Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

Big Data and Human Resources—Letting the Computer Decide?

Employees are a company’s greatest asset, but if the company gets hiring decisions wrong, employees could also be the company’s greatest expense. Accordingly, r

Big Data and Human Resources—Letting the Computer Decide?

Earlier this month the UK’s financial services regulator, the Financial Conduct Authority (FCA), issued its final guidance on financial promotions made via social media channels.As we reported <a href="https://www.sociallyawareblog.com/2014/08/26/uks-financial-services-regulator-issues-draft-guidance-on-social-media-should-we-favorite-or-fail/" target="_blank" rel="noopener">last year</a>, the FCA issued long-awaited draft guidance in August 2014 on the use of social media in financial promotions by regulated financial institutions. Following the publication of the draft guidance, the FCA held a consultation exercise which closed on Nov. 6, 2014. In response to feedback from regulated firms and industry bodies, in the final guidance the FCA has clarified a few areas and amended portions of the text, as well as added more visual examples.Very little has changed in the final guidance with respect to the FCA’s approach to regulating promotions in social media. The overarching principle for all communications with consumers is that they must be “fair, clear and not misleading” and the FCA’s view remains that its rules are, and should be, media neutral. It believes that to take any other approach would create a more complex and costly regime.However, there is one notable amendment in the final guidance. In the draft guidance, the FCA had suggested using a hashtag #ad to help identify promotions. In the final guidance, the FCA has done an about turn and stated that the use of hashtags is not an appropriate way to identify promotional content.KEY RECOMMENDATIONSThe recommendations detailed in the final guidance include the following.<ul><li> Form of communication</li></ul>Any form of communication made by a firm is capable of being a financial promotion – the key is whether it includes an invitation to engage in financial activity. All communications must be fair, clear and not misleading, even if the communication ends up in front of a non-intended recipient (e.g., due to a re-tweet).<ul><li>In the course of business</li></ul>Some communications will not include an invitation to engage in financial activity – for example, communications solely relating to the firm’s community work. Only financial promotions made “in the course of business” will be subject to the FCA guidance. The definition laid down in the guidance effectively requires a commercial interest on the part of the firm. The FCA provides a couple of examples to illustrate the issue.Firstly, if a company is already operating, it will be acting in the course of business when seeking to generate additional capital. However, if the company has not yet been formed, and the proposed founders approach friends and family to obtain start-up capital, they will not generally be acting in the course of business. Secondly, where a personal social media account is used by someone associated with a firm, that firm and individual should take care to distinguish clearly personal communications from those that are, or are likely to be understood to be, made in the course of that business. During the consultation exercise, further guidance was requested as to the difference between personal and business communications. The FCA clarified that if an employee of a firm uses their own social media account to send communications that could be considered an inducement or invitation then this may constitute a financial promotion and will therefore be subject to the same rules that apply to the firm. Accordingly, firms will need to ensure that their social media policies and training cover the risks of personal social media use.<ul><li>Hashtags</li></ul>All financial promotions made via digital media must be clearly identified as such. In the original draft guidance the FCA suggested using a hashtag #ad to help identify promotions. However, in the final guidance, in response to feedback, the FCA has reversed its stance and stated that hashtags are not an appropriate way to identify promotional content. This is based on a few factors.Firstly, the FCA believes that most promotions on social media will be self-evident. For example, paid-for advertising on various social media platforms already indicates that a communication is promotional (e.g., on Twitter ‘promoted by’, on Facebook ‘SPONSORED’). Secondly, the nature of a hashtag means that if the consumer looks up that hashtag the consumer will be presented with a whole series of communications unrelated to the firm. The FCA believes that this could lead to consumer confusion.The FCA has also explicitly stated that hashtags would be inappropriate for the inclusion of risk warnings (e.g., #capitalatrisk) or to highlight jurisdictional limitations (e.g., #UKinvestors). The FCA has suggested that signposting of a tweet will only be appropriate where the promotion is obscured or combined with other content (e.g., a celebrity endorsement or native advertisement).It seems surprising that the FCA did not appreciate how hashtags worked until now. In addition, given that a consumer who regularly uses Twitter is likely to be familiar with how hashtags work, would a consumer really be confused by the use of #ad? Nevertheless, given the position taken in the guidance, if companies have been widely using hashtags in connection with financial promotions they will need to rethink their approach.