data packets transmitted from a wireless home network.

Certification was justified because the issue presented a novel question of statutory interpretation, involved a controlling question of law as to which there is a credible basis for a difference of opinion, and its resolution would materially advance the ultimate outcome of the litigation.

Two recent decisions in the case—In re Google, Inc. Street View Electronic Communications Litigation—are reported at CCH Guide to Computer Law ¶50,215 and ¶50,221. The decisions also will appear in CCH Privacy Law in Marketing.

Facebook Users’ Privacy Claims Dismissed

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law.

The federal district court in San Jose has dismissed claims filed by a putative class of Facebook users who alleged that the social networking website unlawfully transmitted their personal information to third-party advertisers without their consent.

The users’ California Legal Remedies Act (CLRA), Unfair Competition Law (UCL), and unjust enrichment claims were dismissed with prejudice, but the users were granted leave to amend claims alleging that Facebook violated its privacy policy, the federal Wiretap Act and Stored Communications Act (SCA), and the California computer crimes and civil fraud statutes.

The users alleged that, during a four or five month period in early 2010, a redesign of Facebook’s website caused it to transmit to a “referral header” to third-party advertisers when a user clicked on a banner advertisement. The referral header allegedly reported the user ID or username of the user who clicked on an advertisement, as well as information identifying the webpage the user was viewing prior to clicking on the ad.

Federal Wiretap and SCA Claims

The Wiretap Act prohibits electronic communication services providers from divulging the contents of a communication to any person or entity “other than an addressee or intended recipient of such communication.” The SCA provides that an electronic communication service provider “shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.”

Under both statutes, an electronic communication service provider may divulge the contents of a communication to an addressee or intended recipient of such communication.

The court discerned that the users’ allegations were subject to two interpretations. Under the first view, when a Facebook user clicked on a banner advertisement, that click constituted an electronic communication from the user to Facebook. The contents of the communication were a request for Facebook to send the electronic communication to the advertiser. Under the second interpretation, clicking on an advertisement constituted an electronic communication from the user directly to the advertiser.

According to this interpretation, Facebook served merely as a conduit for transmitting the communication to its intended recipient, the advertiser. Neither scenario would support a violation of the SCA or the Wiretap Act, according to the court.

California Computer Crimes Law

The court also held that the Facebook users failed to state a claim under California’s computer crimes statue. To state a violation under most subsections of Cal. Penal Code §502, a plaintiff must show that the defendant’s actions were taken “without permission.” A defendant may only be subjected to liability for acting “without permission” under §502 if the plaintiff can prove that the defendant “circumvented…technical barriers” that had been put in place to block the defendant’s access to the plaintiff’s website.

The users did not allege that Facebook circumvented technical barriers to gain access to a computer, computer network, or website. To the contrary, they alleged that Facebook caused “nonconsensual transmissions” of their personal information as a consequence of Facebook’s “re-design” of its website.

Facebook could not have acted “without permission” as there were no technical barriers blocking access to its own website. To the extent the users’ §502(c) claims alleged that Facebook acted “without permission,” they were dismissed with prejudice.

The court noted that Cal. Penal Code §502(c)(8) created liability for any person who “knowingly introduces any computer contaminant into any computer, computer system, or computer network.” Unlike the other sections of Cal. Penal Code §502(c), subsection (8) does not require that a defendant act “without permission.” Although the users failed to state a claim under §502(c)(8), they were granted leave to amend their claim.

California CLRA, UCL Claims

To assert an unfair competition claim under the California UCL, a private plaintiff must have “suffered injury in fact and . . . lost money or property as a result of the unfair competition.” A violation of the CLRA can only be alleged by an individual consumer who “purchases or leases any goods or services for personal, family, or household purposes.”

The users did not allege that they lost money as a result of Facebook’s conduct. Nor did they allege that they paid fees for Facebook’s services. The users only alleged that Facebook unlawfully shared their “personally identifiable information” with third-party advertisers.

An alleged loss of personal information did not constitute a loss of “property” that could form the basis for a UCL claim, the court held. With regard to their CLRA claim, the users failed to provide any legal support for their assertion that their personal information constituted a form of “payment” to Facebook for its services.

Breach of Contract Claim

To maintain an action for breach of contract under California law, an aggrieved party is required to show “appreciable and actual damage.” Allegations of nominal damages and speculative harm did not amount to legally cognizable damages. The users’ unsupported conclusory statement that they “suffered injury” as a result of Facebook’s breach of its privacy policy was insufficient.

