Data & Privacy Law

ICANN Considers Banning WHOIS Proxy Services for Commercial Websites

June 29, 2015 by David Klein

June 29, 2015

Last month, a working group for the Internet Corporation for Assigned Names and Numbers (“ICANN”) issued a report that contemplates whether the owners of certain commercial websites should be forbidden from using WHOIS proxy services to hide their identities. The working group is accepting public comments on the proposal, which has drawn both considerable praise and criticism from the online community.

Is the use of WHOIS proxy services appropriate when a domain name is registered for commercial purposes?

[Read More]

22 State AGs Settle Data Passing to Negative Option Marketer Claims for $11 Million

May 28, 2015 by David Klein

May 28, 2015

Attorneys General from 22 states reached agreement with Classmates, Inc., Florists’ Transworld Delivery, Inc. and FTD.com (the “Settling Parties”) to settle allegations that the Settling Parties sold consumer information to negative option marketers. Of the $11 million settlement sum, $8 million will be paid by the Settling Parties directly to the various state attorneys general, while a $3 million fund will be established for consumer restitution. The settlement agreement also contains terms which will prevent the Settling Parties from knowingly transmitting consumer information to negative option marketers in the future.

What are “data passing” and “negative option marketing”?

[Read More]

Mobile Tracking Service Provider Settles Privacy Policy Violation Claims

April 27, 2015 by David Klein

April 27, 2015

Nomi Technologies (“Nomi”) provides brick-and-mortar retail outlets with a means to track consumers’ mobile devices as they move in and around their respective stores. This data can be used by retailers to gain insight into certain consumer behavior and associated commercial interactions. Nomi has recently agreed to settle Federal Trade Commission (“FTC”) charges that it misled consumers with regard to certain provisions of its privacy policy that promised consumers that they would be able to opt-out of the consumer tracking activity that Nomi facilitates.

How Closely Must You Adhere to the Terms of Your Privacy Policy?

[Read More]

Bank of America Settles TCPA Lawsuit for Over $32 Million

September 10, 2014 by David Klein

Bank of America Corporation (“Bank of America”) and FIA Card Service, N.A. (“FIA”) (collectively, the “Defendants”) have agreed to pay one of the largest Telephone Consumer Protection Act (“TCPA”) settlement amounts in recent memory. According to the settlement agreement, the Defendants have agreed to pay over $32 million to settle a consolidated TCPA class action. The settlement concludes a class action lawsuit against the Defendants that was filed in the United States District Court for the Northern District of California. The present case against the Defendants is a collective microcosm of a nationwide movement to hold companies liable under the TCPA for using autodialers and/or prerecorded messages to contact consumers on their cellular telephones without proper consent.

[Read More]

FTC Enforces Restraining Order against Cramming Defendants

July 31, 2014 by David Klein

As part of the increased regulatory focus on the mobile marketing space, the U.S. District Court for the Central District of California issued a temporary restraining order against six (6) companies and their respective principals, effectively halting an alleged mobile phone cramming scheme. “Cramming” is the act of placing unauthorized charges on a consumer’s telephone bill. In the present case, it is alleged that the defendants placed more than $100 million dollars worth of unauthorized charges on consumers’ mobile telephone bills. Regulators maintain that the act of cramming relies on the fact that many consumers do not closely scrutinize their monthly telephone bill statements, or assume that charges are legitimate.

FTC Cramming Complaint

Earlier this month, the Federal Trade Commission (FTC) filed the complaint in question alleging mobile telephone bill “cramming” in violation of the FTC Act and other applicable laws. Specifically, the FTC claimed that the defendants used fake websites to offer “free” gift cards to deceptively obtain consumers’ mobile phone numbers. The defendants then placed monthly subscription fees for a variety of text message services (i.e. gossip alerts, fun facts, horoscopes, etc.) on consumers’ mobile phone bills, allegedly without their authorization. The defendants’ text message services typically cost consumers $9.99 or $14.99 per month, and were set to renew automatically each month.

The FTC asserts that the defendants took advantage of the fact that consumers may not expect their mobile phone bills to contain charges from third parties and disguised the charges on consumers’ bills in an abbreviated manner that did not always clearly designate the applicable company as the source of the charge. As a result, many consumers may not have noticed or understood the nature of the charges and otherwise paid the bills. According to the complaint, to the extent that consumers did notice the charges, the process of obtaining refunds was difficult and often unsuccessful.

Cramming Penalties Sought

In addition to the temporary restraining order (which contains an asset freeze provision), the FTC is seeking to permanently enjoin the defendants from continuing their mobile cramming operations and to disgorge all ill-gotten gains generated from their conduct.

The FTC’s most recent cramming complaint is part of a larger trend of regulatory action within the mobile billing space. In light of this action, and the general regulatory trend, mobile service providers that bill for services by and through consumers’ mobile telephone bills should immediately review their marketing practices and consumer disclosures in order to ensure compliance with the FTC’s guidance and to avoid allegations of cramming. Entities that fail to comply with applicable law could find themselves facing regulatory action from the FTC and/or state attorneys general, which could result in significant fines and penalties.

If you are interested in learning more about this topic or need to review your mobile billing practices and/or update your consumer disclosures, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

What to Do When You Are the Victim of Data Theft

June 16, 2014 by David Klein

How Data Theft Occurs

In today’s digital world, the theft, copying or destruction of your databases, customer lists or trade secrets is often as simple as pushing a button. We see this often when competitors hack into databases or use third parties posing as customers to exceed their limited license to access a business’s database. We see data theft occur much more often, however, when an employee runs a business which competes with his/her current employer or copies files, customer lists or whole databases in anticipation of leaving and starting a rival business. Fortunately for an employer, there are many remedies available to businesses under such circumstances. In light of the ease of duplication of digital material, it is impractical to seek the return of stolen data. Instead, most causes of action will focus on preventing use of the data and seek damages that have resulted from the theft.

Thinking Ahead of the Hackers

One of the best ways to address data theft is to take appropriate steps in advance. If employees, vendors or third parties have access to proprietary databases, customer lists or trade secrets as part of their working relationship with you, it is critical that you have each associated person sign a comprehensive confidentiality/non-disclosure agreement. Such agreements should specify the types of data that they can/cannot lawfully access, the specific rules relating to maintaining confidentiality of the data and specific remedies, including injunctive relief and damages, available to your business in the event of the breach of such agreements, including data theft. The agreements must also detail prohibitions on post-employment use of such data. Such agreements not only provide a bit of a deterrent effect, they also make obtaining injunctive relief from a court much simpler and cheaper to accomplish.

What To Do In the Event of a Data Theft

Once you learn of a theft of your database(s), customer list(s) or trade secret(s), it is critical that you take appropriate steps immediately. First, because data theft often involves a breach of trust by a current or recent employee or someone else with whom you work closely, it is easy to react emotionally. Do not overreact, call or threaten the person suspected of misappropriation. The steps you take will have consequences.

Second, contact an attorney experienced in this area of law. If you have sufficient information indicating an actual theft or breach, your attorney should immediately prepare and send a well-worded cease and desist letter, demanding that the unlawful conduct stop and detailing the laws and/or agreements violated. Often this will be followed by the application for a temporary restraining order (“TRO”), wherein, if granted, the court prohibits the party who engaged in the alleged data theft from using the data until the court can hold a hearing to decide whether to grant a preliminary injunction, which would stay in place throughout the underlying trial. Time is of the essence when seeking a TRO, and providing the court with as much evidentiary detail to support your claims of data theft is critical.

In addition to the injunctive relief detailed above, there are many causes of action available for you to pursue in order to obtain damages from the offending party including unfair competition, misappropriation of trade secrets, breach of confidentiality/non-disclosure agreements and unjust enrichment. Depending on the nature of the data theft, whether access was authorized at the time of occurrence, and the existence of damages and losses, you will likely have a cause of action under the Computer Fraud and Abuse Act (“CFAA”), as well. Note that the CFAA carries both civil and criminal remedies.

Third, conduct a detailed investigation. Was your database hacked or was the data stolen by a current or former employee or vendor? Does a former employee/vendor still have remote password access to your computer systems? What databases, customer lists or trade secrets were affected, to what degree and over what period of time? Collect and preserve this information, which will be critical at every step of your efforts to stop the misappropriation and use of your data, and will be a key element in proving damages in a court of law.

This topic should be of interest to any company or individual engaged in a commercial venture within the United States, especially those involved in the online marketing, data collection and/or consumer product industries.

If you have suffered theft of your proprietary database(s), customer list(s) or trade secret(s) or wish to take appropriate steps to help protect yourself against such theft, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

FTC Recommends Congress Adopt Sweeping Legislation Aimed at Data Brokers

May 29, 2014 by David Klein

On May 27, 2014, the Federal Trade Commission (“FTC”) released a report entitled Data Brokers: A Call for Transparency and Accountability (the “Report”). The Report codified the FTC’s findings after a study initiated in December 2012, involving nine (9) data brokers. In proposing legislation aimed at data brokers, the FTC segmented the industry into three (3) distinct product categories: marketing products, risk mitigation products and people search products. The degree of oversight suggested by the FTC varies based on the category of services. If Congress takes up the FTC’s call for more transparency in the data broker industry, data brokers will find themselves facing increased federal oversight involving their business practices.

Proposed Data Broker Legislation Targeting Marketing Services

The FTC study involved five (5) data brokers that sell “marketing products”- products where businesses can purchase customer email addresses and other personally identifiable information (“PII”) from data brokers so that they can send email solicitations or market specific products to them. With respect to data brokers offering these services, the FTC recommended that data brokers be required to provide consumers with access to their data and the ability to opt out of having it shared for marketing purposes. In making this recommendation, the FTC suggested that Congress create a centralized mechanism, such as an Internet portal, where data brokers would identify themselves, describe their information collection and use practices, and provide links that consumers could use to access information tools and opt-out functionality. The FTC further advised Congress to require data brokers to provide enough detail that would allow consumers to see the breadth of categories that specific data brokers have about them, including sensitive data.

In its Report, the FTC has also proposed that Congress pass legislation requiring data brokers to clearly disclose on their respective websites that they collect raw data, such as address, age and income range of individuals, and that they use this data to derive certain inferences about consumers. The proposed legislation would require that data brokers also clearly disclose the names and/or categories of their data sources so that consumers are better able to determine if they need to correct and/or delete certain publicly available information.

Finally, the FTC recommended that Congress require that consumer-facing sources provide prominent notice to consumers that they share consumer data with data brokers and give consumers choices, such as the ability to opt out of the sharing of their information with data brokers. The FTC went on to recommend that Congress require consumer-facing sources to obtain “affirmative express consent” before collection and sharing of “sensitive information” (such as health information) with data brokers.

Proposed Data Broker Legislation Targeting Risk Mitigation Services

Four of the data brokers that were investigated by the FTC offer risk mitigation products, that is, products that businesses use to verify their customers’ identities to protect against fraud. In the Report, the FTC acknowledged that the Fair Credit Reporting Act (“FCRA”) already broadly applies to data brokers offering risk mitigation services. Nevertheless, the FTC has recommended that Congress pass legislation requiring that if a risk mitigation product adversely impacts a consumer’s ability to complete a transaction or obtain a benefit, the consumer-facing company should identify its data broker sources. These data brokers, in turn, should give consumers the right to access the information that they have on file for them and correct any inaccurate information as appropriate.

Proposed Data Broker Legislation Targeting People Search Products

Data brokers that offer people search products typically provide websites or services where users can search for publically available information on individuals. For data brokers that offer these services, the FTC recommends that Congress pass legislation requiring data brokers to provide individuals with access to their personnel information and provide the ability to opt out of the use of this information. In addition, the FTC recommends that data brokers be required to clearly disclose the sources of their information and any limitations associated with consumer opt out requests, such as the fact that close matches of an individual’s name may continue to appear in search results.

Protect Yourself

The Report is a clear sign that the FTC is taking a hard look at the data broker industry. Although the Report calls for new legislation, which Congress may take up, it is important to remember that there are existing federal laws, such as the FCRA, which the FTC can presently use to restrict the practices of data brokers.

If you are interested in learning more about this topic, or if you have been served with legal process relating to your data broker or marketing practices, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

Attorney Advertising

Another TCPA Class Action Dismissed on “Prior Express Consent” Grounds

March 10, 2014 by David Klein

On February 27, 2014, the United States District Court for the Western District of Washington ruled that a plaintiff who provided his mobile telephone number in connection with registering for a local car-sharing service gave “prior express consent” (within the meaning of the Telephone Consumer Protection Act (“TCPA”)) to be contacted via text message by defendant, car2go N.A., LLC (“car2go”).

As part of the car2go registration process, plaintiff was required to complete a form and submit, among other things, his mobile telephone number. Plaintiff was also required to affirmatively check three boxes confirming that he had reviewed and accepted the car2go “Terms and Conditions,” “Trip Process” document and “Privacy Policy.”

Apparently buried in the seven page “Trip Process” document was an explanation that car2go would validate the personal information provided by the applicant, approve an application before membership was extended, and “may confirm a registration via instant text message.” (According to the Court, the text message language appeared in the car reservation section of the Trip Process document – not in the application registration section.) The car2go Privacy Policy further disclosed that the company would use plaintiff’s personal information in any “business process,” including in periodic membership validation.

Within seconds of electronically submitting the completed registration form, plaintiff received a text message to his mobile telephone that provided an activation code that plaintiff could use to electronically complete his registration. In response to receiving this text message, plaintiff commenced litigation against car2go, alleging violations of the TCPA and Washington law.

The Common Sense Approach to the TCPA’s “Prior Express Consent”

Unlike a recent California federal court decision that had analyzed the TCPA’s “prior express consent” standard, the Washington District Court relied heavily on the Ninth Circuit’s decision in Satterfield v. Simon & Schuster, Inc., which held that “[e]xpress consent is ‘[c]onsent that is clearly and unmistakably stated.’” The Washington Court reasoned that although plaintiff did not explicitly grant permission to car2go to contact him by text message regarding his registration form, no reasonable person in his shoes could have doubted that car2go would contact him in some manner. In analyzing the particular facts of the case, the Court held that regardless of whether car2go chose a text message (in addition to an email) is “not significant,” because plaintiff “clearly and unmistakably consented to being contacted about his registration.”

The Court admittedly took a “common sense” approach to the facts before it, opining that, for example, “[c]ould a person who provided a telephone number to a mechanic claim that she did not consent to be called (or texted) when her car was repaired?”

According to the Court’s analysis, as the documents governing the parties’ relationship confirmed (and which plaintiff accepted by checking three separate boxes on the registration page), the subject text message validated plaintiff’s personal information (i.e., his mobile telephone number), confirmed car2go’s acceptance of plaintiff’s application and, essentially, was a form of membership validation.

The Court’s TCPA Ruling and the FCC’s New Rules

We have repeatedly warned that the new changes to the TCPA regulations went into effect on October 16, 2013. (See New TCPA Rules Effective October 16, 2013). The new rules mandate that “unambiguous written consent” be provided by consumers before any telemarketing call may be placed or any text message may be sent. Please note that the Western District of Washington’s ruling does not change these requirements (because the text message at issue was sent prior to October 16, 2013).

Arguably, the Washington Court’s decision might not be different even under the TCPA’s new stricter requirements because of the “common sense” approach taken by the Court. However, the Court’s cited examples, including the mechanic example referenced above, may have fallen within the established business relationship exemption to the TCPA (which no longer exists under the new TCPA rules) or another exemption for calls made/texts sent for informational purposes only (which still only requires “prior express consent”).

We again reiterate how important it is that businesses understand the various provisions of the TCPA in order to protect against a TCPA action.

If you are interested in learning more about this topic, or if you have been named in a lawsuit relating to the TCPA, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

Attorney Advertising