Data & Privacy Law

Bank of America Sued in Putative Class Action Lawsuit for Alleged TCPA Violations

July 25, 2013 by David Klein

On June 20, 2013, Bank of America (“BOA”) was sued for allegedly violating the Telephone Consumer Protection Act (“TCPA”) and the Florida Consumer Collection Practices Act (“FCCPA”).

Factual Allegations

According to the Class Action Complaint, the background of this action is premised on a separate action between the parties. The plaintiff, Marc Katz (“Katz”), had a residential mortgage with BOA that was allegedly in arrears. BOA instituted an action in Florida state court for foreclosure on the mortgage approximately three (3) years before the instant action was initiated (the “Foreclosure Action”). Katz hired counsel to defend him in the Foreclosure Action, who filed a Notice of Appearance and Objection to Ex Parte Communication with Client, informing BOA that Katz was represented by counsel and directing BOA to cease all further communications with Katz. Thereafter, Katz’s counsel sent a letter to BOA, again informing BOA that Katz was represented by counsel. BOA confirmed receipt of that letter. Despite these two notices, BOA still proceeded to attempt to collect the debt by directly communicating with Katz. These communications were allegedly comprised of autodialed calls to Katz’s mobile telephone. When Katz answered these calls, a machine-operated voice requested that he “please hold for the next available representative.”

Legal TCPA and FCCPA Allegations

Katz alleges that these calls (which allegedly were “numerous”) violated the TCPA because he revoked any prior express consent he may have given to BOA to call him through two separate notifications from his counsel. Therefore, Katz maintains, BOA did not have his express consent to call him – and each call to his mobile telephone was a violation of the TCPA, as it allegedly was made with the use of an automatic telephone dialing system.

Katz further alleges that BOA violated the FCCPA, which prohibits communications with a debtor when that person knows the debtor is represented by counsel (unless the debtor initiates the communication or the debtor’s attorney consents to the direct communication). This is akin to ethical rules governing the conduct of attorneys (e.g., counsel may not communicate directly with a party that (s)he knows is represented by counsel).

Katz seeks statutory damages under both the TCPA and the FCCPA, a permanent injunction prohibiting BOA from placing non-emergency calls to mobile, or cellular, telephones by use of an automatic telephone dialing system, and associated attorneys’ fees and costs.

Status of the TCPA Action and Further Considerations

Katz filed a motion for class certification less than one month after the complaint was filed. BOA has not yet had a chance to respond to the complaint – by motion or answer. On July 18, 2013, the Court denied the motion without prejudice.

The strategy behind the filing of this motion was likely to prevent BOA from “picking off” Katz. What this means is that in a putative class action, if the defendant provides an offer of settlement comprising the full relief sought by the individual plaintiff, the case is moot. That means that the case will be dismissed following the filing of the appropriate motion by the defendant. Courts have held that an offer of full relief to the named plaintiff moots a putative class action, as long as it is made before a motion for class certification is filed. (The Court noted that Katz filed the motion so early in the action to prevent BOA from attempting a “buy off” to moot Katz’s claims.)

Two TCPA points of interest:

BOA may have been entirely “off the hook” under the TCPA if the calls were made to Katz’s residential landline phone. Debt collection calls have been found to fall under a TCPA exception which provides that it is unlawful to initiate “any telephone call to any residential line using an artificial or prerecorded voice to deliver a message without the prior express consent of the called party, unless the call . . . is made for a commercial purpose but does not include or introduce an unsolicited advertisement or constitute a telephone solicitation.”
Depending on the information revealed in the discovery process (if the case survives dismissal in the early stages), class certification may be extremely difficult here because of, among other reasons, the numerosity requirement. One of the requirements for class certification is that the “class is so numerous that joinder of all members is impractical.” Here, Katz seeks to certify a class consisting of Florida residents who were the subject of BOA’s debt collection with respect to their residential property located in Florida, and who are represented by counsel, yet continued to receive prerecorded or auto-dialed calls to their cell phones during the last four years. It is difficult to fathom that this class is so numerous so as to warrant the certification of a class. However, Katz’s premature motion for class certification claims that the class consists of thousands of Floridians – basing this allegation on calls with foreclosure defense attorneys throughout Florida, who “all confirm that [BOA’s] practice of repeatedly robodialing their clients is commonplace and widespread.”