The court advised the users to allege “specific facts showing appreciable and actual damages in support of their claim.” Because the users alleged the existence of a valid contract with Facebook, they could not maintain a claim for unjust enrichment.

The decision is In re Facebook Privacy Litigation., CCH Guide to Computer Law ¶50,183.

Further information about CCH Guide to Computer Law is available here.

California Bill Would Allow Consumers to Opt Out of Online Tracking

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

California consumers would have the opportunity to opt out of online tracking, under the provisions of a proposed bill under consideration in the California Senate.

Senate Bill 761 would call on the Attorney General, in consultation with the California Office of Privacy Protection, to adopt regulations requiring persons or entities doing business in California to provide California consumers with a method to opt out of the collection, use, and storage of their personal information.

Entities would also be required to disclose how they use consumers’ information and to which third parties they transfer the information.

Covered Information

Information covered by the bill would include the online activity of an individual and other personal identifying information, including postal addresses, e-mail addresses, telephone or fax numbers, and government-issued identification numbers.

The measure would not cover business addresses, telephone numbers, or fax numbers, or any information collected from or about an employee by an employer, prospective employer, or former employer that directly relates to the employee-employer relationship.

Exemptions

The measure would exempt persons or entities that:

(1) Store information about fewer than 15,000 individuals;

(2) Collect information from fewer than 10,000;

(3) Do not collect or store sensitive information; and

(4) Do not engage in monitoring or analysis of consumer behavior as the person’s or entity’s primary business.

Civil Action for Damages

The bill would make a covered entity that willfully fails to comply with the regulations liable to an affected consumer in a civil action for damages between $100 and $1,000, as well as punitive damages in the court’s discretion.

Originally introduced February 18 as an amendment to California’s coupon law (Business and Professions Code Sec. 17701), the bill was amended on March 24 by its author, Senator Alan S. Lowenthal, to substitute text regulating online tracking.

On April 4, the bill was amended to limit the exemption from coverage to entities that meet all of the four conditions listed above, rather than any one of them.

Google Settles FTC Privacy Charges Over Social Networking Service

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law.

Google, Inc. has agreed to settle Federal Trade Commission charges that it violated Gmail users’ privacy and acted deceptively when it introduced its social networking service Google Buzz last year. Google Buzz allows Gmail users to share status updates, comments, photos, and videos.

This is the first time the FTC has required a company to implement a comprehensive privacy program, the agency said in a March 30 news release.

Privacy advocates expressed concern about Buzz from the day it was launched. The FTC initiated its investigation in response to a complaint by the Electronic Privacy Information Center (EPIC) one week after Buzz made its debut. Google tweaked Buzz in response to criticism, but its practices failed to alleviate the agency’s concerns.

In its complaint against Google, the FTC delineated several deceptive or misleading practices it considered to be violations of Section 5(a) of the FTC Act.

The FTC alleged that Google’s Gmail Privacy Policy falsely represented that (1) Google would use Gmail users’ messages, contacts, and other account data only for providing Gmail services, and (2) Google would ask for users’ consent before using their personal information for a purpose other than for which is was collected.

In fact, Google used Gmail users’ information to populate Buzz without seeking users’ prior consent, according to the complaint.

The agency also contended that Google acted deceptively when it launched Buzz by (1) failing to disclose to Gmail users that Buzz’s default settings would publicly share certain previously private information, such as frequent email contacts and (2) misrepresenting Gmail users’ ability to opt-out of Buzz services.

User controls for limiting the sharing of personal information were “confusing and difficult to find,” the FTC said.

According to the FTC, Google’s Privacy Policy also falsely represented that Google complied with the US-EU Safe Harbor Framework. Google’s sharing of user information without obtaining consent allegedly violated the U.S. Safe Harbor Privacy Principles of Notice and Choice.

Under the proposed agreement and consent order, Google would be required, among other things, to:

• Comply with its stated information sharing practices;

• Not misrepresent the privacy and confidentiality of “covered information.” Covered information is defined to include first and last name, street address, physical address, location, telephone number, email address or other online contact information, such as user ids or screen names, lists of contacts, and persistent identifiers, such as static IP addresses;

• Establish and maintain a comprehensive privacy program designed to protect the privacy and confidentiality of covered information;

• Assess privacy risks associated with existing and when developing new products and services;

• Establish privacy controls and procedures; and

• Permit an independent privacy audit every other year for 20 years.

In a March 30 blog post (“An Update on Buzz”), Google apologized “for the mistakes we made with Buzz.”

