Data & Privacy Law

More Data Brokers Targeted in Senate Commerce Committee Investigation

February 19, 2014 by David Klein

Senate Commerce Committee Chairman Jay Rockefeller recently expanded his investigation into the data broker industry, focusing specifically on the compilation and sale of products that identify consumers based on their financial vulnerability or health status.

Rockefeller initially launched the investigation in October 2012 to uncover how consumers’ personal information was being collected, shared and used. On December 18, 2013, a report was released in conjunction with Rockefeller’s hearing about the industry. The report noted that one of the primary ways that data brokers package and sell data to marketers is by putting consumers into categories based on characteristics that enable marketers to target potential and existing customers. The report noted that in many cases this may be beneficial because it provides consumers with products and services that are specific to their interests and needs. However, problems arise when these categories describe consumers using financial characteristics and the data ends up in the hands of predatory businesses seeking to identify vulnerable consumers.

Rockefeller noted that in the course of his investigation, some of the largest data brokers, such as Experian, have been evasive in providing information that had been requested by the Committee (which is particularly problematic in light of allegations that Experian’s subsidiary sold consumer data to an alleged identity theft scheme).

Earlier this month, Rockefeller sent Experian and others, including Lexis Nexis, new requests for information seeking, among other things, lists of all purchasers of the personal consumer data that the respective companies had collected and shared. In his correspondence, Rockefeller reiterated that he was “again” requesting information necessary for the Committee’s assessment of the potential consumer harms and benefits associated with data broker practices.

As we have reported in the past, the Federal Trade Commission has been cracking down on the data broker industry. The Senate Commerce Committee’s ongoing investigation seeks to uncover more facts related to industry practices and, if necessary, continue that crackdown.

If you are interested in learning more about this topic, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

Does California’s Strict New Internet Data Privacy Law Apply to You?

January 24, 2014 by David Klein

As many of our readers already know, California’s new data privacy law went into effect earlier this month on January 1, 2014. The law places strict requirements on operators of websites and other online services that collect certain information about California residents. In addition to addressing other aspects of collecting personally identifiable information (“PII”) from California residents, the new law focuses on the collection and use of “cookies.” For those that are unaware, “cookies” are small files that are stored on users’ computers to track Internet activity and allow online marketers to deliver targeted advertising to them.

Who Must Comply With California’s Data Privacy Law?

The scope of California’s new Internet data privacy law is broad and is applicable to any entity that operates a commercial website or online service that collects California consumer PII. The California Attorney General’s Office has made clear that service providers are specifically excluded from the requirements set forth in the data privacy law.

What Does California’s Data Privacy Law Require?

California’s data privacy law requires, among other things, that the Privacy Policies of covered entities: (1) identify the categories of PII that are collected and the third-parties that the PII may be shared with; (2) provide a description of the process for users to review and change their preferences for the types and amount of PII collected; (3) describe the process by which users are notified of material changes to the Privacy Policy; (4) disclose how the operator responds to users’ “do not track” web browser signals PII; and (5) disclose whether third parties may collect user PII across different websites when consumers uses the operator’s website or service.

Concerns with the Internet Data Privacy Law

How do you know that a person visiting your website is a California State resident? Even if you track the person’s IP address, there is no way of really knowing where the person resides. For example, a California resident could be vacationing in New York and visit your website from there. Or, a California resident could work in a neighboring state and access your website from his or her office computer. The only sure way to protect your company is to apply the new California requirements to your website across the board (for all consumers, regardless of location).

If you are interested in learning more about this topic, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

FTC Targets Data Broker Industry

December 19, 2013 by David Klein

If it was not clear before, the Federal Trade Commission (FTC) provided further evidence to Congress yesterday of how seriously it takes violations of the Fair Credit Reporting Act (FCRA). We’ve previously written about the warnings letters that the FTC mailed to data brokers earlier this year and the FTC’s decision to begin focusing on the privacy practices of the data brokerage industry generally. It appears that the FTC has no intention of decreasing its enforcement action in the data broker space. Judging by the $30 Million in civil penalties imposed upon various data brokers in the aggregate for violations of the FCRA last year, the FTC’s comments yesterday should be heeded by everyone in the data brokerage business.

