Consumer Advertising Law Blog

The Power of I: Advertisers Attempt to Demystify Online Advertising for Consumers

Those of you who shop online, use web-based mail, or spend any amount time perusing websites online (and that covers, well, almost everyone), may have come across an advertisement that left you wondering, “How did I get this ad?” Soon, thanks to a blue symbol with a little white “i”, your question will be answered with the click of a link.

Heeding calls for more self-regulation and concerns of privacy advocates, the Federal Trade Commission, and Congress, the advertising industry has come up with a standardized icon -- referred to as the "Power I" -- that will let consumers know how advertisers use web surfing history, demographic profiles, and other personal data to display ads tailored to the interests of the specific online user. Once a consumer clicks on the Power I, they will be taken to a page detailing why certain ads are being shown to them. Although there is no legal requirement that companies that use online advertising adopt the Power I, industry groups hope that it catches on so that it can be used in the argument against the need for further prescriptive government regulation. An online campaign initially aimed at explaining the system behind web advertisements to consumers has already been launched. The second stage of the online campaign will focus on the "Power I" specifically.

The FTC undoubtedly will keep a close eye on the effectiveness of the Power I, and it is likely companies will have to do more in the way of making online advertising practices more transparent to consumers. For the Power I to be “powerful,” though, most, if not all, advertisers will have to adopt it, and consumers will have to learn to interact with the Power I in a meaningful way. If it works, however, the Power I may be seen as a key step toward better information for consumers about their online privacy and making the process behind behavioral advertising more visible. Nevertheless, this step alone is unlikely to stave off legislation or industry wide regulation, and advertisers will probably have to focus on other key behavioral advertising issues, such as consent, re-use of data, and data retention.

- Danielle Sims, Nancy Perkins, and Sean Morris

Vladeck Calls for "Baked In", Not "Half-Baked" Protections for Consumer Data

The FTC gathered in the west yesterday, holding the second in its series of Internet "Privacy Roundtables" at Berkeley Law School. Like the first round table last month in Washington (previously reported on here), the event yesterday brought together representatives from business, consumer advocacy groups, and government to wrestle with the privacy issues faced in this age when just about every visit to a website, update of a social media profile, or use of an iPhone app results in the collection of consumer data. And also like last month, the panels sometimes became "politely heated" as the participants expressed differing views regarding how to address the issues.

The day began with Commissioner Pamela Harbour stating that, what with all the privacy concerns consumers face, "good" businesses have an opportunity to compete for market share on the privacy point, a sentiment repeated in later panels. Nevertheless, she also noted her view that market forces are not sufficient to protect consumers, because (among other reasons) it is "difficult for consumers to define their expectations" for privacy. BCP Director David Vladeck followed, picking up on the theme of continued concern that many consumers do not understand the privacy issues they face, and that privacy protections for new technology should thus be "baked in at the beginning, rather than half-baked" add ons later.

The panels then addressed issues ranging from the particular issues raised by social networking sites, what happens to consumer data in the "cloud," and how mobile devices bring their own unique issues.

As readers of this blog know, it seems pretty clear that the FTC is looking to move away from a self-regulatory "notice and consent" model for dealing with privacy and toward a prescriptive world. Comments at this Berkeley roundtable were consistent with that, but obviously no solutions were reached. Now it's on to the third and last in the round table series, this time back in DC.

If you are interested in watching the webcast of the Berkeley Roundtable, it is available here.

- Sean Morris

FTC Round Table Tango: Agency and Congress Dance Steps Hint At Where Online Privacy Legislation Is Going

The FTC announced today the agenda for its second privacy roundtable discussion, scheduled for January 28, in Berkeley, California “to explore the privacy challenges posed by the vast array of 21st century technology and business practices that collect and use consumer data.” This second recent foray into online privacy follows the first roundtable, held December 7, 2009, in Washington DC. Although the focus of these roundtables is wider than using consumers' information to support Behavioral Advertising (BA), a bit of background on that practice and the history behind these discussions, provide perspective on some of the issues involved.

A Brief History

As long-time readers know, the FTC has been engaged in a dance with industry for years over using consumers' personal information to support different business activities, including BA (the “tracking of a consumer’s activities online - including the searches the consumer has conducted, the web pages visited, and the content viewed - in order to deliver advertising targeted to the individual consumer’s interest”). When the music first started the FTC and industry seemed to be doing a waltz, moving together in both apposition and concordance, and the FTC in 2007 seemed happy to let industry take a self-regulatory spin. With the changing of administrations, the waltz gave way to alternating turns of break-dancing. First industry, then the FTC, sought to anticipate the other and vied for the crowd's attention. The Network Advertising Initiative (NAI), jumped on stage early, modifying its existing online self-regulatory code of conduct in December, 2008, anticipating the FTC’s release of “final” self-regulatory principles by two months. The FTC issued those principles in February, 2009, with staff in the accompanying report. Congress, watching from the sidelines, grumbled it wasn't overly fond of the music, and began to mutter about changing the tune completely. The Interactive Advertising Bureau (IAB), until then mostly silent, broke onto the floor in July, suggesting Congress stay on the sidelines because the dance floor was full and the dancers already doing quite fine on their own. The FTC then sidled closer to where Congress was standing, and said that it too was thinking it might be time to change the music once and for all. Since then, the dance has slowed to a crawl as everyone has waited to see what music Congress decides to put on and occasionally suggesting the current tune was still snappy and shouldn't be changed just yet.