Acknowledging that the launch of Google Buzz “fell short of our usual standards for transparency and user control—letting our users and Google down,” Google reassured users that “we are 100 percent focused on ensuring that our new privacy procedures effectively protect the interests of all our users going forward.”

Further information about In the matter of Google, Inc. File No. 102 3136, is available here on the FTC’s website.

A description of the agreement and consent order will be published soon in the Federal Register. Interested parties may submit written comments electronically or in paper form through May 2, 2011. Comments in electronic form should be submitted here.

FTC Testifies on the State of Online Consumer Privacy to Senate Committee

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Industry stakeholders have made important progress in implementing “Do Not Track,” a mechanism proposed by the Federal Trade Commission last December that would allow consumers to choose not to have their Internet browsing tracked by third parties, the FTC said today in testimony before the Senate Committee on Commerce, Science and Transportation.

The FTC’s testimony discussed its efforts to protect consumer privacy through enforcement actions, consumer education, and policy initiatives like the FTC staff’s recent preliminary privacy report.

That report—titled “Protecting Consumer Privacy in an Era of Rapid Change”—proposed a framework to balance consumer privacy with industry innovation by building privacy protections into everyday business practices (“privacy-by-design”); simplifying privacy choices for consumers; and improving transparency with clearer, shorter privacy notices.

Consumer Choice Mechanisms

“Do Not Track is no longer just a concept, it is becoming a reality,” said FTC Chairman Jon Leibowitz,. “It’s encouraging to see companies responding positively to our call for more consumer choice about their online privacy.”

The testimony noted that two of the major Internet browser vendors—Microsoft and Mozilla—have announced that they are developing choice mechanisms for online behavioral advertising.

In addition, the World Wide Web Consortium has accepted a submission by Microsoft to consider a technical standard for a universal choice mechanism and has announced that it is conducting a workshop in April 2011 on how to incorporate Do Not Track preferences into Internet browsing.

In the FTC’s view, an effective Do Not Track regime would:

• Be implemented universally, so consumers do not have to opt out as they go from site to site;

• Have an opt-out mechanism that is easy to find and easy to use;

• Offer choices to consumers that are persistent and that would not be deleted if, for example, consumers cleared their cookies or updated their browsers;

• Be effective and enforceable; and

• Let consumers opt out of being tracked for reasons other than commonly accepted uses, such as fraud prevention.

Universal Opt-Out

“A robust, effective Do Not Track system would ensure that consumers can opt out once, rather than having to exercise choices on a company-by-company or transaction-by-transaction basis,” the testimony stated. “Such a universal mechanism could be accomplished through legislation or potentially through robust, enforceable self-regulation.”

Consumers may want to opt out of more than targeted ads, the FTC said. For example, they might want to prevent prospective employers or insurers from examining their browsing habits. An effective Do Not Track system would go beyond simply opting consumers out of receiving targeted advertisements; it would opt them out of having their behavior tracked online, the testimony states.

“Commission staff will monitor further industry innovation in this area, which may build upon existing industry initiatives and incorporate elements of the different mechanisms being proposed today,” said the FTC.

Privacy Protection Efforts

The Commission stated that protecting consumers’ privacy had been a priority for 40 years.

“During this time, the Commission has employed a variety of strategies to protect consumer privacy, including law enforcement, regulation, outreach to consumers and businesses, and policy initiatives,” the FTC said.

According to the testimony, in the last 15 years, the FTC has brought more than 300 privacy-related actions, including:

• 32 data security cases,

• 64 cases against companies for improperly calling consumers on the Do Not Call registry,

• 86 cases against companies for violating the Fair Credit Reporting Act (FCRA),

• 97 spam cases,

• 15 spyware (or nuisance adware) cases, and

• 15 cases against companies for violating the Children’s Online Privacy Protection Act (COPPA).

The FTC has obtained $60 million in civil penalties in Do Not Call cases; $21 million in civil penalties under the FCRA; $5.7 million under the CAN-SPAM Act; and $3.2 million under COPPA, the testimony noted.

The Commission vote to approve the testimony was 4-1, with Commissioner William E. Kovacic dissenting. Text of the testimony can be found here on the FTC website.

Retailer’s Request for Credit Cardholder’s Zip Code Violates California Law

This posting was written by William Zale, Editor of CCH Advertising Law Guide.

When a store cashier asks for the zip code of a customer making a purchase with a credit card in California, the retailer violates California’s Song-Beverly Credit Card Act, the California Supreme Court has ruled.