FCRA Generally

The FCRA was created to protect consumer privacy and to ensure that those who collect, distribute and sell consumer information – called consumer reporting agencies (CRAs) – properly verify the identities of the parties requesting such information and confirm that such parties have a lawful purpose for receiving and using consumer information.

FTC’s Most Recent Comments

Yesterday, FTC Consumer Protection Director Jessica Rich emphasized the FTC’s concern that consumers are usually unaware of the type and extent of personal information collected and shared by data brokers. Director Rich emphasized the FTC’s focus on giving consumers greater control over how their information is collected and used by data brokers, including giving consumers better access to the data maintained about them.

In an effort to increase the level of consumer transparency present within the industry, the FTC introduced a three-pronged plan of attack: 1) aggressive enforcement of the FCRA; 2) the issuance of further compliance reports and directives; and 3) continuing to educate consumers about their data and information rights.

Takeaway and Best Practices for Data Brokers

While there are still several types of entities that are not covered by the FCRA, the FTC revealed that the data broker industry is in its crosshairs and the comments of Director Rich serve as a not-too-subtle reminder for the companies to re-evaluate their verification procedures in accordance with the requirements set forth by the FCRA. Considering the FTC’s recent scrutiny of the data brokerage industry, it would be wise for every company that collects, shares and/or uses consumer information to evaluate its business practices to avoid encountering an FTC investigation, one that could result in associated injunctive action, fines and other costs.

If you are interested in learning more about this topic or need to review your data collection, usage and/or distribution practices, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

FTC Brings New Lawsuit against 10 Companies and Individuals Charged with Mobile Cramming

December 17, 2013 by David Klein

As part of the increased regulatory focus on the mobile marketing space, the Federal Trade Commission (FTC) filed a complaint against several mobile marketing companies, including Tatto, Inc. and its principals, in a California federal court, alleging mobile telephone bill “cramming” in violation of the FTC Act and other applicable laws. “Cramming” is the act of placing unauthorized charges on a consumer’s telephone bill – in the present example, mobile telephone bills.

FTC Cramming Complaint

The FTC’s complaint alleges that the defendants “controlled, pitched ‘love tips,’ ‘fun facts,’ and celebrity gossip alerts sent by text message to consumers, but placed monthly subscription fees for these ‘services’ on consumers’ mobile phone bills without their authorization.” The FTC asserts that the defendants took advantage of the fact that consumers may not expect their mobile phone bills to contain charges from third parties and disguised the charges on the consumers’ bills in an abbreviated manner that did not always clearly designate the company as the source of the charge. As a result, many consumers did not notice or understand the nature of the charges and otherwise paid the bills. According to the complaint, to the extent that consumers did notice the charges, the process of obtaining refunds was difficult and often unsuccessful.

Cramming Penalties Sought

In addition to the temporary restraining order (with an asset freeze provision), which was granted on December 5, 2013, the FTC is seeking to enjoin the defendants from continuing their mobile cramming operations and to disgorge all ill-gotten gains generated from their conduct.

The FTC’s most recent cramming complaint is part of a larger trend of regulatory action within the mobile space. In light of this action, and the general regulatory trend, mobile service providers that bill for services by and through consumers’ mobile telephone bills should immediately review their marketing practices and consumer disclosures in order to ensure compliance with the FTC’s guidance and to avoid allegations of cramming. Entities that fail to comply with applicable law could find themselves facing regulatory action from the FTC, which could result in significant fines being levied.

If you are interested in learning more about this topic or need to review your mobile billing practices and/or update your consumer disclosures based on this FTC action, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

Mobile Content Providers Beware

November 18, 2013 by David Klein

On November 6, 2013, the Attorney General for the State of Texas filed a lawsuit in Texas state court against five mobile content providers and an aggregator, alleging mobile telephone “cramming” by the defendants. The action is yet another example of state and federal regulatory agencies pushing to rein in the advertising practices of mobile content providers.