Of course, we presently only have Katz’s version of the facts. BOA’s may differ entirely, in which case BOA may file a motion to dismiss the action or, perhaps, a motion for summary judgment.

If you are interested in learning more about this topic or need to review your telemarketing practices, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

Privacy Policies for Websites and Mobile Applications

June 17, 2013 by David Klein

While some businesses might be under the impression that posting a privacy policy on their web venue or mobile application (“app”) is of little importance, in truth, a well-crafted privacy policy is a key aspect of any Internet or mobile venture. Letting website/mobile app visitors know, via your privacy policy, what personally identifiable information you collect, how you use that information, to whom you disclose that information and the security measures taken to protect that information, is not only good policy from a customer-relations perspective, it is also required by state and federal law.

In addition to making sure that your online data collection activities are compliant with state and federal law (including the recently amended Children’s Online Privacy Protection Rule (COPPA)), a well-written privacy policy can form a key feature of your online business strategy.

Monetize Your Database

If proper disclosures are included in your privacy policy and above the “Submit” button on your website, you can monetize user data through e-mail marketing, telemarketing and, where permitted by law, mobile/text message marketing, to end-users. On the other hand, if you do not properly inform end-users of your intention to use their data for marketing purposes, any attempt to do so would almost certainly violate applicable law.

While properly collected end-user data may provide your business with a valuable revenue stream, collecting data also imposes a responsibility on your employees to safeguard such data. Various state and federal statutes require that you distribute to your employees a written manual on data security procedures, and that you notify end-users in case of any breach of security with respect to their data.

Help Is on the Way

With all the rules and regulations governing the collection and use of personally identifiable information – and given the potential financial benefits derived from a database of consumer information – it makes good business and legal sense to craft a privacy policy that is well-suited to the needs of your business, and that provides your website/mobile app visitors with the information they require to make an informed decision.

If you are interested in learning more about this topic, need a privacy policy for your web venue or mobile app, or need to review your privacy practices, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

FTC Issues Warning Letters to Data Brokers

May 7, 2013 by David Klein

Judging from the ten warning letters mailed to data brokers this week and the six we detailed last month, it is clear that the Federal Trade Commission (FTC) is taking violations of the Fair Credit Reporting Act (FCRA) very seriously. These warning letters come on the heels of the FTC’s decision in December of last year to begin focusing on the privacy practices of the data brokerage industry generally. As shown by the Equifax case, which we previously discussed on this blog, warning letters can lead to large monetary penalties and, thus, should heeded by everyone in the data brokerage business, even if a letter has not been specifically directed towards it.

FCRA Generally and Details of the FTC’s Most Recent Inquiry

The FCRA was created to protect consumers’ privacy and to ensure that those who collect, distribute and sell consumer information – called consumer reporting agencies (CRAs) – properly verify the identities of the parties requesting such information and confirm that such parties have a lawful purpose for receiving consumer information.

The latest set of warning letters resulted after FTC Staff contacted 45 data brokers, posing as individuals and/or companies seeking consumer information. Of the 45 data brokers, it was determined that ten brokers were willing to sell information to the FTC agents without properly following the authentication procedures set forth in the FCRA.

According to the FTC’s website, the ten companies receiving warning letters from the FTC include:

Two companies that appeared to offer “pre-screened” lists of consumers for use in making firm offers of credit: ConsumerBase and one additional company;
Two companies that appeared to offer consumer information for use in making insurance decisions: Brokers Data and US Data Corporation; and
Six companies that appeared to offer consumer information for employment purposes:Crimcheck.com, 4Nannies, U.S. Information Search, People Search Now, Case Breakers and USA People Search.

Takeaway and Best Practices for Data Brokers

While the FTC makes clear that it has not reached a conclusion regarding whether or not the ten companies in question have actually violated the FCRA, the warning letters serve as not-too-subtle reminders for the companies to re-evaluate their verification procedures in accordance with the requirements set forth by the FCRA. Considering the FTC’s recent scrutiny of the data brokerage industry, it would be wise for every company that collects, shares or uses consumer information to evaluate its business practices to avoid encountering an FTC investigation and associated fines and other costs.