FACTA Court Opinion: E-Mail Receipt Is Not “Electronically Printed”

It is apparent, especially during the holiday season, that Internet commerce has become an evolving substitute for traditional in-store shopping. In the area of federal identity theft protections, however, purchases over the Internet are not comparable to in-store transactions.

Under the Fair and Accurate Credit Transactions Act (“FACTA”), a person that accepts credit or debit card payments is prohibited from printing more than the last five digits of the card number or the expiration date on any receipt provided at the point of sale or transaction. The U.S. District Court for the Northern District of Illinois, however, recently determined that these FACTA prohibitions do not apply to email order confirmations related to Internet purchases. (Shlahtichman v. 1-800 CONTACTS (N.D. Ill. 2009) 

In Shlahtichman v. 1-800 CONTACTS, Inc., the plaintiff purchased contact lenses from the defendant through an Internet transaction with his credit card. The defendant sent the plaintiff a receipt through e-mail which contained the plaintiff’s credit card expiration date. The district court dismissed the plaintiff’s claim that the defendant’s actions were in violation of FACTA for two reasons: 1) an e-mail receipt is not an “electronically printed” receipt under FACTA; and 2) an e-mail receipt is not provided at a transaction’s point of sale.

(1) An e-mail receipt is not an electronically printed receipt under FACTA

The relevant FACTA prohibitions are limited to “receipts that are electronically printed.” The court examined the plain meaning of FACTA, as well prior case law analyzing FACTA’s language, and concluded, consistent with the majority of court opinions to date, that e-mail receipts are not “electronically printed” receipts. The judge noted that the word “print” means to transfer information onto paper and not to display on a computer screen. To emphasize the point that print could only refer to a tangible paper receipt, the judge quoted a prior case (Grabein v. Jupiterimages (S.D. Fla. 2008), noting that the definition of “print” only refers to a tangible, paper receipt. That is why a person “has to print a copy of his receipt to get it off of his computer; it is why the machine used to transfer text from a computer to paper is called a printer.” 

The Shlahtichman court also looked at Congress’ intent underlying the FACTA, noting that the statute was only meant to prevent low levels of identity theft, such as using information on a receipt obtained from the trash. If FACTA were aimed at protecting email privacy, the court opined, Congress would have explicitly referenced e-mail, as it has done in other statutes.

(2) An e-mail receipt is not provided at a transaction’s point of sale

FACTA also requires that the receipt covered by the statute be provided “at the point of the sale or transaction.” According to the Shlahtichman court, Internet commerce has no tangible point of sale or transaction, and thus FACTA cannot apply to an e-mail receipt resulting from an Internet purchase. E-mail receipts are directed to an account that could be accessed anywhere in the world, and not specifically to the place or computer where the consumer made the purchase. The court concluded that the a point of sale or transaction could only exist in the context of printed paper receipts.

As the Internet continues to drive retail shopping to the virtual realm, with search engines, one-click transactions, and cyber promotions, FACTA’s identity theft protections may become more and more limited. Shoppers eschewing the crowds at the mall should be aware that if they leave their e-mail on view to others, they may not have recourse to relief under FACTA in the event their receipts show too much of their personal data.

- Beth DeSimone, Nancy Perkins, and Brian Larkin

The FTC Tackles Online Privacy - Vladeck Speaks

In sessions filled with healthy doses of Louis Brandeis references, the FTC hosted on December 7 the first of its day-long roundtable discussions designed to explore online privacy issues. FTC Chairman Jon Leibowitz kicked off the day by referring to this as a watershed time for online privacy policy. Panelists representing industry, consumer groups, technology, and government then debated the benefits and risks of collection and use of consumer data over the Internet.

The final session addressed whether additional regulation is needed, which unsurprisingly drew a sharp split of opinion. This, of course, comes as we await anticipated draft privacy legislation being overseen by Congressman Rick Boucher, D-Va.

In summing up the day, David Vladeck, the FTC Director for the Bureau of Consumer Protection, noted that the last panel in particular “exemplified just how difficult the questions we have to confront are,” and offered these additional overarching conclusions and “questions [that] face us in the future”:

• The panelists “pointed out that the benefits [of online information tracking] include[e] free content, better search results and more relevant advertising,” but also “mentioned real risk including the disclosure of information consumers believe is private,” and the "chilling effect” for those who might “modify their online behavior for fear of being tracked.” “These are real risks as well and we need to confront them.”
• Panelists also questioned whether “the traditional distinction that has been drawn in privacy law between personal identifiable information and anonymous information may be a thing of the past.” “These observations raise questions about how to build in transparency, consumer control and accountability into the process without sacrificing the benefit.”
• Researchers seem to “confirm our intuition that consumers do not really understand the data collection process.”
• “Many consumers believe that if a company has a privacy policy it means the company does not share data with third parties,” which is not necessarily correct. “There is also general agreement that consumer disclosure as we know it simply does not work.” But, “just because it's broken, doesn't mean we should scrap it or discharge it. Transparency is challenging but we need to think more creatively and innovatively about how to deliver important information for consumers when they need it and in clear and in simple terms.”
• “The economists also pointed out the limits of disclosure. They noted that consumers engage in bounded rationality when they tend to discount long-term negative effects [] of giving up their privacy. I also have questions about timing, is the type of collection adequate or should we think about notice at the time of use?”
• The industry has implemented “a number of initiatives, including efforts to improve consumer notice about these ads and to provide more effective choice to consumers,” but there are “concerns, particularly about how some in the industry frustrate consumer choice by using technologies other than cookies to gather information online and by collecting and using sensitive data for behavioral advertising. “
• “The broker industry is largely unknown and invisible to the consumers and there's a lot of diversity in the types of information, uses of information and even the rules that apply to how such information” is managed. “This is an issue that may warrant our attention.”