The defendants find themselves facing regulatory action from the State despite their disclosures and double opt-in procedures. Now, more than ever, it is important that mobile content providers review their business models to help avoid regulatory scrutiny and litigation.

Allegations of Deceptive Advertising and Inadequate Disclosures

The subject complaint alleges that, among other things, the subject mobile content providers used search engine advertising in a fashion meant to mislead consumers into believing, for example, that by clicking on an advertisement consumers would obtain free coupons. Instead, the complaint alleges, by clicking on the advertisements, consumers were unwittingly taking the first step in a process of signing up for a completely unrelated product, for example, horoscopes, that resulted in the placement of monthly billing charges on their mobile telephone bills.

In addition to misleading consumers with respect to the product they would obtain, the complaint alleges that the marketing materials used by the mobile content providers were designed to confuse and mislead consumers. For example, under the content provider website “continue” buttons, the defendants included a clock that counted up in tenths of a second. According to the Texas State Attorney General, the clock was designed to “create a false sense of urgency and to discourage the consumer from reading the rest of the website.” Additionally, the price point and other product disclosures were written “in very small font” and located at the bottom of the web page. The complaint states that the disclosures appeared even smaller when viewed on a consumer’s mobile telephone.

The complaint also alleges that information concerning the product that the consumers were actually signing up to receive was deceptively placed a distance away from the advertised product that had initially lured consumers to the website. Therefore, while consumers entered personally identifiable information for the product that they sought to receive (for example, a coupon), they were in fact purchasing, at a monthly recurring cost, an entirely different product (for example, horoscope information). The complaint details that the defendants’ websites separated disclosures from the product consumers thought they were registering to receive (for example, a coupon) in such a manner that would lead consumers to believe the disclosures concerned an unrelated product (for example, a horoscope).

Double Opt-In and Typosquatting

Although the defendants purported to use a “double opt-in” sign up process, where the consumer signs up online and then re-enters a PIN sent to their mobile telephones via text message, the Texas State Attorney General nevertheless alleges that this practice was fraudulent. Both the web page seeking confirmation of the consumer’s mobile number and the text message containing the PIN failed to provide adequate disclosures. The text message containing the PIN number did in fact contain disclosures, but according to the Attorney General, “Defendants have designed the message such that they often provide the PIN well before there is any disclosure of the price.”

The complaint further alleges that the defendants used subdomains as a form of “typosquatting,” whereby a mobile content provider obtains and uses a domain name that is confusingly similar to the domain name of a legitimate website. The subdomains were created, according to the complaint, to intentionally mislead consumers into believing that they were visiting a well-known commercial website rather than that of defendants.

All of these practices, according to the Texas State Attorney General, lead to the invalid and fraudulent billing of products on the mobile telephone bills of consumers.

Protect Yourself

We have previously noted that the Federal Trade Commission has been increasingly scrutinizing the business practices of mobile content providers. (See, FTC Crackdown on Unsolicited Commercial Text Message Spamming Continues, Jamster Settles FTC Cramming Lawsuit for More than $1 Million). In addition, consumer protection agencies and industry organizations have been revising the regulations governing how mobile content is advertised to consumers. (See, July’s New COPPA Requirements and Their Effect on Mobile Apps, BBB Will Enforce New Consumer Disclosure Requirements). It is clear that state regulators are also turning their focus toward mobile content providers. (See Are You Prepared for California’s Strict New Internet Data Privacy Laws?). Therefore, it is critical that mobile content providers seek competent counsel in order to prevent becoming a named defendant in a state or federal regulatory action.

If you are interested in learning more about this topic, or if you have been served with legal process relating to your provision of mobile content services, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

Attorney Advertising

Court Rules that E-mail Addresses Are Protected Personal Data

November 14, 2013 by David Klein

Previously we informed our readers that California’s new Internet data privacy law, effective January 1^st, 2014, requires operators of commercial websites or online services that collect personally identifiable information (“PII”) from California consumers to conspicuously post their privacy policies on their respective websites. Now, the federal District Court for the Eastern District of California has ruled that consumers’ e-mail addresses are PII under California’s Song-Beverly Act, and that retailers may not require consumers to provide their e-mail addresses prior to making a purchase with their credit cards.