If you are interested in learning more about this topic or need to review your data collection, usage and/or distribution practices based on the recent issuance of FTC warning letters, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising

FTC Settles Case Against Prepaid Phone Cards

May 6, 2013 by David Klein

A case the Federal Trade Commission (“FTC”) has been investigating for more than two (2) years was settled last month. For several years, the FTC received numerous complaints that prepaid phone cards sold by DR Phone Communications, Inc., also doing business as drphonecom.com (“DR Phone”), contained far fewer long distance phone minutes than were advertised. Upon investigating the calling cards, which are primarily consumed and marketed to recent immigrants to the U.S., the FTC found that the cards delivered only forty percent (40%) of the minutes promised, with some delivering less than five percent (5%) of the minutes advertised.

Authority to Regulate Unfair and Deceptive Business Practices

While the Federal Communications Commission (“FCC”) has jurisdiction over the telecommunications industry generally, the FTC is tasked with regulating the marketing aspects associated with telecommunications-related products and services. As detailed in a previous post, the FTC is an independent agency established in 1914 to, among other things, protect consumers from unfair and deceptive business practices, especially focusing on advertising, marketing, telemarketing fraud and privacy/identity protection. Under the FTC Act, a business and/or individual will be found to have engaged in an unfair business practice if the practice is found to be unethical and injures consumers, in violation of established public policy. Likewise, a business and/or individual will be found to have engaged in deceptive business practices if it made a material representation/omission or engaged in an activity that is likely to deceive reasonable consumers. The FTC has stated that a “material” representation, omission or practice is one that affects the consumer’s behavior.

Application of the FTC Act to DR Phone

In a complaint filed on May 22, 2012, the FTC alleged that DR Phone violated the FTC Act by misrepresenting the number of calling minutes available on the defendant’s prepaid calling cards and for failing to adequately disclose the fees that reduce the number of calling minutes contained on the pre-paid calling cards. Specifically, the FTC alleged that DR Phone failed to properly inform consumers that the advertised calling minutes were available only if used on a single call, that there were limits on the time of day in which the advertised rates were available and that the calling cards were subject to expiration and blackout dates.

DR Phone’s Settlement Terms and Penalties

On April 24, 2013, a consent order was entered in the U.S. District Court for the Northern District of California, in which DR Phone agreed to implement strict procedures to ensure that all of its marketing material is accurate and up-to-date. Additionally, DR Phone agreed to clearly and conspicuously disclose all material terms and fees associated with its prepaid phone cards. Finally, DR Phone agreed to pay a monetary judgment of $61,597.00 as disgorgement of all proceeds derived from the alleged FTC Act violations.

This topic should be of interest to anyone engaging in a commercial venture within the United States, especially those involved in the marketing and advertising of prepaid calling cards and/or telemarketing services generally.

If you would like to ensure that you are compliant with current FTC regulations, or if you are facing class action litigation or regulatory action, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

Recent Lawsuits Over Personally Identifiable Information

May 1, 2013 by David Klein

Lawsuits concerning alleged misuse of personally identifiable information (“PII”) are on the rise. According to the United States General Services Administration, PII “refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.” Although this once meant information as private as a Social Security Number, the definition has expanded to include, among other things, email address and online usernames and passwords. Recently courts have begun scrutinizing whether or not consumers have standing to assert claims relating to PII. In response, some consumers have brought lawsuits alleging a loss of value to their PII. These consumers make the argument that PII is akin to personal property, and that unauthorized distribution of PII diminishes the value of such PII, thus harming the affected consumers.

Background Facts

Recently, a California federal court in Yunker v. Pandora Media, Inc. held that a dilution of value to PII due to unauthorized sharing is insufficient to bring a claim. The Yunker case concerned the Pandora App. When a user downloaded the Pandora App, Pandora gathered PII about the user, including user age, gender, location and a universally unique device identifier. The Pandora App was integrated with advertising libraries such as AdMob, Ad-Marvel, comScore (SecureStudied), Google.Ads, and Medialets. These advertising libraries operated in the background while Pandora users navigated the App. The libraries collected significant PII which was later packaged and sold by the libraries.

The Court Denies Standing for Pesonally Identifiable Information Claim

The court in Yunker rejected the plaintiff’s dilution theory. The court reasoned that plaintiff’s complaint failed to allege that he attempted to sell his PII, that he would do so in the future or that he was foreclosed from entering into a value for value transaction relating to his PII as a result of Pandora’s conduct. Critically, the court reasoned that plaintiff never alleged that, had he known how Pandora intended to use his PII, he would not have downloaded or used the Pandora App.

Another Court Finds Standing

Two years before Yunker was decided, another federal court refused to dismiss a PII loss of value claim on the basis of standing. In Claridge v. RockYou, Inc., the plaintiff was a registered account holder with RockYou, a publisher and developer of online services and applications for use with social networking sites, such as Facebook, MySpace, hi5 and Bebo. Customers of RockYou provided email addresses, registration passwords and social media usernames and passwords, which RockYou would store in its database. The plaintiff in Claridge alleged that RockYou promised that it would safeguard its users’ PII. Despite this assurance, RockYou was informed by an online security firm that there was a flaw in RockYou’s system that allowed hackers to take advantage of web software to introduce malicious code into its network. The plaintiff alleged that RockYou did not respond to this information timely and sued. Specifically, the plaintiff alleged that RockYou’s customers, including the plaintiff, “paid” for the products and services that they “purchased” from RockYou by providing their PII, and that the PII constituted valuable property that was exchanged for RockYou’s promise to employ commercially reasonable methods to safeguard the PII that was exchanged. The court refused to dismiss the complaint, focusing on both the extremely sensitive nature of the PII at issue and the fact that there was a breach in RockYou’s servers. Although the court expressed doubt that the plaintiff could ultimately prove damages, the lawsuit was nevertheless allowed to proceed.

Defending Pesonally Identifiable Information Lawsuits

Individual consumers, as well as class action plaintiffs’ lawyers, are likely to continue to seek to use the diminution of value theory to assert claims for unauthorized use of, or access to, PII. Therefore, it is critical for companies that collect and store PII to retain counsel to both review and revise privacy policies and aggressively defend them in litigation.

If you are interested in learning more about this topic or crafting a privacy policy for your business, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

Attorney Advertising

FTC Settles with Path over Alleged Violations of Consumer Privacy Laws

February 7, 2013 by David Klein

As part of the widespread increase in regulatory focus on data collection, usage and disclosure practices in the mobile industry, the FTC brought charges against Path, Inc., the maker and distributor of a popular social media mobile app, alleging general privacy law violations, as well as a violation of the recently amended Children’s Online Privacy Protection Act (COPPA). The FTC’s action against Path comes amid an uptick in regulatory activity, including the release of a recent FTC report on the topic, discussions by federal lawmakers on establishing mobile application privacy standards and California’s recent action to require mobile app distributors to post and comply with a privacy policy.

In response, Path and the FTC reached a settlement that will require Path to pay $800,000 for the alleged COPPA violation, and for Path to “obtain independent privacy assessments every other year for the next 20 years.”

According to the FTC:

The settlement with Path is part of the FTC’s ongoing effort to make sure companies live up to the privacy promises they make to consumers, and that kids’ personal information isn’t collected or shared online without their parents’ consent. [ . . . ]

In its complaint, the FTC charged that the user interface in Path’s iOS app was misleading and provided consumers no meaningful choice regarding the collection of their personal information . . . Path automatically collected and stored personal information from the user’s mobile device address book even if the user had not [agreed to such collection] . . .

The FTC also alleged that Path’s privacy policy deceived consumers by claiming that it automatically collected only certain user information such as IP address, operating system, browser type, address of referring site, and site activity information. In fact, version 2.0 of the Path app for iOS automatically collected and stored personal information from the user’s mobile device address book when the user first launched version 2.0 of the app and each time the user signed back into the account.

Given the larger regulatory trend, it was only a matter of time before the FTC, and other regulatory bodies, began taking action against entities engaged in the mobile marketplace that fail to ensure that their privacy practices, and associated disclosures, are compliant with existing law. As the Path case makes clear, entities that fail to comply with state and federal privacy practice requirements – even in the mobile space – could find themselves facing regulatory action from the FTC, or state regulatory bodies, which is increasingly resulting in significant fines being levied.

If you are interested in learning more about this topic or need to review your privacy practices and/or update your mobile platform/mobile app privacy policies based on this FTC settlement, please contact us at your convenience.

Attorney Advertising

FTC Report Recommends Ways to Improve Mobile Privacy Disclosures

February 1, 2013 by David Klein

The FTC issued a report today recommending ways for players in the mobile space to improve privacy practices to ensure that consumers are provided easy-to-understand policies on data collection and usage.

The report makes recommendations for the following entities engaged in the mobile marketplace: “mobile platforms (operating system providers, such as Amazon, Apple, BlackBerry, Google, and Microsoft), application (app) developers, advertising networks and analytics companies, and app developer trade associations.”