There is a second roundtable discussion scheduled for January 28 in Berkeley, California.

- Sean Morris

One if By Land, Two if By Electronic Storage or Transmission

Following in the finest traditions of legislative “punting”, Massachusetts' General Court (the less than obvious name for the state legislature), passed data security legislation in 2007 and charged the Massachusetts Office of Consumer Affairs and Business Regulation (“OCABR”) to “adopt regulations relative to any person that owns or licenses personal information about a resident of the commonwealth.” Two years, multiple drafts, and several public hearings later, OCABR recently released what it’s calling final data security regulations, which will take effect this coming March. Despite all the angst about a revolution in regulation from both businesses and privacy advocates over the past two years, the final regulations borrow concepts liberally from the FTC, some states’ data security or breach notification laws, and unsurprisingly, federal requirements for information systems security. The regulations mandate both general approaches and specific security practices.

So, what’s in the final regulations, in two sentences? Individuals or businesses, who own, license, store or maintain, personal information about Massachusetts’ residents, have to develop and follow written and comprehensive risk-based information security programs. These programs create a process, carried out by identified people, to evaluate the sensitivity of information and mandate appropriate protections. If this approach sounds familiar, it should be. Ask any IT security professional what the Federal Information Security Management Act (FISMA) requires of federal agencies, and compare the duties imposed by section 17.03 of the regulations to the National Institute of Standards and Technology ("NIST") risk-management framework for designing and implementing information systems security, and you should get the same picture -- implement a process rather than specific technologies, and recognize parties, protections, and the sensitivity of data all vary widely. It is no surprise that OCABR shifted to a risk-based, rather than the one-size-shoe-fits-all approach reflected in earlier drafts of the Massachusetts regulation, following a series of comments from businesses and other interested parties.

What is new, and potentially problematic for some, is that the regulations additionally require specific protections for personal information stored or transmitted electronically. Although many of the section 17.04 protections are fairly standard (for example, secure access controls and user authentication procedures), some go further, such as the requirement to encrypt personal information transmitted across public or wireless networks, or stored on laptops and other portable devices. In this, Massachusetts goes beyond other states which have passed laws requiring encryption of social security numbers before transmission over the Internet, and more recently encryption of any personal information before transmission outside a business’s own secure system. Any laptop or portable device containing personal information about Massachusetts residents will have to be encrypted, not just protected by a password.

The good news? Encryption and other specific computer security measures are only required “to the extent technically feasible” by the regulations. The bad? The regulations don’t define what “technically feasible” means. OCABR suggests in a FAQ something is technically feasible “if there is a reasonable means through technology to accomplish a required result.” The next question -- if something is technically possible but economically prohibitive under the circumstances is it a “reasonable means through technology” -- is somewhat of an open question. Although OCABR staff that drafted the regulation willingly admit they borrowed liberally from FTC concepts of reasonable security which look at many surrounding circumstances including the size of a company, the sensitivity of information involved, and possibly the cost of a particular practice, OCABR’s FAQ intimates economic considerations don’t factor into whether a practice is technically feasible. While it is probable that businesses may seek additional clarification, at least on this point, any person who has not already come into compliance now has one more chance to meet the compliance deadline. Again.

- Ronald Lee

Social Networking Site Gets Tag-Teamed by NY and TX AGs

Yesterday, the Attorneys General for the states of New York and Texas announced that settlements had been reached with social networking site Tagged.com over claims that Tagged misappropriated the identities and email address books of its members and sent millions of deceptive and unsolicited emails promoting use of its site. In New York, the company has agreed to pay $500,000 in penalties and costs and to adopt “industry-leading measures” to govern the use of its members’ personal information; in Texas, the company will pay $250,000 in penalties and costs and will implement new data privacy and security features.

With more than 80 million members worldwide, Tagged bills itself as the third-largest internet-based social networking site in the U.S., after Facebook and MySpace. Previously, Tagged requested that members provide the company access to their email address books during the enrollment process (through a process termed “import your friends”). Those contacts were then sent auto-messages purporting to be from the new member. Under its agreements with New York and Texas, Tagged will need to seek specific consent before accessing its members’ address books and will need to disclose specifically how that data will be used (including by whom and for how long). The Texas judgment also requires Tagged to designate a “corporate level compliance representative” to oversee its compliance with the terms of the agreed-upon judgment and that state’s data and privacy protection laws, as well as to respond to consumer complaints or inquiries regarding Tagged’s privacy guidelines.

While social networking sites and other web-based member communities face intense competition to reach and enroll new members, these companies must be careful to ensure that their recruiting efforts do not run afoul of the data security and privacy laws of the jurisdictions in which their members live.