A Williams-Sonoma customer filed a class action complaint alleging that when she was paying for a purchase with her credit card, the cashier asked for her zip code. Believing it necessary to complete the transaction, the customer provided the requested information and the cashier recorded it.

The trial court held that the customer failed to assert a violation of the Credit Card Act or a claim for invasion of privacy under the California Constitution, and a California appellate court affirmed that decision (CCH Advertising Law Guide ¶63,658; CCH Privacy Law in Marketing ¶60,400).

The California Supreme Court granted review, but only of the Credit Card Act claim.

Request for Personal Identification Information

The Act prohibits businesses that accept credit cards as payment for goods or services from requesting, or requiring as a condition to accepting the credit card as payment, the cardholder to provide personal identification information which the business records.

The statute’s express prohibition against “requesting” personal identification information was added in a 1991 amendment to prevent a retailer from making an end-run around the law by claiming the customer furnished personal identification data voluntarily, the court noted.

“Personal identification information” is defined as “information concerning the cardholder . . . including, but not limited to, the cardholder’s address and telephone number.”

Part of an Address

The California Supreme Court held that the Act’s prohibition applies not only to a complete address but also to a component of an address, such as a zip code. Otherwise, a business could ask not just for a cardholder’s zip code, but also for the cardholder’s street and city in addition to the zip code, so long as it did not also ask for the house number. Such a construction would render the statute’s protections hollow, the court said.

A cardholder’s zip code is similar to his or her address or telephone number, in that a zip code is both unnecessary to the transaction and can be used, together with the cardholder’s name, to locate the cardholder’s full address, according to the court. The retailer can then, as alleged in this case, use the accumulated information for its own purposes or sell the information to other businesses, the court added.

The court rejected contentions by Williams-Sonoma that the statute, as construed, violated due process and was unconstitutionally vague. The decision of the appellate court was reversed and remanded for further proceedings.

The February 10 decision in Pineda v. Williams-Sonoma Stores, Inc. will be reported in CCH Advertising Law Guide and CCH Privacy Law in Marketing.

Federal Consumer Privacy Bill Introduced in House

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

A proposed federal consumer privacy law titled “Building Effective Strategies to Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards Act” (“BEST PRACTICES Act”) was introduced in the House of Representatives on July 19 by Rep. Bobby L. Rush (D, Ill.).

According to Rush, the bill (H.R. 5777) would establish a flexible framework of basic rights for consumers while also outlining obligations for companies based on fair information principles. The measure would cover both online and offline collection, use, and retention of information about consumers.

The bill would grant enforcement authority to the Federal Trade Commission and the states, including civil penalty authority; would authorize a limited private right of action; and would preempt certain state laws that require covered entities to implement requirements with respect to the collection, use, or disclosure of consumer information.

The preemption provision would not apply to state laws that address financial information or health information, data breach laws, trespass, contract or tort laws, or other laws that relate to acts of fraud.

If enacted, the “BEST PRACTICES Act” would:

• Require companies that collect personal information to disclose their practices with respect to the collection, use, disclosure, merging, and retention of personal information, and to explain consumers' options regarding those practices;

• Require companies to provide disclosures of their practices in concise, meaningful, timely, and easy-to-understand notices;

• Require companies to obtain "opt-in" consent to disclose information to a third party;

• Establish a "safe harbor" that would exempt companies from the "opt-in" requirement, provided those companies participate in a universal opt-out program operated by self-regulatory bodies and monitored by the FTC;

• Require companies to have reasonable procedures to assure the accuracy of the personal information they collect, as well as means for consumers to access and correct or amend certain information; and

• Require companies to have reasonable procedures to secure information and to retain personal information only as long as is necessary to fulfill a legitimate business or law enforcement need.

Text of the bill, which was referred to the House Energy and Commerce Committee, appears here at the Thomas website of the Library of Congress.

State’s Bulk Sale of Motor Vehicle Records Did Not Violate Federal Driver’s Privacy Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

The federal Driver’s Privacy Protection Act (DPPA) permitted the State of Texas to sell drivers motor vehicle (DMV) records in bulk to private entities that certified that they had a lawful purpose for acquiring the data, the U.S. Court of Appeals in New Orleans has decided.

A provision of the Texas Transportation Code allowed individuals and companies to buy magnetic tapes of driver’s license records, upon certification of a lawful purpose.

Plaintiffs bringing a purported class action on behalf of individuals with drivers licenses issued by the State of Texas asserted that the purchasing entities did not use all of the records immediately and maintained databases or resold the information.