According to the FTC’s website:

The report recommends that mobile platforms should:

Provide just-in-time disclosures to consumers and obtain their affirmative express consent before allowing apps to access sensitive content like geolocation;
Consider providing just-in-time disclosures and obtaining affirmative express consent for other content that consumers would find sensitive in many contexts, such as contacts, photos, calendar entries, or the recording of audio or video content;
Consider developing a one-stop “dashboard” approach to allow consumers to review the types of content accessed by the apps they have downloaded;
Consider developing icons to depict the transmission of user data;
Promote app developer best practices. For example, platforms can require developers to make privacy disclosures, reasonably enforce these requirements, and educate app developers;
Consider providing consumers with clear disclosures about the extent to which platforms review apps prior to making them available for download in the app stores and conduct compliance checks after the apps have been placed in the app stores; and
Consider offering a Do Not Track (DNT) mechanism for smartphone users. A mobile DNT mechanism, which a majority of the Commission has endorsed, would allow consumers to choose to prevent tracking by ad networks or other third parties as they navigate among apps on their phones.

App developers should:

Have a privacy policy and make sure it is easily accessible through the app stores;
Provide just-in-time disclosures and obtain affirmative express consent before collecting and sharing sensitive information (to the extent the platforms have not already provided such disclosures and obtained such consent);
Improve coordination and communication with ad networks and other third parties that provide services for apps, such as analytics companies, so the app developers can better understand the software they are using and, in turn, provide accurate disclosures to consumers. For example, app developers often integrate third-party code to facilitate advertising or analytics within an app with little understanding of what information the third party is collecting and how it is being used.
Consider participating in self-regulatory programs, trade associations, and industry organizations, which can provide guidance on how to make uniform, short-form privacy disclosures.

Advertising networks and other third parties should:

Communicate with app developers so that the developers can provide truthful disclosures to consumers;
Work with platforms to ensure effective implementation of DNT for mobile.

The FTC report is part of a larger trend, coming amid discussions by federal lawmakers on establishing mobile application privacy standards, as well as California’s recent action to require developers and distributors of mobile apps to post and comply with a privacy policy – just like websites and other commercial online venues must.

In light of this report, and the general regulatory trend, mobile platform providers, advertising networks and mobile app developers that collect consumer information should immediately review their data collection, usage, sharing, sale and broader privacy practices and seek to ensure compliance with the FTC’s report and additional guidance. Entities that fail to comply with the requirements of this report could find themselves facing regulatory action from the FTC, which could result in significant fines being levied.

If you are interested in learning more about this topic or need to review your privacy practices and/or update your mobile platform, advertising network and/or mobile app privacy policies or related agreements based on this FTC report, please contact us at your convenience.

Attorney Advertising

FTC Takes a Closer Look at Data Broker Industry’s Collection & Use of Consumer Data

December 20, 2012 by David Klein

Earlier this week, the Federal Trade Commission (FTC) issued orders requiring nine separate data brokerage companies to provide the FTC with information about how they collect, use, share and sell consumer data. The FTC has stated that it will use the information gathered from these nine brokerage companies to study privacy practices in the data broker industry.

The nine data brokers receiving orders are: (1) Acxiom; (2) Corelogic; (3) Datalogix; (4) eBureau; (5) ID Analytics; (6) Intelius; (7) Peekyou; (8) Rapleaf; and (9) Recorded Future.

According to the FTC’s website, the FTC is seeking details about:

– the nature and sources of the consumer information the data brokers collect;

– how they use, maintain, and disseminate the information; and

– the extent to which the data brokers allow consumers to access and correct their information or to opt out of having their personal information sold.

This action comes after the FTC issued the report, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers earlier this year in an effort to establish voluntary guidelines aimed at improving transparency and consumer choices in connection with data collection and usage. The FTC has stated that it will use the information gathered from the aforementioned brokerage companies to make further recommendations along the lines of the report referenced above.

Given this development, data brokers (and any entity that collects and shares consumer information with third parties) should immediately review their data collection, usage, sharing, sale and broader privacy practices and seek to ensure compliance with the FTC’s report and additional guidance. Entities that fail to comply with the FTC’s guidance could find themselves facing regulatory action from the FTC itself, as well as numerous state attorneys general and other regulatory bodies.

If you are interested in learning more about this topic or need to review your privacy practices and/or update your website (or mobile App) privacy policies based on the FTC’s guidance, please contact us at your convenience.

Attorney Advertising