<ul><li>Re-tweets</li></ul>The FCA has confirmed that when a communication is re-tweeted or shared, the responsibility lies with the person who sends the communication. Accordingly, if a consumer re-tweets a firm’s promotional communication and is not acting in the course of business, then it is only the original communication that will need to be compliant with the promotion rules. The firm would not be responsible for the re-tweet.Where a firm re-tweets, shares, or likes a consumer’s communication, whether this is a financial promotion or not will depend on the content of the tweet. For example, if the tweet praises the firm for good customer service, the FCA has confirmed that would not be a promotion because customer service is not a controlled activity. Whereas, if a customer is endorsing the benefits of a particular product, then re-tweeting, sharing or liking that tweet would constitute a promotion. Accordingly, firms will need to ensure that training for their social media operators deals with the potential risks of sharing positive customer comments.<ul><li>Images</li></ul>Risk warnings must be suitably prominent in social media promotions. If a risk warning is set out in too small a font size and/or lost in surrounding text, the promotion will not be compliant with the guidance. Of course, social media often poses particular challenges because of space and character limitations. The FCA has suggested that one solution is to insert images (such as infographics into tweets) as long as the image itself is compliant. The FCA acknowledges that the functionality which allows a Twitter image to be permanently visible may be switched off so that the image appears simply as a link. Accordingly, any risk warning or other information required by the rules cannot appear solely in the image.<ul><li>Signposting</li></ul>It may be possible to signpost a product or service with a link to more comprehensive information, provided that the signpost remains compliant in itself. The FCA has rejected that compliance should be assessed based on the combination of a tweet and the website to which it links. This form of ‘click-through’ approach was proposed by a number of respondents during the consultation period. The FCA is of the opinion that the tweet and the website are separate financial promotions and so each tweet needs to be compliant, even if the tweet has been created to point the consumer to the firm’s website.<ul><li>Image advertising</li></ul>Firms may be able to advertise through image advertising, which is less likely to cause compliance issues. An image advertisement (i.e., an advert that only includes the name of the firm, a logo or other image associated with the firm, contact point, and a reference to types of regulated activities provided by the firm or its fees or commissions) may be exempt from financial promotion rules, but will still need to be fair, clear and not misleading.<ul><li>Likes</li></ul>Being a follower of a regulated firm on Twitter or having “liked” its Facebook page does not constitute an “existing client relationship” or “express request” for a communication under applicable rules. Issuing a financial promotion to such an individual would therefore be considered unsolicited.<ul><li>Systems</li></ul>Firms need to put in place adequate systems for signing off digital media communications. Sign-off should be by a person of appropriate competence and seniority within the organisation. 3 © 2015 Morrison & Foerster LLP | mofo.com Attorney Advertising lient AlertCONCLUSIONThe final guidance does not introduce any major surprises. By and large, it follows very closely existing guidance relating to financial promotions and includes some pretty clear-cut examples of compliant and non-compliant communications.Some firms may have been holding back from becoming fully engaged on social media in anticipation of this final guidance. Such firms may be disappointed that the guidance is not more detailed and does not give them the regulatory certainty that they were hoping for, but that’s really not surprising – FCA guidance is rarely prescriptive.In any case, firms can’t afford to wait any longer to take the plunge. Increasingly consumers want to engage via social media and with the rise of FinTech, we are seeing a whole host of new competitors moving into the financial services market, many of whom are potentially more agile and better equipped in terms of a digital strategy than the traditional finance brands. While organisations need to be careful to comply with the relevant laws and regulations, they also need to get on board with social media if they do not want to be left behind.Social media may be a new method of communicating with customers, but compliance risks are not insurmountable. Firms need to exercise the same risk-balancing that they use with other types of media. It’s a case of putting in place appropriate guidance, policies and procedures to adequately address the risks, while not overly restricting the firm’s ability to be up-to-date in terms of its promotional campaigns.