- Taja-Nia Henderson and Amy Mudge

Zip Code Please: California Court Upholds Merchant’s Right To Request And Distribute A Consumer’s Zip Code

May I have your zip code? Jessica Pineda didn’t like that question from a Williams-Sonoma store clerk, and sued for invasion of her privacy rights. But the question was perfectly legal. On October 23, 2009, the California Court of Appeal held in Pineda v Williams-Sonoma it was not unlawful for Williams-Sonoma to ask Pineda for her zip code at the time of purchase, even if that zip code was later used to obtain, view, and distribute her addresses to third parties. The Court’s rationale in Pineda may be useful in determining what other information merchants can lawfully request from consumers and what may later be done with that information without violating the consumer’s privacy rights.

Based on Williams-Sonoma’s alleged conduct, Pineda filed a putative class action alleging violations of California’s Song-Beverly Credit Card Act and her constitutionally recognized right to privacy. The trial court ultimately dismissed both claims and the Court of Appeal affirmed. In holding that Williams-Sonoma had not violated the Song-Beverly Act or Pineda’s privacy rights, the Court of Appeal relied upon two critical findings.

First, the Court found that while the Song-Beverly Act does prohibit merchants from asking credit cardholders for “personal identification information”, zip codes are not protected. Specifically, the Court noted that the Legislature included clear examples of what constituted “personal identification information” under the Act, including a “cardholder’s address and telephone number.” Construing the word of the statute, and relying on an earlier court decision addressing the same issue, the Court explained these examples indicated the Legislature intended to protect “facially individualized information,” and not “group” type information, like zip codes. The Court stated this reasoning was not lessened by the allegation that Williams-Sonoma used Pineda’s zip code to obtain her address using computer search engines. “Simply put,” the Court stated, the Act does not protect zip codes, and whether it should because a zip code can later be used to obtain an address, is an argument “best presented to the Legislature.” The Court’s reasoning here suggests that under the Song-Beverly Act it may be entirely lawful for a merchant to request other types of information that at least facially do not solely relate to the specific customer including a zip code, state of residence, city of residence, or area code.

Second, the Court found Pineda had not stated a claim for invasion of privacy under the California Constitution because she had not satisfied the “serious invasion of privacy” requirement. Pineda’s theory, the Court explained, was that she suffered a serious invasion of privacy when Williams-Sonoma allegedly obtained her zip code and then used it (along with her name and credit card) to obtain, print, and distribute to third parties her address. But nowhere in Pineda’s complaint was there any allegation that her address was not otherwise publicly available or that she had taken any effort to protect such information. “Without such facts, using a legally obtained zip code to acquire, view, print, and distribute or use an address that is otherwise publicly available does not amount to an offensive intrusion of her privacy.” As such, there was no invasion of Pineda’s privacy rights.

Retailers face extreme competitive pressures, and appropriate customer communication can be a significant competitive advantage. They must, however, carefully assess the detailed privacy laws and regulations that vary from one jurisdiction to another in order to end up, as Williams-Sonoma did, on the winning side of a consumer claim.

- James Speyer and Christopher Tarbell

Another Red Flag Against the FTC’s Application of Identity Theft Rules

The FTC is once again delaying the enforcement date of its Identity Theft “Red Flags” regulation. After first postponing enforcement from November 1, 2008 to May 1, 2009, and next to November 1, 2009, the agency now says it won’t enforce the rule until June 1, 2010. This time, however, the agency is not just trying to accommodate entities apparently subject to the rule: Members of Congress have requested the enforcement delay.

As noted in our previous blog post, the House recently approved an amendment to exclude certain businesses, including legal, health care, and accounting professionals, from the scope of Red Flags regulation. House Members want the FTC to let that amendment work its way through the Senate and reach the President’s desk before any enforcement action is taken under the regulation. Out of respect for these Members’ views, the FTC will hold off at least until next June.

Not only do Members of Congress think the FTC made errors in crafting the rule, but a federal judge just this past week found the same. On October 29, Judge Reggie Walton of the Federal District Court for the District of Columbia ruled that the Red Flags regulation does not apply to lawyers (court order here). In an order granting partial summary judgment for the American Bar Association (ABA), which had challenged the FTC’s characterization of lawyers as “creditors” under the rule, Judge Walton held that the FTC exceeded its statutory jurisdiction and authority by applying the rule to lawyers.

Adopted at the direction of Congress, the Red Flags rule is designed to prevent identity theft by requiring certain “financial institutions” and “creditors” to establish and implement written programs to detect and respond to warning signs of identity theft. According to the FTC, the term “creditors” means just about anyone who provides a good or service prior to being paid, including, generally, lawyers.

In its lawsuit, the ABA filed a complaint against the FTC for this inclusive interpretation of “creditor.” The ABA argued that the FTC’s interpretation was contrary to congressional intent, and Judge Walton agreed, reasoning that under the FTC’s broad interpretation, even a plumber who charges a customer  two days after service would count as a “creditor,” and that can’t be what Congress intended. The FTC may yet appeal Judge Walton’s ruling, but the agency can’t possibly ignore the “red flags” that its actions may have exceeded its authority.

- Nancy Perkins & Brian Larkin

Don’t Mess With COPPA

While companies may often feel like the FTC may be less inclined to go after smaller, alleged Section 5 violations, that is not always the case, particularly when it comes to COPPA. The Children’s Online Privacy Protection Act commonly referred to as COPPA applies to the online collection of personal information from children under the age of 13, requires that website operators implement procedures to ensure that it not collect personal information from children without obtaining prior parental consent, and that it delete any such information about which it becomes aware.

In a Complaint filed in Federal District Court in New York on Tuesday, the Iconix Brand Group, Inc., the owner, licensee and/or marketer of such popular children and teenage apparel brands as Mudd, Candie’s, Bongo, and OP, was targeted by the FTC for COPPA violations. The Complaint alleged that since 2006, Iconix knowingly collected and stored personal information from approximately 1,000 children without first notifying their parents or obtaining parental consent. According to the Complaint, Iconix also enabled children to publicly share personal stories and photos online.

The Complaint underscores the need for companies not only to develop privacy policies that comply with COPPA guidelines, but to implement and comply with those policies. According to the Complaint, while Iconix posted privacy policies on its websites that contained COPPA guidelines ― it failed to implement or comply with those policies. As such, the FTC charged Iconix with falsely stating in its privacy policies that it would not seek to collect personal information from children without obtaining prior parental consent, and that it would delete any children’s personal information that it became aware of.

Rather than contest the FTC’s allegations, Iconix has agreed to pay a $250,000 civil penalty and enter into a Consent Order prohibiting the company from violating COPPA in the future; and requiring the company to delete all personal information collected and maintained in violation of COPPA and to distribute the Order and the FTC’s “How to Comply with the Children’s Online Privacy Protection Rule” to company personnel.

- Randy Shaheen and Alan Veronick

House Does Not Want FTC to Go “Where Everybody Knows Your Name”

Cheers, and other businesses where “everybody knows your name” may soon be relieved of the obligation to adopt identity theft prevention programs under the FTC’s “Red Flags” regulation. In a measure that passed 400-0, the House approved an amendment to the Fair Credit Reporting Act, 15 U.S.C. § 1681m(e), to exclude certain businesses from the FTC’s Red Flags implementing the Act. Those businesses, according to the amendment, include those who can show they know all of their customers or clients individually.

The Fair Credit Reporting Act was amended in 2003 to require the FTC and the Federal banking agencies to develop Red Flags regulations for banks and creditors in order to help prevent identity theft. The agencies’ respective rules mandate that written programs be created to detect and respond to warning signs of identity theft related to a customer account. The regulations apply to financial institutions and to “creditors,” which is generally defined as “a person who arranges for the extension, renewal, or continuation of credit.” This broad definition sweeps in virtually any businesses that provides consumers with goods or services in advance of payment. According to the FTC, even government and non-profit entities can be creditors under this definition. If the House bill becomes law, there will be far fewer businesses for the FTC to monitor.

The House bill responds to the concerns of small businesses, by categorically excluding some of them from the FTC regulation and providing a test by which others may also become exempt. H.R. 3763  provides that the term “creditor” does not include a health care, legal, or accounting practice with 20 or fewer employees. Additionally, the bill states that any other business can be excluded from the Red Flags rule if it can make one of three showings:

• that it knows all of its customers individually;
• that it only performs services near the residences of its customers; or
• that it has not experienced identity theft and the crime is rare for a business of that type.

The sponsor of the bill, John Adler, D-N.J., introduced the measure by noting that, “[d]uring these tough economic times, the Federal Government should not be placing burdensome regulations on small businesses.” The bill has been sent to the Senate, and referred to the Committee on Banking, Housing, and Urban Affairs.

Small businesses, and possibly some large businesses with good memories, may soon find relief from an apparently unwarranted regulatory burden.

- Nancy Perkins and Brian Larkin

Lapsed US-EU Safe Harbor Certification is No Safe Harbor

Earlier this month, the FTC announced that it had reached settlements with six US companies over allegations that the businesses misrepresented their participation in, and certifications under, the Safe Harbor Framework, a voluntary program under the aegis of the Department of Commerce and in conjunction with the European Commission. According to the FTC, the companies -- World Innovators, Inc., ExpatEdge Partners LLC, Onyx Graphics, Inc., Directors Desk LLC, Collectify LLC, and Progressive Gaitways LLC – represented to customers that their certifications under the Safe Harbor program were current, even though those certifications had been allowed to lapse. In each case, the accused company had, after a number of years of annually recertifying its compliance with Safe Harbor, allowed its status to lapse while still publicly representing on its website that it remained a participant in the Safe Harbor program.

The US-EU Safe Harbor Framework allows US businesses under the jurisdiction of the FTC and the Department of Transportation to receive personal data from entities located in the EU member nations subject to strict safeguards consistent with the EU Data Protection Directive (Directive) adopted in 1995. The Directive, as implemented by the individual 27 EU member nations through their respective legislative bodies, comprehensively regulates the security, integrity, and privacy of all “personal data.” The Directive specifically prohibits the transfer of personal data to nonmember nations that fail to provide data security and privacy measures deemed “adequate” by the European Commission (EC), and allows the EC to block transfers of personal data to countries whose data privacy enforcement and regulatory regimes are not “adequate.” Following adoption of the Directive, the European Commission determined that US data privacy and security measures were not “adequate” and, therefore that special protections would be required for any transfers of personal data from the EU to the United States. One such form of special protection is the “Safe Harbor Framework” agreed to by the EU with the United States, which allows US entities that commit to the Directive’s basic privacy protection obligations to receive personal data from EU member nations without undertaking special contractual obligations.

The FTC’s recent action to enforce its deception authority under Section 5 of the FTC Act against the companies named in the World Innovator et al. complaints may have a chilling effect on US businesses’ election of the Safe Harbor as a method of compliance with the Directive. Since Safe Harbor certification is not the only way to obtain personal data from EU member nations for commercial purposes, companies seeking to limit potential liability or enforcement action by the FTC may wish to consider alternative methods for complying with the Directive.

At a minimum, companies that have already committed to the Safe Harbor should be careful to confirm that their certifications are current (i.e., recertified annually). The FTC’s recent enforcement interest in this area more generally serves as a cautionary tale against allowing stale and/or misleading information to remain (and be republished) on company websites. 

- Nancy Perkins & Taja-Nia Henderson

The Great Behavioral Advertising (BA) Debate Continues

In our last blog entry on Behavioral Advertising, we asked you to watch this space, noting new Congressional concern that the FTC’s self-regulation Principles alone will be sufficient to protect consumers. In that piece, we reviewed in passing the latest effort by one industry group to convince legislators and regulators more attention is not always better, the IAB’s “Self-Regulatory Principles for Online Behavioral Advertising”. Since then, while others have come forward attempting to interpret the IAB’s Guidelines in a more user friendly way, we have not seen a comparison of the IAB’s Guidelines and the NAI’s revisions to its Code late last year, either to each other or the FTC’s Principles.

The first question that comes to mind is “why would anyone do so?” and we have either three sound reasons, or at least three reasons that sound good. First, there’s no guarantee anything new will emerge from either Congress or the FTC without another “DPI” scare or unauthorized data breach fiasco to spur them along, leaving the two industry regimes as the only “guidance” companies have other than the Principles (and what the Commission may occasionally say the Principles relate to). Second, even if something new does emerge, good money is on the option where the FTC or Congress craft something that operates on top of self-regulatory programs rather than replacing them, making any differences between the Principles and those programs more important. Finally, some moves last week by a coalition of consumer privacy organizations may have upped the ante a bit. By offering detailed suggestions to address holes they see in the industry regimes, and urging Congress to plug these holes (and more), it becomes more important to know if holes really exist, and how big they might be.

As space is limited, we’ll tackle a review of the privacy organizations’ proposals in a companion piece, and focus here on the industry guidelines and the FTC’s Principles. This task is challenging enough given the size of the guidelines, inconsistent commentary or explanations, and the tendency of their drafters to use different terms, define the same terms differently, and consequently make life a bit more difficult for anyone attempting to do what we’re doing for you. 

Cybercrime Mastermind: The Lord of the Rings?

On August 17, the US Attorney’s Office for the District of New Jersey charged Miami native Albert Gonzalez and two other men in what the Department of Justice is calling “the largest hacking and identity theft case ever prosecuted.” The indictment alleges that Gonzalez and some unnamed co-conspirators stole over 130 million debit and credit card numbers in a scheme to breach the data security systems of a number of companies, including Heartland Payment Systems, 7-Eleven, and Hannaford Brothers. Gonzalez also is separately facing trial in the District of Massachusetts for alleged his role in the much-publicized “TJX” data breach.

The Gonzalez case should serve as a cautionary tale about an alarming trend in the ever-increasing size of data breaches and sophisticated identity theft schemes.  As recently as September 2004, for example, the US Attorney’s Office for the Southern District of New York announced the guilty plea of Philip Cummings to charges relating to an identity theft scheme that was, at the time, hailed as the “largest identity theft case in [the] nation’s history.”  Cummings and his accomplices were charged with unlawfully stealing the credit reports of more than 30,000 people. (Full disclosure: one of the authors of this post, Marcus Asner, led the Cummings prosecution while serving as an AUSA in the SDNY.)  Subsequently, in February 2005, ChoicePoint announced the theft of data pertaining to 145,000 individual victims, and, in August 2008, DOJ announced the TJX data breach that involved the theft of 40 million debit and credit card numbers. Then-Attorney General Mukasey called the TJX case the single largest and most complex identity theft case ever charged in this country.

Government Attempts to Stop Facilitating Identity Theft

A recent bipartisan bill, known as the Social Security Number Privacy and Identity Theft Protection Act of 2009 (H.R. 3306), is the latest Government attempt to curtail identity theft. The bill would prohibit Federal, State and local governments from selling Social Security numbers (SSNs), displaying SSNs to the general public, displaying SSNs on checks issued for payment or on identification cards issued to employees, employing prisoners in jobs that provide them with access to SSNs, and transmitting the SSNs over the internet without encryption. The bill would also forbid the private sector from doing all the same things, and limit truncated SSNs to the last four digits.

The punishments for violating this potential law would be quite harsh. Repeat offenders who try to sell, purchase or misuse the SSN could face up to ten years in prison, and Social Security Administration employees who sell or transfer SSNs potentially face prison sentences of twenty years. But why all this fuss about social security numbers?

Well, although originally a humble group of nine digits designed to track individuals for retirement benefits, the social security number has now become a de facto national identification number, required to obtain a driver’s license, submit a loan application, apply for a job, donate blood, and a host of other things. Because SSNs are so frequently used by businesses to authenticate identity, a thief that manages to get his hands on an individual’s SSN may be able to wreak havoc. The stories of identity theft victims tell of mysterious credit card bills, loans taken out in their name, difficulties repairing credit, and substantial, continuing anguish. To make things worse, in many cases, the Government might have been an unintentional accomplice.

Despite the SSN being a portal into identity theft, Federal, state and local governments have been often making SSNs easier to steal. Until recently, the Social Security Administration displayed the recipient’s full SSN on the millions of benefit statements mailed each year. Tens of millions of ID cards for Medicare, the Department of Defense and Veterans Affairs display the social security numbers of the card holders. State and local governments are even worse. The GAO estimates that 85% of the largest counties in the US either display records that may contain SSNs online, or offer them in bulk sales. These records include divorce settlements, property liens, and mortgage documents, all with the consumer’s SSN potentially in full display. Why bother trolling through someone’s dumpster to steal an identity when the government has so graciously provided all the tools you need online?

Every year, up to 10 million Americans are victims of identity theft, costing consumers $50 billion dollars annually. Identity thieves employ a variety of methods to steal identities, from simply swiping mail or dumpster diving to “phishing,” where thieves solicit personal information through emails disguised as coming from the consumer’s financial institution. But no matter the method, identity thieves everywhere benefit from the ubiquity of the social security number. Whether or not this bill will change that remains to be seen.

- Nancy Perkins

The Current State of Play for BA

In an earlier blog entry, we reviewed the FTC’s Online Principles for Behavioral Advertising, and came to two conclusions: the FTC was continuing to rely on industry self-regulation, and it appeared likely either a new FTC would reverse course, or Congress would enter the fray. Five months, three more Congressional hearings, a new FTC Chairman, and another industry effort at a self-regulation regime later, and the only question left appears to be what legislation is going to look like.

First, for background, Behavioral Advertising (BA), is the “tracking of a consumer’s activities online - including the searches the consumer has conducted, the web pages visited, and the content viewed - in order to deliver advertising targeted to the individual consumer’s interest.” (as defined by the FTC). In 2007, the FTC issued a draft set of principles for industry self-regulation. The House and Senate held a series of hearings in 2008 decrying some of the bad apples in the online BA world - those using Deep Packet Inspection (DPI) to potentially review the content of what a user sends or receives in order to better target advertising. The Industry, or at least the Network Advertising Initiative (NAI), responded by tightening the principles underlying its self-regulatory code of conduct, in December, 2008, beating the FTC to the punch by barely two months.

Since then, a lot has happened that suggests Congress will be taking its turn by issuing general privacy legislation addressing the issue, which may provide some absolute protections, and give both the FTC and FCC greater authority to regulate in this area. So, what happened?

Privacy Lawsuit Stimulates Discussion

A registered nurse has filed a class action lawsuit in the Southern District of New York claiming that certain provisions of the American Recovery and Reinvestment Act (“ARRA”) (the new stimulus legislation enacted in February) violate the privacy rules laid out in the Health Insurance Portability and Accountability Act (“HIPAA”) and the federal Privacy Act.The complaint can be found here.

Beatrice Heghmann of Durham, North Carolina claims that, pursuant to ARRA, the White House Office of Health Reform is working with the Department of Health and Human Services (“HHS”) to design a new system that would create electronic health records for millions of Americans by 2014. According to Heghmann’s complaint, this planned system poses a major threat to individual privacy: she claims individuals’ personal health information (“PHI”) could be just a “mouse click away from being accessible to an intruder.”

Heghmann takes issue with ARRA’s provision allowing HHS to determine what constitutes the “minimum necessary” amount of PHI allowed to be disclosed under HIPAA, as well as how best to implement “de-identification” of protected information. According to Heghmann’s complaint, HHS Secretary Kathleen Sebelius is “empowered to totally vitiate the privacy provisions under HIPAA and link medical information contained in Plaintiff’s personal health record directly to Plaintiff and all others similarly situated.” Heghmann argues that the $22 billion earmarked for the electronic registry is merely a vehicle to obtain access to this confidential health care information.

Heghmann is seeking certification for a class of similarly situated individuals and is requesting an injunction to prevent the government from disbursing the $22 billion budgeted for the Electronic Health Records System.

As our readers might remember, we’ve blogged before about the importance placed on the handling of PHI and HIPAA’s privacy provisions (related blog post here). In ARRA, Congress did impose significant new privacy and security requirements on HIPAA-covered entities and their business associates, precisely to protect against the kind of risks Heghmann’s complaint highlights. Whether such a complaint could create a barrier to the Administration’s goals for electronic health records will be an important question; at the very least, the complaint will like cause HHS to lean further toward strict implementation of ARRA’s privacy provisions in its forthcoming regulations.

- Nancy Perkins

UK: Who Are the People in My Neighborhood?

Google has for some time provided a popular map feature which is accessible from its home page.  Recently in the UK, Google has augmented this service by using customized vehicles to photograph most public streets in the UK’s major towns and cities, to produce what they call “Google Street View”.  Street View allows one to see literally what any given place looks like as though one were standing on the street. 

Google’s camera cars have recorded streets adding up to a distance of more than 22,000 miles in this country alone.  With the release of Street View in this country, a few people have announced that they feel that the creation of such a permanent record is a infringement of people’s privacy.  Some have gone further and suggested that it constitutes a breach of the country’s data protection laws.  Indeed, the Information Commissioners’ office has now been called upon by one group, Privacy International, to take action against Google under the Data Protection Act.

In reality, Privacy International are almost a year late.  Google’s street view received the blessing of the Information Commission in July last year on the basis that it had in place adequate safeguards to protect people’s privacy.  The Information Commission referred to those safeguards as including “the blurring of vehicle registration marks and the faces of anyone included in the street view images”.  The idea being that those safeguards would make it very difficult to identify anyone that happens to have been captured by Google’s street view cars.  Google has also agreed that in circumstances where someone has been captured, a strict and expeditious take down procedure should be put in place so that such people are able to call for the removal of those particular images. 