The plaintiffs did not contend that the entities used any of the records for a purpose other than the permissible purposes listed in the DPPA; nor did they allege that records resold to third parties were used for impermissible purposes. Instead, they argued that maintaining records not actually used for the purpose stated at the time of purchase was itself an impermissible purpose under the DPPA.

The text and legislative history of the DPPA indicated that Congress intended to allow states to distribute DMV information in bulk, according to the court. Purchasers of the data were not required to actually use all of the data, as long as they did not use any of the information for a purpose not permitted by the DPPA. The DMV database was analogous to a set of legal reporters purchased by an attorney who intended to do research using the set, but was unlikely to read every single opinion, the court said.

In addition, the purchasing entities were not required to make use of the DMV records before reselling them to third parties for one or more of the DPPA’s permissible purposes. Dismissal of the DPPA claims with prejudice was affirmed.

The decision in Taylor v. Acxiom Corp. will appear at CCH Privacy Law in Marketing ¶60,510.

FTC Addresses Consumer Privacy at Congressional Hearings

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law.

The Federal Trade Commission recently appeared before two congressional committees to testify about FTC efforts to protect consumer privacy.

Chairman Jon Leibowitz appeared before the Senate Commerce, Science, and Transportation Committee on July 27 and David Vladeck, Director of the FTC’s Bureau of Consumer Protection, appeared before the Subcommittee on Commerce, Trade, and Consumer Protection of the House Committee on Energy and Commerce on July 22.

The testimonies described the FTC’s actions to hold companies accountable for protecting consumer privacy (focusing on data security, identity theft, and children’s privacy) and protecting consumers from intrusive spam, spyware, and telemarketing.

The FTC has brought 28 actions charging businesses with failing to protect consumers’ personal information, 15 actions charging website operators with collecting information from children without parents’ consent, 15 spyware cases, and dozens of actions challenging illegal spam, including an action against a rogue Internet Service Provider that resulted in a temporary 30 percent drop in spam worldwide.

In addition, the FTC brought 64 actions alleging violations of the Do Not Call Rule, resulting in violators paying almost $40 million in civil penalties and giving up nearly $18 million, including consumer redress.

New Technologies, Business Models

The testimonies also described the FTC’s recent initiatives to examine consumer privacy protection in light of new technologies and business models, including hosting a series of roundtables discussions addressing (1) integrating privacy into everyday business practices; (2) simplifying consumer choices about commercial data practices, and (3) increasing transparency of those practices.

Chairman Leibowitz said that consumers do not understand the extent to which companies are collecting, using, aggregating, storing, and sharing their personal information, particularly with regard to companies’ affiliate information sharing.

Data Use Transparency

The Commission “is considering a number of other ways to increase transparency about commercial data practices,” Leibowitz said. In an upcoming report, the Commission will discuss ways to improve the disclosures in privacy policies. One possible approach is the use of standardized terms or formats, Leibowitz said. The Commission also favors giving consumers the right to opt-in to how their data will be used.

Repeal Common Carrier Exemption

Chairman Leibowitz renewed the FTC’s request for repeal of the telecommunications common carrier exemption from the FTC Act. Currently, the FTC Act exempts common carrier activities from the FTC Act’s prohibitions on unfair and deceptive acts or practices and unfair methods of competition.

House Legislation

David Vladeck expressed the FTC’s general support for two legislative proposals—H.R. 5777 (the “BEST PRACTICES Act”) and a discussion daft of legislation to require consumer notice and consent regarding collection and use of personal information.

H.R. 5777, the Building Effective Strategies To Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards Act (the "BEST PRACTICES Act"), was introduced by Bobby Rush (D-IL), Chairman of the Subcommittee on Commerce, Trade, and Consumer Protection, on July 19, to foster transparency about the commercial use of personal information. The text of Chairman Rush’s BEST PRACTICES Act can be found here.

The discussion draft of legislation proposed by Rick Boucher (D-VA), Chairman of the Subcommittee on Communications, Technology, and the Internet, would require consumer notice to and consent prior to collection and use of personal information. The text of Chairman Boucher's discussion draft bill can be found here.

The FTC supported overlapping provisions in both proposals’ concerning data security and accuracy, simplification of consumer choice in determining collection and use of personal information, and enhanced FTC rulemaking authority. David Vladeck also urged Congress to (1) require standardized, clear disclosures to enable consumers to compare privacy protections, (2) ensure that disclosures be given at the time of relevant transactions, and (3) not necessarily exempt business affiliates from consent requirements.