UK’s Financial Services Regulator: No Hashtags in Financial Promotions

Earlier this month the UK’s financial services regulator, the Financial Conduct Authority (FCA), issued its final guidance on financial promotions made via soci

UK’s Financial Services Regulator: No Hashtags in Financial Promotions

As consumers increasingly connect to the Internet using multiple devices—such as mobile phones, tablets, computers, TVs and wearable devices—advertising technology companies have rapidly developed capabilities to reach the same consumers across their various devices. Such “cross-device” tracking enables companies to target ads to the same consumer regardless of the platform, device, or application being used. Last week, the Federal Trade Commission (FTC) <a href="https://www.ftc.gov/news-events/press-releases/2015/03/ftc-host-workshop-cross-device-tracking-nov-16?utm_source=govdelivery" target="_blank" rel="noopener">announced</a> that it will host a workshop on November 16, 2015, to explore the privacy issues arising from such practices—signaling that interest based advertising (IBA) is still at the forefront of its agenda.For a long time, advertisers and publishers have tracked consumers’ online activities using HTTP cookies stored in web browsers on desktop and laptop computers. In response to the FTC’s concerns over consumers’ visibility into and control over such tracking for IBA purposes, industry responded with widely adopted ways for publishers and advertisers to provide consumers with enhanced notice and cookie-based choice with respect to such tracking.As consumers’ behavior has shifted, however, traditional cookie-based technologies are becoming less effective. Most consumers now access the Internet through apps on various platforms, in addition to web browsers, and they tend to use different devices throughout the day. This presents challenges for advertisers, publishers and others who want a complete picture of how individual consumers interact with their websites, services, and advertisements over time— as well as for those who want to know where and how they can reach such consumers. In response, companies have developed various solutions for identifying the same consumer across devices. One approach, for example, is to use “deterministic” methods that link the consumer’s devices to a single account as the consumer logs into websites and services on different devices. Another is through “probabilistic” methods that infer links among devices that share similar attributes, such as location derived from IP address. In some cases, companies may combine multiple techniques for greater accuracy.In its announcement, the FTC explained that these new practices may raise privacy issues if consumers are not provided with adequate notice and control—and the workshop will address, among other topics, how companies can make their tracking more transparent and give consumers greater control over it. If history is a guide, the FTC will likely publish a staff report some months after the workshop, to highlight the privacy issues it sees with cross-device tracking and to offer industry guidance on addressing them.The FTC’s announcement is a natural extension of its recent workshops on <a href="https://www.ftc.gov/news-events/events-calendar/2012/05/short-advertising-privacy-disclosures-digital-world" target="_blank" rel="noopener">mobile privacy disclosures</a>, the <a href="https://www.ftc.gov/news-events/events-calendar/2013/11/internet-things-privacy-security-connected-world" target="_blank" rel="noopener">Internet of Things</a>, and <a href="https://www.ftc.gov/news-events/events-calendar/2014/02/spring-privacy-series-mobile-device-tracking" target="_blank" rel="noopener">mobile device tracking</a>. It also follows recent news from the Digital Advertising Alliance (DAA) that it has launched tools to provide in-app notice and choice to consumers about IBA practices and that it expects enforcement of the DAA Self-Regulatory Principles in the mobile environment to begin this summer.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

The New Frontier in Interest Based Advertising: FTC Shifts Focus to Cross-Device Tracking

As consumers increasingly connect to the Internet using multiple devices—such as mobile phones, tablets, computers, TVs and wearable devices—advertising technol

The New Frontier in Interest Based Advertising: FTC Shifts Focus to Cross-Device Tracking

Chevy Kelly, a partner in the UK-based Social Media Leadership Forum, recently sat down with Socially Aware’s own Sue McLean, a Social Media Leadership Forum member, to discuss the legal implications of UK companies’ use of social media as part of their marketing strategies. Chevy Kelly: In your opinion, what are the top three legal risks that organizations in the United Kingdom face when engaging in social media?Sue McLean: Compliance with relevant advertising and marketing rules is a key priority. All relevant rules, whether it’s the CAP Code, unfair trading regulations, FCA promotions rules, are concerned with organizations treating the customer fairly and being transparent. Companies will be experienced with applicable rules in terms of traditional media but, of course, social media brings its own challenges, including space/character limitations and the immediacy element of social media bypassing the time for review and approval protocols built into “old media” usage.Data protection is also a key challenge. Whether you’re collecting personal information from customers via your social media channels, mining data from social media platforms or carrying out Big Data analytics, you need to ensure that you comply with relevant privacy laws. If you’re a global business, unfortunately that means a myriad of different laws. It’s not just a question of compliance. Showing that you take customers’ data seriously will help build trust; it may even help give you a competitive advantage.Lastly, companies need to continue to focus on social media policies and the education and training of employees. Given the rate of change, companies really need to regularly review their policies and practices. New platforms can trigger new issues, as we have seen with instant messaging, as well as visual, anonymous, self-deleting platforms. Get social media right and employees can be fantastic brand ambassadors; but get it wrong and their activity could result in damage to your reputation and potentially legal or regulatory action.CK: Are UK lawmakers able to keep up with the rate of change and disruption in the digital era and how are they coping to legislate for every scenario?SM: No. Given the rate of technological change we have seen over the past decade and are continuing to see (whether it’s social media, Big Data, the Internet of Things, drones, etc.), the law is always playing catch-up; it’s virtually impossible for the lawmakers to keep up.Also, it often takes so long to bring in a new law, that by the time it’s adopted it may be out of date. By way of example, the long-awaited Data Protection Regulation was proposed back in 2012 to reflect technological changes, including social media—but is still being debated in Europe and, even if it is finalized this year, there will be a transition period of two years before the law applies.But it’s not always a case of bringing in new laws. Often it’s about interpreting how existing laws can apply to new platforms. That’s certainly the approach the FCA has taken (at least up until now) with respect of the use of social media by financial organizations, the approach that their rules are media neutral and apply to social media in the same way as they apply to traditional media. It’s also the approach the government has taken to trolling and other malicious behavior via social media—that the framework of laws we have are fit for purpose in this digital age (even if they were designed in a world before social media, e.g., to apply to poison-pen letters).And, of course, while laws are inherently national, social media is a global phenomenon. Unless laws are very closely harmonized (which they are not), social media users face uncertainty because of different approaches to law and regulation in the key countries.CK: Would you say that large organizations are taking the legal risks surrounding social media as seriously as other traditional communications channels?SM: I’m not sure it’s a case of not taking the legal risks of social media seriously. I think it’s more a case of organizations being less experienced with social media generally, and that includes legal and compliance departments. If social media is being run out of a marketing/communications team then they will be very experienced with the legal risks of traditional media. But social media triggers new, different types of risk and both the marketing/ communications team and the legal and compliance teams are trying to figure out how to handle those risks.And, of course, not all social media platforms are the same, and we are getting new platforms all the time. Companies may have become just about comfortable with Facebook and Twitter, but now they have to deal with, say, Pinterest, Instagram, Snapchat. And that’s just in the West; if you are a global organization, it’s likely that you have to deal with a variety of platforms across the different regions.Of course, it’s not just a question of using social media to promote your business and interact with customers. If you’ve implemented an enterprise social media platform for your employees, that throws up a whole host of other issues.CK: If you were to reference an example to give a wake-up call to an organization that may be laid-back in their attitude to social media governance, what would it be?SM: There are a lot of examples I can point to where companies’ social media activity has ended up making headlines for all the wrong reasons. For example, the HMV case where the company didn’t take sufficient control of its Twitter account and employees managed to send a series of angry tweets before the company took control. In fact, I expect that a lot of companies still don’t put enough focus on social media in the context of insolvency and crisis management. It’s not just a question of implementing proper social media governance to avoid legal sanctions. In many cases, it’s equally important to avoid the risk of damage to the company’s reputation.CK: Have you found that having an in-depth understanding of the law actually makes organizations more risk averse, or are they more averse when they don’t know the boundaries?SM: A number of companies have taken limited steps into social media because they think that they should be on it, but haven’t fully engaged because of a lack of understanding of social media and a fear of the potential legal risks. But legal risks must be weighed up against the damage that may be caused to the business of not properly engaging. If you appreciate what the risks are, you can weigh up those risks against the business benefit, and also the damage that may be caused to your business of not engaging. Whereas, if you don’t understand the nature or level of the risks, you could be almost paralyzed into inaction. In most cases, the legal risks are not insurmountable. Companies need to exercise the same common sense, judgment and risk-balancing that they use with other media.

Five Vital Questions on the Implications of UK Law on Social Media

Chevy Kelly, a partner in the UK-based Social Media Leadership Forum, recently sat down with Socially Aware’s own Sue McLean, a Social Media Leadership Forum me

Five Vital Questions on the Implications of UK Law on Social Media

Under section 512(f) of the Digital Millennium Copyright Act (DMCA), copyright owners are liable for “any damages” stemming from knowingly false accusations of infringement that result in removal of the accused online material. Section 512(f) aims to deter abuse of the DMCA requirement that service providers process takedown requests from purported copyright owners, but such abuses remain rampant. (E.g., as reported here and here.) In fact, until the March 2, 2015, decision in Automattic Inc. v. Steiner (adopting magistrate’s earlier recommendation), no court had awarded damages under section 512(f).The case concerned a blog by Oliver Hotham, who had contacted a group called “Straight Pride UK,” identifying himself as “a student and freelance journalist” and submitting a list of questions. Nick Steiner responded by identifying himself as the “Press Officer” for Straight Pride UK and providing a PDF file titled “Press Statement – Oliver Hotham.pdf.” The press statement laid out Straight Pride UK’s opposition to “everyone [in the UK] being forced to accept homosexuals” and stated its mission of ensuring “that heterosexuals are allowed to have a voice and speak out against being oppressed.” Hotham posted material from the press statement on his blog.Steiner, apparently displeased with the subsequent negative attention, sent an email to Automattic, Inc., the blog’s host, invoking section 512(f). Steiner claimed to hold copyright in the posted material and requested that Automattic remove the blog post, and Automattic complied. Hotham, however, again posted material from the Press Statement to his blog, prompting Steiner to send two more removal requests by email to Automattic. Automattic denied those requests, citing their legal insufficiency. Automattic and Hotham then filed a lawsuit to recover damages related to Steiner’s misrepresentation that the blog infringed his copyright.The court easily found that Steiner had violated section 512(f) because he “could not have reasonably believed that the Press Statement he sent to Hotham was protected under copyright.” Following the precedent of Lenz v. Universal Music Corp., the court then interpreted the statute’s specification of “any damages” to mean that damages are available, no matter how insubstantial. After requesting more detailed evidence concerning damages, the court found that Hotham and Automattic were entitled to certain types of damages.First, based on the time he was prevented from spending on freelance articles and his expected compensation for such work, Hotham estimated the value of the time he spent on activities related to the incident, including responding to media inquiries. Hotham also requested additional damages for “lost work” due to the “significant distraction” caused by the media coverage and legal disputes. Hotham claimed a total of $960, and the court found his declaration sufficient to support that claim. But the court denied Hotham’s request for reputational harm as speculative, and rejected Hotham’s request for damages based on emotional distress and “chilled speech,” citing the lack of authority that such damages are available under section 512(f).Automattic was likewise successful in claiming damages of $1,860, calculated based on employee salaries and a 2,000-hour year, for time spent responding to the takedown notices and related press inquiries. The court denied Automattic’s request for damages attributable to time spent by its outside public relations firm, however, because there was insufficient evidence to show how that time constituted a loss to Automattic.The court also awarded attorneys’ fees, which are expressly allowed by section 512(f). Based on comprehensive billing records submitted along with data indicating the average local billing rate for IP attorneys, the court granted the request for recovery at a rate or $418.50 per hour, for a total of $22,264 in fees.The court’s analysis is instructive in multiple ways. First, as mentioned, this was the first case resulting in a damages award under section 512(f), so the opinion is likely to serve as a road map for future courts considering such damages. Potential litigants should not read this case, however, as necessarily indicative of the magnitude of damages available in section 512(f) cases. Exposure can certainly be much greater, as demonstrated in Online Policy Group v. Diebold, Inc., a case that reportedly settled for $125,000. A few factors conspired to make damages in this case minimal (a total of $25,084). Steiner’s takedown notice was obviously fraudulent, so practically no resources were expended in meeting the normally demanding burden of proof. (As other commentators have noted, that same demanding burden of proof is one reason why there are not many section 512(f) cases in the first place.) Other cases may involve more protracted conflict over takedown notices and legal threats. Steiner also never appeared in his defense and therefore defaulted, which likely greatly reduced the time and expense of the lawsuit.This case also reinforces the most crucial strategic consideration for service providers in responding to a DMCA takedown notice: as Socially Aware has previously explained, no damages can be awarded under section 512(f) unless the notice actually prompts the removal of the accused material. Therefore, if it ultimately wants to resist a takedown notice, a service provider can only recover the expenses of doing so if it actually removes the accused material in the first place.On the other hand, the court applied the takedown requirement loosely in its actual assessment of damages. Steiner issued three purported DMCA takedown notices, but only the first notice resulted in actual removal of accused content. Even though Hotham and Automattic could have incurred a portion of their expenses due to the final two notices, the court did not discuss whether the takedown requirement precluded any portion of their claimed damages. While this bodes well for the availability of damages in cases involving multiple takedown notices, the analysis has questionable weight on this point. Given the absence of any opposition from defendant, future defendants will have a strong argument that the court simply did not consider this nuance.

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.

Aaron Rubin

First-Ever Award of “Any Damages” for Fraudulent DMCA Takedowns Under Section 512(f)

Under section 512(f) of the Digital Millennium Copyright Act (DMCA), copyright owners are liable for “any damages” stemming from knowingly false accusations of 

First-Ever Award of “Any Damages” for Fraudulent  DMCA Takedowns Under Section 512(f)

Is it stealing to take data without permission from a public website, or is it simply making use of resources that are made available to you? “Web scraping” or “screen scraping” is the practice of extracting large amounts of data from public websites using bots.A recent case in the European Court of Justice has focused attention both on the intellectual property infringement aspects of scraping practices and on the potential for website owners to use their sites’ contractual terms and conditions to combat the scrapers.Scraping is not new, but it has become increasingly widespread in recent years, fuelled by the rise in big data analytics and the popularity of price comparison websites. Indeed, in 2013, it accounted for 18% of site visitors and 23% of all Internet traffic. Scraping is not inherently bad: it can have legitimate uses, spur innovation and give companies with limited resources access to large amounts of data. However, unsurprisingly, many website operators do not like it. Not only are operators keen to protect their proprietary rights, but repeated scraping can also take a heavy toll on websites by using up bandwidth and leading to network crashes.In the U.S., website operators have asserted various claims against scrapers, including copyright claims, trespass to chattels claims and contract-based claims alleging that scrapers violated their websites terms of use. In the EU, operators have tended to rely on intellectual property infringement claims against scrapers, but there has been little case law to provide guidance.However, in January 2015, in a much anticipated decision, the European Court of Justice (CJEU) held that where a website operator cannot establish intellectual property rights in its database, an operator may still be able to rely on its website terms and conditions to prohibit scraping. This ruling may impact an increasing number of companies whose business models rely on mining data from websites and social media platforms without permission. On the other hand, it will be viewed positively by those data-rich businesses keen to protect and/or monetise their data.RYANAIR LTD V PR AVIATIONThe CJEU case involved PR Aviation which operates a price-comparison website for low-cost airlines. Consumers can book a flight on the website and PR Aviation receives a commission. The website relies on information obtained by screen scraping publicly available data from the websites of low cost airlines, including data from Ryanair’s website.Ryanair sued the defendant for infringement of database rights under the Database Directive (96/9/EC), and breach of its website terms and conditions. It sought an order against PR Aviation to refrain from any further infringement on pain of a financial penalty and for PR Aviation to pay damages.WHAT ARE DATABASE RIGHTS?Database rights are a form of unregistered intellectual property rights introduced by the Database Directive in 1996 and implemented into national law across the European Union.The aim of the Database Directive was to harmonise the rules that applied to copyright protection of databases across the EU, safeguard the investment of database makers and secure the legitimate interests of database users. In essence, the Directive sought to create a legal framework appropriate to the use of databases in the information age. It did so by ensuring copyright protection to those elements of databases possessing protectable expression and introducing a new form of “sui generis” protection to those elements of databases which are not “original” in the sense of being the author’s own intellectual creation.Accordingly, the Database Directive provides two forms of protection. Article 3(1) establishes the first of these rights: “databases which by reason of the selection or arrangement of their contents, constitute the author’s own intellectual creation shall be protected as such by copyright”. The second form of protection (established by Article 7) provides protection where there “has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents [of a database]”.Importantly, the Database Directive includes certain limited exceptions to the rights created. In particular, Article 6 allows lawful users to make a copy of a copyright-protected database without consent where it is necessary to do so in order to access its contents. Further, Article 8 permits lawful users of a publicly available database to extract and/or reuse insubstantial parts of its contents, as long as this use does not conflict with normal exploitation of the database or unreasonably prejudice the legitimate interests of the database’s author.DUTCH SUPREME COURTThe Ryanair dispute ended up in the Dutch Supreme Court where PR Aviation successfully argued that Ryanair could not rely on copyright protection because Ryanair’s database was not sufficiently original to attract copyright protection, and also that there had been insufficient investment by Ryanair, in compiling its database, for it to claim the sui generis right.However, the court still faced the question whether Ryanair could assert a claim that PR Aviation had breached Ryanair’s website terms and conditions by scraping and re-using data from the Ryanair site. Significantly, Ryanair’s website terms and conditions contain the following express prohibition on the use of screen scraping: “The use of automated systems or software to extract data from this website or www.bookryanair.com for commercial purposes (‘screen scraping’) is prohibited unless the third party has directly concluded a written licence agreement with Ryanair which permits access to Ryanair’s price, flight and timetable information for the sole purpose of price comparison.”Ryanair sought to enforce this term. PR Aviation argued that the prohibition against screen scraping was not enforceable because, under Article 15 of the Database Directive, any contractual provisions which are contrary to Articles 6 and 8 are rendered null and void. The Dutch Supreme Court was unsure whether Article 15 of the Directive applied to a database which did not attract copyright protection or the sui generis right and therefore it sought a preliminary ruling from the CJEU.CJEU DECISIONIn a logical ruling, the CJEU ruled that the limitations on rights introduced by the Database Directive do not apply to databases that are not protected by the Directive. Accordingly, Articles 6, 8 and 15 of the Database Directive do not preclude a website operator from laying down contractual limits on the use of a database, without prejudice to applicable national law.The case has now been sent back to the Dutch courts, which must decide on the enforceability of the Ryanair website terms and conditions.For a website owner, it is not simply a question of prohibiting scraping in its terms and conditions; an operator also needs to ensure that those terms and conditions are enforceable. We have written before about the issues involved, particularly in Europe, in ensuring that online terms are deemed fair and reasonable.Ideally, a website operator would require any user of its site to accept the website terms and conditions before allowing the user to access the website. However, the majority of sites are reluctant to enforce this rule because it is not considered user-friendly. It is therefore more common to ensure that a link to the terms is displayed prominently on the site. The problem with this method is that there is no active acceptance of the terms (e.g., clicking a box). As a result, there is a risk that the website owner will be unable to demonstrate that there is a contract in place with the user. This is a question for national law, as indicated in this case.There is no binding case law on the issue in the UK. Unfortunately, although the issue was touched on in the recent high-profile Newspaper Licensing Agency v Meltwater [2011] EWCA Civ 890, the Court of Appeal did not consider whether an end-user was bound by the website terms of use because, given the nature of the case, it said that it was unnecessary “to enter into that controversy”.Lastly, the Ryanair judgment does not answer the question of whether a screenscraper would ever be able to rely on the lawful use exceptions set out in Article 6 or 8 of the Database Directive if the database owner were able to establish copyright protection or the sui generis right in the database.OTHER CLAIMSIt is worth pointing out that, in addition to intellectual property rights infringement and contract breach claims, website owners may have other legal arguments against scraping. For example, as in the U.S., in the UK, a website operator may try to bring a claim for trespass to chattels, a common law tort. In addition, an operator may seek to rely on the Computer Misuse Act 1990 which prohibits unauthorised access to, or modification of, computer material. To date, as with database rights, neither of these arguments have been tested in the UK courts in connection with web scraping. (However, similar legislation has formed the basis of claims elsewhere, for example, in the U.S., as described in our previous alert, “<a href="http://www.sociallyawareblog.com/2014/07/21/data-for-the-taking-using-the-cfaa-to-combat-web-scraping/" target="_blank" rel="noopener">Data for the Taking: Using the Computer Fraud and Abuse Act to Combat Web Scraping</a>”.)Of course, when dealing with scraped data, issues of privacy and security loom large and web scrapers and users of scraped data will also need to tread extremely carefully in order to avoid problems under applicable privacy laws. For a detailed discussion on privacy and big data, see our previous Alert.CONCLUSIONThe CJEU’s Ryanair decision appears to give a rather contrary result – in certain circumstances, a database owner may have broader, albeit contractual, rights to prevent scraping if it does not actually have proprietary rights in the database. However, in any event, in light of this decision, website owners based in the EU may be encouraged to amend their website terms and conditions to expressly prohibit screen-scraping in order to try to protect their valuable data.Whether the impact of this decision will truly disrupt those companies with business models that rely on the use of data mined from websites and social media platforms remains to be seen. Certainly, any business that carries out screen-scraping activities should consider where it sources its data from and identify whether such data are bound by contractual limitations or other restrictions. It can then make a reasoned decision on whether or not it should approach the database owner for a commercial licence to ensure that the data keeps flowing.

samavi_mercedes_blog_150x150.png

samavi_mercedes_common_640x280.jpg

samavi_mercedes_heroretina_2700x1160.jpg

samavi_mercedes_mobileretina_750x1040.jpg

samavi_mercedes_social_600x600.jpg

Mercedes Samavi is an associate based in the London office of Morrison & Foerster and a member of both the Technology Transactions Group and the Global Privacy Group.
Mercedes advises domestic and int

Mercedes Samavi

istock_000026998957large-300x300-1.jpg

Data for the Taking: Using Website Terms and Conditions to Combat Web Scraping

Data for the Taking: Using Website Terms and Conditions to Combat Web Scraping