The sets of rights in question would be those rights enshrined within either, the UK Data Protection Act, or the European Convention of Human Rights, which under Article 8 provides everybody with a right to enjoy a private life.  

The Data Protection Act concerns the collection and protection of personal data. The question is whether or not taking a photograph of a street, where the subject matter of the photo is the street itself, is something that should be protected by the Data Protection Act?   Google proceeded only after receiving the blessing of the Information Commission, who had confirmed that the safeguards that they had put in place were adequate.

With regards to Article 8 of the Human Rights Act, the right that is enshrined therein is that people should be provided with a right to lead a private life.  Recently there has been a move by the courts to interpret this Article of the Humans Right Act in a way that has expanded the popular expectation of privacy.  However, to infer from this Act that merely taking a photo of a public street, (where the subject matter is not the incidental persons upon that street but the street itself) constitutes an invasion of their privacy, would be to take that interpretation of the Act much further, and arguably an untenable step too far.

There is also another article enshrined within the Human Rights Act which is Article 10, which enshrines each person’s right to freedom of expression.  When balancing the interplay between these two articles, the courts will have in mind the relative harm and utility that any given act will have.   In this particular case, since Google’s street view is of such particular utility, not just to the people within the city that is photographed but to everyone, around the world, now able to see what any given city looks like in detail, it would not be surprising if they were to conclude that such utility is greater than any invasion of privacy.

- Richard Dickinson and Alex Watt

"Phorm" over Substance in the UK

The European Commission has recently threatened to sanction Britain for the manner in which it has implemented the European Community Data Protection legislation. The European Telecommunications Commissioner said last week, “European privacy rules are crystal clear; a person’s information can only be used with their prior consent”. However, the on-line world to which those rules are applied has changed, and though the rules themselves may be simple, how they are applied is therefore not so straightforward.

The latest technological advance and cause of EC upset, is a targeted advertising system called “Phorm”. Phorm is a piece of software that may be implemented by ISPs in order to track what people are interested in. In the UK, Phorm’s partners include BT, TalkTalk and Virgin Media, which together represent approximately 70% of UK broadband ISP markets. Once people have had their interests tracked, the adverts that may be displayed on the pages that they view can be adapted so that there are adverts that people are more likely to find interesting.

Targeted advertising in this manner, is something that has already gone on for some time. Google, when it launched its email service, Google Mail, made it clear that when the emails on its systems were scanned (as all emails are, for spam and viruses) it would also scan those emails for users’ personal interests. The adverts that were then shown within Google Mail, could then be targeted to the users preferences.

BT admit that, for at least the years 2006 and 2007, no consent was ever requested of their users within their terms and conditions. However, Phorm argue that consent is not required. They contend that their system is such that no human ever reviews the information and nothing personally identifiable is ever permanently recorded, it assigns a randomly generated number to a user and then, after having reviewed the sites that that randomly generated number has visited, assigns codes that equate to areas of interest. The site’s history is then deleted so that what is left is a randomly generated number with particular interests, when that randomly generated number reaches a particular site, adverts will be shown that reflect those interests.

Whether it is ultimately deemed either an invasion of privacy, or a breach of the Data Protection act or not, if the technique is unpopular with consumers, then they will vote with their feet and ISPs that continue to implement unpopular policies will lose customers. This may not be enough to prevent the European Commission looking at the UK’s implementation of the Data Protection Act, which means we may yet see some significant changes to the way people’s data is dealt with in this country.

- Richard Dickinson and Alex Watt

FTC COPPA Rule to be Revisited

The FTC recently released their report, “Beyond Voice: Mapping the Mobile Marketplace,” as a follow-up to the FTC’s May 2008 public town hall meeting which explored new developments associated with mobile devices and their impact on mobile commerce.  One of the main concerns of the new report is how the ability of “smartphones” and other mobile devices to access the web presents a unique challenge to protecting children’s privacy. 

The report noted that the U.S. currently has no laws specifically governing mobile marketing campaigns aimed at children.  The panelists requested that the FTC revisit and clarify its COPPA rule  to require affirmative express consent from parents when advertisers collect information used to send individualized ads to children as part of behavioral advertising in mobile marketing.  For example, through the use of cookies, though identifying when information is being collected from minors could often pose a challenge.  The FTC staff agreed to expedite the review of the COPPA rule to determine whether it should be modified to address changes in the mobile marketplace.  The review will now occur in 2010 instead of the original 2015 date.  The panelists also called upon lawmakers to consider adapting and updating COPPA so that the law clearly applies to the mobile web.  In addition, the panelists urged further discussion on the possibility of a Do Not Call registry governing minor’s mobile numbers. 

The panelists also highlighted industry guidelines and industry best practices they believed helped protect children’s privacy, such as requiring a “double opt-in” when registering for certain texting services and avoiding use of the word “free” in children’s campaigns when standard rates and other charges apply.  Several panelists, however, questioned whether industry guidelines and best practices went far enough to protect children.  They stated that current disclosures may not indicate how a child’s mobile phone number will be used or whether it will be provided to third parties, and that more controls should be placed on general audience advertising that is likely to appeal to significant numbers of children.  The panel did, however, conclude that a complete ban on child-directed mobile advertising was not warranted.  We expect there will be additional informational gathering by the FTC, as well as opportunities for comment regarding any proposed changes to COPPA’s rules.