Song-Beverly Act Generally

In an effort to cut down on the amount of unsolicited marketing material sent to California consumers, the California legislature passed the Song-Beverly Act (the “Act”), which prohibits retailers from requiring consumers to provide their PII prior to purchasing a good or service by credit card. The Act defines PII as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.”

Recent Federal Court Case Regarding E-mail Addresses

While on its face, the Act outlaws retailers from collecting consumers’ telephone numbers and street addresses, there had been uncertainty as to whether a consumer’s e-mail address is subject to the Act. In a class-action lawsuit brought against the popular retailer Nordstrom’s, the federal District Court found that, like zip codes, which were previously found to be PII under the Act, consumers’ e-mail addresses fall within the broad definition of PII under the Act.

In reaching this decision, the Court found that an e-mail address is, in fact, more personal than a consumer’s zip code. Expanding on this reasoning, the Court stated that “a cardholder’s e[-]mail address permits direct contact and implicates the privacy interests of a cardholder.” In essence, while a consumer’s zip code may inform the retailer of the general vicinity in which the consumer lives, an e-mail address gives the retailer direct access to the consumer through which it may deliver unsolicited marketing messages.

In rejecting Nordstrom’s argument that that the Controlling the Assault of Non-Solicited Pornography and Marketing Act (“CAN-SPAM”) preempts application of the Act to the facts at issue, the federal District Court ruled that CAN-SPAM is not preemptive because, unlike CAN-SPAM, the Act does not address or regulate the content of the e-mail messages sent to consumers. In fact, the Court found that retailers should comply with both the Act and CAN-SPAM.

The District Court’s inclusion of e-mail as PII covered under the Act may whet the appetites of plaintiff’s attorneys and result in a new wave of e-mail related lawsuits in both California State and federal courts.

If you are interested in learning more about this topic, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

Are You Prepared for California’s Strict New Internet Data Privacy Laws?

October 24, 2013 by David Klein

In late September, California enacted several laws that place stricter requirements on operators of websites and other online services that collect certain information about California residents. These Internet data privacy laws will go into effect on January 1, 2014. One of the laws focuses on cookies, small files that are stored on users’ computers to track Internet activity to allow, among other things, online marketers to deliver a page tailored to that particular user.

Internet Data Privacy Law Requirements

California’s new Internet data privacy law requires any operator of a commercial website or online service that collects personally identifiable information (“PII”) about California consumers to conspicuously post its privacy policy on its website. The Internet data privacy law also establishes specific requirements for the privacy policy itself, including that the privacy policy must: (1) identify the categories of PII that are collected and the categories of third-parties that the PII may be shared with; (2) provide a description of the process for reviewing and requesting changes to the PII collected through the website or online service (if the operator maintains such a process); (3) describe the process by which the operator notifies consumers who use or visit its website or online service of material changes to the privacy policy; (4) disclose how the operator responds to web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of PII; and (5) disclose whether other parties may collect PII about a consumer’s online activities over time and across different websites when a consumer uses the operator’s website or se

Concerns with the Internet Data Privacy Law

How do you know that a person visiting your website is a California resident? Even if you track the person’s IP address if he or she submits information on your site, there is no way of really knowing where the person resides. For example, a California resident could be vacationing in New York and visit your website from there. Or, a California resident could work in a neighboring state and access your website from his or her office computer. The only sure way to protect your company is to apply the new California requirements to your website across the board (for all consumers).

While California’s Internet data privacy law goes into effect on January 1, 2014, it is not too early to revise your privacy policy so that you are fully prepared.