Chairman Leibowitz’s Senate testimony is available here. David Vladeck’s House testimony is available here.

Public Interest Groups Urge FTC to Create Comprehensive Privacy Plan

This posting was written by John W. Arden.

Seventeen public interest and privacy groups sent a letter yesterday to Federal Trade Commission Chairman Jon Leibowitz, urging the FTC to “draft a comprehensive plan that both details the deficiencies in Americans’ privacy rights, and proposes comprehensive statutory and regulatory solutions to those problems.”

The letter asserted that U.S. privacy law was “in a state of disarray,” that existing laws “don’t adequately address new business practices,” and that entire industries have sprung up “with little or no regulation.”

“Under the guise of `self regulation,’ companies routinely revise privacy policies so that they can do essentially whatever they wish with the data they collect,” the letter stated. “Meanwhile, public support for stronger privacy safeguards is growing as consumer protests continue to mount.”

Opportunity to Act

After hosting a series of roundtable discussions on privacy challenges posed by technology and business practices that collect and use consumer data, the FTC is well positioned to issue a “wide-ranging report” addressing problems of online and offline data collection, the groups observed. The agency was urge to “seize this opportunity.”

The groups recommended that the Commission take the following steps:

 Propose a comprehensive privacy law that would provide consumers with safeguards and control over their personal information;

 Set out regulations for the collection of information by the online advertising industry to help ensure that consumers have meaningful control over their personal information;

 Identify specific new business practices that raise possible privacy concerns and propose solutions; and

 Improve the agency’s transparency so the public can understand the significance and effectiveness of an enforcement action.

Need for Comprehensive Regulation

The letter pointed out that current U.S. privacy law is piecemeal, protecting personal information in one area, while leaving it uncovered in another context.

“We believe a comprehensive overview of the problems and a discussion of the potential solutions—similar to the recent Federal Communications Broadband Plan—is the best way to begin to address these systemic problems.”

The letter was signed by 17 groups, including the ACLU, the Center for Digital Democracy, the Electronic Frontier Foundation, the Electronic Privacy Information Center, Public Citizen, US PIRG, and the World Privacy Forum.

Text of the letter appears here on the Center for Digital Democracy’s web site.

AOL Users May Seek Injunction Barring Release of Internet Search Records

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

California consumers could proceed with claims under that state’s Consumer Legal Remedies Act (CLRA) against Internet service provider AOL for unlawfully making public a database containing the Internet search records of more than 650,000 AOL members, the federal district court in Oakland has decided.

The consumers could pursue injunctive relief, although they failed to provide the requisite notice under the CLRA in order to pursue a claim for damages.

Misrepresentations

The consumers alleged that AOL made false representations in its privacy policy and other statements posted on AOL's website, which assured members that AOL would endeavor to maintain the privacy of their personal information. These allegations were specific enough to satisfy the requirements of Federal Rule of Civil Procedure 9(b), the court said.

The expectations of privacy fostered by these statements were material in terms of influencing AOL members' decisions whether to disclose sensitive information, in the court’s view. Accordingly, the consumers sufficiently pleaded causation for purposes of the CLRA.

The consumers adequately alleged that they sustained injury as a result of AOL’s conduct. “Damage” under the CLRA could encompass harms other than pecuniary damages, the court noted. AOL’s disclosure of highly sensitive personal information regarding its members—including names, addresses, credit card numbers, Social Security numbers, and medical information—was not something that members bargained for when they signed up and paid fees for AOL's service.

Injunctive Relief

The consumers could seek an injunction requiring AOL to:

(1) ensure that member search data does not appear as search results in Internet search engines;

(2) take all necessary steps to enforce a license to prohibit commercial and non-research use of members' search data;

(3) no longer store or maintain records associated with members' searches on AOL's search engine; and

(4) destroy all such records in its possession.

AOL allegedly engaged in a practice and policy of storing search queries containing confidential information and allegedly had taken no steps to ensure that such data would not be disclosed again in the future. Although AOL had pulled the leaked database from its website, the information already had been posted on a number of other public sites.

AOL allegedly did not attempt to retrieve this information or to prevent further republication. The consumers asserted that AOL continued to collect and disseminate the same types of data, the court said.

Damages

The CLRA requires plaintiffs to provide notice to the defendant of the alleged statutory violation and a demand to rectify the alleged violation within 30 days. There was no dispute that the consumers had failed to do so, according to the court.
The claim for damages was dismissed without prejudice, until 30 days or more after the plaintiff complied with the notice requirement. If AOL corrected the alleged wrongs or indicated that it would correct the wrongs within the 30-day period, it could not be held liable for damages.

Disposal of Records

The consumers failed to state a claim that AOL violated the California Consumer Records Act (CRA), the court determined. The CRA provided that businesses must take all reasonable steps to shred, erase, or otherwise destroy customer records that were no longer to be maintained and required businesses to maintain security procedures to protect consumers' personal information.

The CRA was inapplicable because it applied only when a business intended to discard records containing personal information. The alleged disclosure by AOL did not occur in the course of AOL's disposal of customer records, the court said.

The decision is Doe v. AOL LLC, CCH Privacy Law in Marketing ¶60,493.

Further information regarding CCH Privacy Law in Marketing appears here on the CCH Online Store.

Twitter Agrees to Settle FTC Privacy and Security Charges

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law.

Micro-blogging service Twitter has agreed to settle Federal Trade Commission charges that it “deceived consumers” about its privacy practices and failed to implement reasonable security measures to safeguard user information.

The Commission issued a complaint yesterday, alleging that Twitter violated Section 5 of the FTC Act by engaging in a number of practices that, taken together, failed to provide reasonable and appropriate security to prevent unauthorized access to nonpublic user information and honor the privacy choices exercised by such users. A proposed FTC consent order, resolving the allegations, was released at the same time.

Between January and May 2009, hackers twice exploited Twitter’s lax and ineffective security measures to obtain unauthorized administrative control of the Twitter system, according to the agency. The hackers gained access to nonpublic user information and reset users’ passwords to send unauthorized tweets from users’ accounts, including one from President-elect Barack Obama and another from Fox News.

Under the terms of the proposed FTC consent order, Twitter has agreed to:

· refrain from misrepresenting its efforts to maintain and protect the security, privacy, confidentiality, or integrity of any nonpublic information;

· adopt and maintain comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of nonpublic consumer information; and

· permit biennial assessments and reports from an independent third-party security professional.

“When a company promises consumers that their personal information is secure, it must live up to that promise,” said FTC Bureau of Consumer Protection Director David Vladeck. “Likewise, a company that allows consumers to designate their information as private must use reasonable security to uphold such designations.”

Twitter Blog Post

A post on Twitter’s corporate blog described the 2009 hacking incidents, occurring at a time when the company had fewer than 50 employees, as small in scale and duration—over the course of a few hours, 45 accounts were accessed in January and in April, 10 accounts were accessed before the hacker was detected and shut down within minutes. The blog post noted that, prior to the FTC settlement, “we’d implemented many of the FTC's suggestions and the agreement formalizes our commitment to those security practices.” No other privacy or security complaints have been brought against Twitter, according to Twitter General Counsel Alexander Macgillivray.

San Francisco-based Twitter was established in 2006 as a social networking website operating at Twitter.com that enables users to send “tweets,” SMS messages of up to 140 characters, to other users who sign up to “follow” them and receive updates via e-mail and mobile text messages. Today, Twitter has around two hundred employees and an estimated 75 million users worldwide.

First Data Security Case Against Social Network

The FTC noted in a press release that its action against Twitter was the first against a social networking service for faulty data security.

The complaint, consent order, and other documents in In the Matter of Twitter, Inc., FTC File No. 092 3093, are available here on the FTC's website. The documents are published at CCH Trade Regulation Reporter ¶16,469.

Further information regarding the CCH Trade Regulation Reporter appear here on the CCH Online Store.

FTC Finds Sensitive Data Leaked from Organizations to P2P Networks

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law.

The Federal Trade Commission announced on February 22 that it has notified nearly 100 organizations that personal information emanating from the organizations' computer networks had been shared and was available on peer-to-peer (P2P) file-sharing networks where it could be accessed and used to commit identity theft or fraud. The information included sensitive data about customers and/or employees.

Notices Sent to Private, Public Entities

The notices went to both private and public entities, including schools and local governments, the agency said. Entities contacted ranged in size from businesses with as few as eight employees to publicly-held corporations employing tens of thousands. The agency also said it opened non-public investigations of other companies whose customer or employee information has been exposed on P2P networks.

The notification letters urged the entities to review their security practices—and. if appropriate, the practices of contractors and vendors—to ensure that they are reasonable, appropriate, and in compliance with the law. The agency posted samples of the letters (Letter A, Letter B, and Letter C), which advise recipients, “It is your responsibility to protect such information from unauthorized access, including taking steps to control the use of P2P software on your own networks and those of your service providers.”

The FTC warned that failure to prevent such information from being shared to a P2P network may constitute a violation of law, including the Gramm-Leach-Bliley Act and Section 5 of the FTC Act.

“Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers’ sensitive information at risk,” said FTC Chairman Jon Leibowitz.

“Companies should take a hard look at their systems to ensure that there are no unauthorized P2P file-sharing programs and that authorized programs are properly configured and secure,” Leibowitz counseled.

Notification of Customers, Employees

The FTC also recommended that the entities identify affected customers and employees and consider whether to notify them that their information is available on P2P networks. Many states and federal regulatory agencies have laws or guidelines about businesses notification responsibilities in these circumstances, the agency noted.

Text of the announcement appears here on the FTC website.

To help businesses manage the security risks presented by file-sharing software, the FTC released a new business education brochure, “Peer-to-Peer File Sharing: A Guide for Business,” describing the risks and recommend ways to manage them.

Further information about the FTC’s privacy and data security enforcement actions can be found here.

Class Certified in Privacy Action over Sale of Missouri Driver’s License Data

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Class certification has been granted by the federal district court in Kansas City to Missouri residents whose personal information was allegedly obtained by a data mining company from the Missouri Department of Revenue and sold to an online database operator, in violation of the federal Driver’s Privacy Protection Act (CCH Privacy Law in Marketing ¶25,500).

The data mining company allegedly acquired a large database from the Department of Revenue by falsely claiming that the information in the database was to be used to verify the identity of individuals doing business with the company. The database contained driver’s license information about class members, including their Social Security numbers.

The company allegedly transferred the information to the online database operator, which made the information available for sale on its website. The Department of Revenue allegedly authorized or participated in the dissemination of the class members’ personal data.

It was estimated that at least 300,000 Social Security numbers were in the database, which was sufficient to establish numerosity for class certification purposes, the court said. Class members’ claims involved several common issues of law and fact. The named class representative asserted that her claims emanated from the same legal theory or offense as the claims of the class.

A class action was superior to other methods of adjudicating the claims, in the court's view. Given the large number of potential plaintiffs and the commonality of their claims, class action treatment would be more efficient than individual adjudications.

The class was defined to include all licensed drivers in the state of Missouri whose personal information from their motor vehicle records was obtained, disclosed, or used by the defendants between July 21, 2004 and the present.

The decision is Roberts v. The Source for Public Data, CCH Privacy Law in Marketing ¶60,404.

Using Motor Vehicle Data to Solicit Legal Clients Would Violate Federal Privacy Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

A purported class of individuals could pursue claims against attorneys for violating the Driver's Privacy Protection Act (DPPA) by unlawfully obtaining personal information pursuant to the Freedom of Information Act (FOIA) from the South Carolina Department of Motor Vehicles (SCDMV) for the impermissible purpose of soliciting clients, the federal district court in Greenville, South Carolina has ruled.

The attorneys allegedly sent several FOIA requests to the SCDMV seeking information regarding individuals who purchased automobiles during specific periods of time, including the name, address, and telephone number of the buyer; the dealership where the automobile was purchased; the type of vehicle purchased; and the date of the purchase.

The attorneys then mailed a letter to the individuals, whose information was obtained, offering a free consultation and inviting the individuals to hire the attorneys to represent them in a lawsuit against certain dealerships. The letter included the label “ADVERTISING MATERIAL.”

Litigation, State-Action Exceptions

This conduct would not fall under the DPPA's “litigation exception,” according to the court. The DPPA provides that a state DMV may disclose personal information for use in connection with an investigation in anticipation of litigation. The exception permitted the attorneys to request information in an attempt to obtain evidence, but not to find and solicit clients.

The attorneys also did not qualify for the DPPA's state-action exception by functioning as “private attorneys general.” The attorneys did not allege that they provided any information to any government agency.

Knowledge, Damages Requirements

The individuals did not have to allege that the attorneys knowingly violated the DPPA, only that they knowingly obtained their personal information, the court said. The individuals were not required to plead actual damages in order to receive statutory liquidated damages under the DPPA.

The DPPA did not violate the Commerce Clause, the court determined. The personal information regulated by the DPPA was in interstate commerce and was therefore a proper subject of congressional regulation.

The decision is Maracich v. Spears, CCH Privacy Law in Marketing ¶60,380.