If you are interested in learning more about this topic or would like to update your privacy policy, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

Voluntary Mobile App Code of Conduct Draft Issued Governing Privacy Notices

August 12, 2013 by David Klein

On the heels of the release of the Digital Advertising Alliance’s self-regulatory guidelines for the mobile app industry, the National Telecommunications and Information Administration (“NTIA”) recently published a draft Short Form Notice Code of Conduct to Promote Transparency in Mobile App Practices (“Mobile App Code of Conduct”). The Mobile App Code of Conduct provides guidance to app developers and publishers regarding the display of certain application practices information. The Mobile App Code of Conduct is voluntary and, NITA adds, the adoption of its principles does not guarantee compliance with specific state, federal or international laws or best practices.

The Mobile App Code of Conduct addresses short form notices about the collection and sharing of consumer information with third parties. The goal is to provide consumers with information about whether the app that they are downloading on their mobile devices is collecting and transmitting their personal data to third parties – and what manner of personal data that entails. Ideally, the short form notice will be presented to consumers prior to installation or use of the app, but the Code of Conduct does not make this a requirement.

What the Short Form Notices Must Contain

The categories of data the app collects (meaning that such data will be transmitted off of the device), regardless of whether the user knows that it is being collected:
1. Biometrics (information about one’s body, including fingerprints, facial recognition, signatures and/or voice print);
2. Browser History (a list of websites visited);
3. Phone or Text Log (a list of the calls or texts made or received);
4. Contacts (including list of contacts, social networking connections or their phone numbers, postal, email and text addresses) ;
5. Financial Information (including credit, bank and consumer-specific financial information such as transaction data);
6. Health, Medical or Therapy Information (including health claims and other information used to measure health or wellness);
7. Location (precise past or current location of where a user has gone); and
8. User Files (files stored on the device that contain user content, such as calendar, photos, text and video).
The categories of third parties with which the app shares user-specific data:
1. Ad Networks (companies that display ads through apps);
2. Carriers (mobile phone service companies);
3. Consumer Data Resellers (companies that sell consumer information to other companies for multiple purposes, including offering products and services that may interest the user);
4. Data Analytics Providers (companies that collect and analyze the user’s data);
5. Government Entities (any sharing with the government except where required by law or expressly permitted in an emergency);
6. Operating Systems and Platforms (software companies that power the device, app stores, and companies that provide common tools and information for apps about app consumers);
7. Other Apps (apps of companies that the consumer may not have a relationship with); and
8. Social Networks (companies that connect individuals around common interests and facilitate sharing).
A means of accessing a long form privacy policy, if any exists. Privacy laws, such as California’s Online Privacy Protection Act, may separately require a long form privacy policy to be posted. In any event, since this is generally accepted best practices, NTIA encourages all app developers to post a long form privacy policy.
The identity of the entity providing the app.

The Mobile App Code of Conduct indicates that short form notice is not required for sharing consumer data with third party service providers where a contract between the app and the third party explicitly: (i) limits the uses of the data provided by the app to the third party solely to provide a service to or on behalf of the app; and (ii) prohibits the sharing of the consumer data with subsequent third parties.

The Mobile App Code of Conduct provides certain exceptions, including for what it deems the most common app collection and sharing activities for operational purposes, such as those activities necessary to:

(a) maintain, improve or analyze the functioning of the app;

(b) perform network communications;

(d) cap the frequency of advertising;

(e) protect the security or integrity of the user or app;

(f) facilitate legal or regulatory compliance; or

(g) allow an app to be made available to the user on the user’s device.

With the evolution of the mobile app industry and devices’ ability to collect (and transfer) a tremendous amount of personal information collected from its users, there is increasing regulatory scrutiny focused on protecting consumers’ privacy. For example, as we recently reported, on June 27, 2013, the FCC issued its first Declaratory Ruling in the mobile telephone context clarifying precisely what information must be protected on mobile devices. As this and the Mobile App Code of Conduct reveal, app developers and publishers must keep updated on the numerous and ever-evolving policies and best practices governing data collection and sharing in order to remain in compliance and stay on the “right side of the law.”

If you would like us to prepare a short form notice for your app or are interested in learning more about this topic, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising