Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

The European Court of Justice (ECJ) issued a quite surprising <a href="http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=req&docid=152065&occ=first&dir=&cid=257118">decision</a> against Google which has significant implications for global companies.On May 13, 2014 the ECJ issued a ruling which did not follow the rationale or the conclusions of its Advocate General, but instead sided with the Spanish data protection authority (DPA) and found that:<ul><li>Individuals have a right to request from the search engine provider that content that was legitimately published on websites should not be searchable by name if the personal information published is inadequate, irrelevant or no longer relevant;</li><li>Google’s search function resulted in Google acting as a data controller within the meaning of the Data Protection Directive 95/46, despite the fact that Google did not control the data appearing on webpages of third party publishers;</li><li>Spanish law applied because Google Inc. processed data that was closely related to Google Spain’s selling of advertising space, even where Google Spain did not process any of the data. In doing so, it derogated from earlier decisions, arguing the services were targeted at the Spanish market, and such broad application was required for the effectiveness of the Directive.</li></ul>The ruling will have significant implications for search engines, social media operators and businesses with operations in Europe generally. While the much debated “right to be forgotten” is strengthened, the decision may open the floodgates for people living in the 28 countries in the EU to demand that Google and other search engine operators remove links from search results. The problem is that the ECJ mentions a broad range of data that may be erased. Not only should incorrect or unlawful data be erased, but also all those data which are “inadequate, irrelevant, or no longer relevant”, as well as those which are “excessive or not kept up to date” in relation to the purposes for which they were processed. It is left to the companies to decide when data falls into these categories.In that context, the ruling will likely create new costs for companies and possibly thousands of individual complaints. What is more, companies operating search engines for users in the EU will have the difficult task of assessing each complaint they process and whether the rights of the individuals prevail over the rights of the public. Internet search engines with operations in the EU will have to handle requests from individuals who want the deletion of search results that link to pages containing their personal data.That said, the scope of the ruling is limited to name searches. While search engines will have to de-activate the name search, the data can still be available in relation to other keyword searches. The ECJ did not impose new requirements relating to the content of webpages, in an effort to maintain the freedom of expression, and more particularly, press freedom. But this will still result in a great deal of information legally published to be available only to a limited audience.Below we set out the facts of the case and the most significant implications of the decision, and address its possible consequences on all companies operating search engines.FACTS OF THE CASEIn 2010, a Spanish national lodged a complaint before the Spanish DPA against the publisher of a daily newspaper with a wide audience in Spain, La Vanguardia, and against Google Spain and Google Inc. for their refusal to remove web links to the newspaper. The web pages contained the claimant’s personal details in an announcement concerning an auction of real estate connected with a procedure prompted by Social Security debts.The Spanish DPA did not require the newspaper to take down the pages, but it ordered Google Spain and Google Inc. to remove the data from their search results and to render future access to them impossible. Google appealed to the Spanish National High Court, seeking an annulment of the DPA decision.QUESTIONS REFERRED TO THE COURTThe Spanish National High Court referred the following questions to the ECJ for a preliminary ruling:<ul><li>Is Google a data controller with respect to its search engine activity?</li><li>Does the Directive apply even though Google Spain does not carry out any activity related to the search engine?</li><li>Can individuals require the erasure of their personal data by Google in a search engine, regardless of whether third- party content is legitimate?</li></ul>The ECJ is the highest court which decides on the interpretation and application of EU law. Decisions of the ECJ are legally binding on the courts in all EU countries which apply EU law. When a case is referred for a preliminary ruling, the answers of the ECJ must be applied by national courts, which then issue their own ruling on the specific facts of a case. There is no appeal following a preliminary ruling.In this specific case, the case will go back to the Spanish National High Court, which will have to decide on the specific facts while taking into account the principles highlighted by the ECJ.OPINION OF THE ADVOCATE GENERALOn June 25, 2013 the Advocate General at the ECJ Niilo Jääskinen issued an Opinion recommending that Google should not be required to remove links to legitimate third-party content based on data protection principles. In his Opinion, Jääskinen emphasized the importance of freedom of speech and the reservation of historic newspaper reports.The Advocate General agreed that sales offices in EU countries suffice to trigger the application of that country’s data protection law. In his view, the processing of personal data takes place within the context of an ‘establishment’ if that establishment is linked to a service selling targeted advertising in the Member State, even if the technical data processing operations are situated in third countries.However, the Advocate General stated that Google cannot be considered the data controller of data available on third party websites as it does not control the content of these sites. Also, he made it clear that in his opinion, there was no such thing as a general “right to be forgotten” under the current Data Protection Directive.The ECJ ultimately took a very different view. It is an uncommon occurrence that the ECJ disagrees with the opinion of an Advocate General as it has done here.GOOGLE IS A DATA CONTROLLERIn its decision, the ECJ explained that Google’s search engine activity consists of retrieving, recording and organizing personal data which it stores on its servers and, as the case may be, discloses the data to its users in the form of lists of results. In the ECJ’s view, this indexing activity is a processing of personal data, regardless of the fact that the search engine does not distinguish between personal data and other types of data.The ECJ further regarded Google as a data controller in relation to the processing of the data by the search engine. According to the ECJ, Google determines the purposes and means of data processing and its activity is “liable to significantly affect” individuals’ fundamental rights to privacy. The ECJ highlighted that the definition of a data controller in the Directive is broad.The ruling is a surprising result as this means that Google is the data controller of search results even though it cannot control the webpages from which the data are pulled. In fact, third party publishers are the data controllers when it comes to the content of the webpages. This fact however, was not relevant to the ECJ and finding may have broader implications regarding the definition of a data controller in other contexts.APPLICATION OF EU DATA PROTECTION LAW WHERE PROCESSING RELATES TO ACTIVITIES OF LOCAL SALES AGENTSThe ECJ held that the Google’s search engine is subject to EU data protection laws even if Google Spain does not carry out any activity directly linked to the indexing or storing data.In fact, the ECJ said that a broad interpretation of the territorial scope of EU laws was required to ensure the effectiveness of Art. 4.1 (a) of the Directive which states that local EU data protection law applies where “the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable.”The ECJ determined Google Spain constitutes a stable establishment of Google Inc. within the meaning of the Directive, and Google Inc.’s processing is closely related to Google Spain’s activity because it is intended to promote and sell advertising space in Spain in order to make the service offered by the engine more profitable. In doing so, the Court considered whether Spanish users were targeted for marketing and for advertising, a consideration provided in the draft EU Regulation and discussed in literature, but not currently provided in the Directive. Thus, this finding is new and quite unexpected.The ECJ ruling follows the same line as its General Advocate and a common position in the Member States with respect to the meaning of an “establishment”. It held the “establishment” in not just in terms of control over personal data, but also in the economic function of the EU subsidiaries of the foreign companies. The interpretation of the “establishment” has been continuously broadened by the EU DPAs. This may, in the end, be the finding that has the broadest implications for companies. Essentially if an EU subsidiary is intertwined with the goals and purposes of a foreign parent company and if the service is aimed at the local EU Member State market, EU law may be found to apply to the non-EU entity.RECOGNITION OF THE MUCH DEBATED “RIGHT TO BE FORGOTTEN”According to the ECJ opinion, a website operator should remove links to web pages that are published by third parties each time the inclusion of the link is or has become incompatible with the Directive. Opposing the Advocate General’s reasoning, the ECJ stated that a link is incompatible with the Directive not only when the data are false or unlawful (which is the current position in many Member States), but also when the data are inadequate, irrelevant, or no longer relevant, or where the data are excessive or not kept up to date in relation to the purposes for which they were processed. This is a significant expansion of the definition of the correction rights as currently implemented and interpreted in many Member States.The ECJ did make an exception for individuals who are public figures or where the public interest in the information would outweigh the privacy rights of the individuals.In the specific case at hand, the ECJ found that the web pages contained true information that had been lawfully published, but they stated, “having regard to the sensitivity of the information contained on the webpage, and to the fact that its initial publication had taken place 16 years earlier, the data subject establishes a right that that information should no longer be linked to his name.” Thus, the ECJ found that even where the data are lawfully published and the underlying website will not be altered, the individual still has the right to request that the “aggregator” of such information remove the data.  The ECJ, however, did not impose specific requirement as to how much time must pass for a request to be considered valid, leaving that question to search engine operators, data protection authorities and national courts to answer on a case-by-case basis.As a result, while the information was legitimately published, and may remain available off-line and on the Internet, the information should no longer be searchable via the name of the individual. That said, it would still be permissible for the search engine platform to allow the information to be searchable by date, location, or any other keyword.A NEW SOURCE OF CONTENTIONS BEFORE THE DPAsThe ECJ justified the new constraint it imposes on technology companies by the “seriousness of the interference in the private life of the individuals” that may be caused by a name search. In fact, any Internet user, when he or she searches an individual’s name, may obtain a structured overview of the information relating to that individual, the ECJ said. This information potentially concerns a vast number of aspects of an individual’s private life which, without the search engine, could not have been interconnected.What this likely means in practice is that an individual may make a request to a company to have the links based on name be removed. If the company does not agree, then the individual will have the right to go to the Data Protection Authority or the local courts to try to force the company to remove the links. This will thus create quite a bit of additional work for the DPAs and the courts.A DIFFICULT BALANCE TO STRIKE BETWEEN THE INTERESTS OF THE INDIVIDUALS AND THOSE OF THE INTERNET COMMUNITYThe ECJ ruling creates a new requirement that search engine operators and other aggregators of information must seek a fair balance between the interests of the individuals and those of the public. The ECJ stated that the following factors need to be taken into account by the search engine provider in deciding whether to make information available via name search.The balance will depend on (i) the nature of the information, (ii) the sensitivity of the information for the individual’s private life and (iii) the interests of the general public in having that information. Such interest may vary according to the role played by each individual in public life. Again, it is for the companies to assess in which case such role may justify the indexation of the data. This will likely be a costly and uncomfortable position for many companies.PRESS FREEDOM AND FREE SPEECH PRESERVED BUT POTENTIALLY LIMITEDThe ECJ affirmed that publishers of websites are still allowed to publish contested personal data for journalistic purposes. These rights do not, however, extend to search engines. Therefore, while an individual may require the erasure of his or her data by a search engine’s operator, the content of the webpage would be left unchanged.However, it is likely that the decision will affect the activity of journalists and more generally, freedom of expression. The removal of contested links will lower the number of times a webpage is visited, thus adversely affecting freedom of expression. The ECJ did not uphold the Advocate General’s opinion that the erasure of legitimate and legal information would amount to a form of “censorship” by a private party.CURRENT STATE OF PLAY AT EU LEVELThe introduction of a right to be forgotten has been proposed by the EU commission in the proposed General Data Protection Regulation. In a first reading of March 2014, the Parliament adopted a new article 6, which set out that any data which is inaccurate, incomplete or no longer up to date should not be disclosed. The proposed Regulation also sets out that the right to erase incorrect data extends to third parties. However, the Parliament did not retain the Rapporteur’s proposition for a reference to clear time limits. For the proposed Regulation to become law, the Council must agree on a common position with the Parliament. It is not certain that these developments will be upheld by the Council which has stated that it wants to remove administrative burdens from companies. While Parliament has expressed the need to adopt a reform by the end of the year, the Council has not yet formed official positions or started official negotiations to reach a common position. In view of the coming European elections and the appointment of a new Commission, solid legislative work may not restart until next year.In this context, it is still unclear whether the ECJ’s ruling at hand will be integrated in the new Regulation. What is sure is that the decision will be debated at the EU level, whereas it already has implications in the jurisdictions of the 28 Member States.IMPLICATIONSIn addition to putting data protection authorities in a rather uncomfortable position of deciding on the question of what legitimate content should be easily searchable and accessible, this decision will have wide-ranging ramifications for organizations, not just for search engine providers.First, there is a very broad interpretation of the jurisdictional reach of EU Member State law to cover organizations outside the EU whenever users in the EU are targeted.Second, search engine providers, social media and other content providers may have obligations to comply with the data protection laws even where they are not involved in making decisions about the online content provided.Third, the way in which organizations search for data will likely change due to the fact that certain information will now no longer be available by name.

European Court of Justice Strengthens Right to Be Forgotten

The European Court of Justice (ECJ) issued a quite surprising decision against Google which has significant implications for global companies. On May 13, 2014 t

European Court of Justice Strengthens Right to Be Forgotten

The staff of the Division of Corporation Finance of the U.S. Securities and Exchange Commission (SEC) recently provided guidance on applying its rules regarding communications in connection with securities offerings, tender offers, business combinations and proxy contests when statements are made utilizing certain social media channels. The staff’s guidance permits the use of a hyperlink to information required by certain rules when a character- or text-limited social media channel such as Twitter is used for a regulated communication, and also confirms that, at least in the context of a securities offering, a communication that has been re-transmitted by a third party that is not an offering participant or someone acting on behalf of the issuer is not attributable to the issuer for the purposes of the rules that apply to such communication.SECURITIES OFFERING COMMUNICATIONSRule 134 under the Securities Act of 1933, as amended (the “Securities Act”), permits an issuer conducting a registered securities offering to make limited communications that will not be deemed to be a prospectus or free writing prospectus, provided that the communication includes no more information than is permitted by the rule and the communication includes specific legends, including the statement required by Rule 134(b)(1) and information required by Rule 134(b)(2), unless the conditions of Rule 134(c) are met, as well as the statement required by Rule 134(d) if the communication solicits from a recipient an offer to buy the security or requests the recipient to indicate whether he or she might be interested in the security.Rule 134(b)(1) provides that if the registration statement has not yet become effective, the following statement must be included:A registration statement relating to these securities has been filed with the Securities and Exchange Commission but has not yet become effective. These securities may not be sold nor may offers to buy be accepted prior to the time the registration statement becomes effective.Rule 134(b)(2) indicates that the notice must include the name and address of a person or persons from whom a written prospectus for the offering, meeting the requirements of Section 10 of the Securities Act, other than a free writing prospectus, including a price range where required, may be obtained.Rule 134(d) provides that a communication sent or delivered to any person which is accompanied or preceded by a prospectus which meets the requirements of Section 10 of the Securities Act (other than a free writing prospectus), including a price range where required, at the date of such communication, may solicit from the recipient of the communication an offer to buy the security or request the recipient to indicate whether he or she might be interested in the security, if the communication contains substantially the following statement:No offer to buy the securities can be accepted and no part of the purchase price can be received until the registration statement has become effective, and any such offer may be withdrawn or revoked, without obligation or commitment of any kind, at any time prior to notice of its acceptance given after the effective date.Recognizing the growing interest in the use of social media, in Securities Act Rules Compliance and Disclosure Interpretations Question 110.01, the staff indicates that it would not object to the use of an active hyperlink to satisfy the requirements of Rule 134(b) and Rule 134(d) in limited circumstances when:<ul><li>The electronic communication is distributed through a platform that has technological limitations on the number of characters or amount of text may be included in the communication;</li><li>The inclusion of the entire required statements, together with the other information in the communication, would cause the communication to exceed the limit on the number of characters or amount of text; and</li><li>The communication contains an active hyperlink to the required statements and prominently conveys, through introductory language or otherwise, that important or required information is provided through the hyperlink.</li></ul>The staff points out that where an electronic communication is capable of actually including the required statements, along with the other information, without exceeding a limit on the number of characters or amount of text, then the use of the hyperlink would not be appropriate. Therefore, the guidance appears to be limited to those micro-blogging social media channels with character or text limitations such as Twitter, rather than other social media channels, such as Facebook, which permit longer postings.The staff took a similar approach in Securities Act Rules Compliance and Disclosure Interpretations Question 232.15, which provides an interpretation with respect to Rule 433 under the Securities Act. Rule 433 provides conditions for the use of free writing prospectuses (as defined in Securities Act Rule 405), and any free writing prospectus (other than free writing prospectuses that comply with Rule 433(f)(1)) must contain the legend required by Rule 433(c)(2)(i). The Rule 433(c)(2)(i) legend states:The issuer has filed a registration statement (including a prospectus) with the SEC for the offering to which this communication relates. Before you invest, you should read the prospectus in that registration statement and other documents the issuer has filed with the SEC for more complete information about the issuer and this offering. You may get these documents for free by visiting EDGAR on the SEC Web site at <a href="https://www.sec.gov/" target="_self">www.sec.gov. </a>Alternatively, the issuer, any underwriter or any dealer participating in the offering will arrange to send you the prospectus if you request it by calling toll-free 1-8[xx-xxx-xxxx].The legend also may provide an email address at which the documents can be requested and may indicate that the documents also are available by accessing the issuer’s website and provide the Internet address and the particular location of the documents on the website.The staff notes that, under the same conditions set forth above with respect to Rule 134, an issuer can use an active hyperlink to provide the legend required by Rule 433(c)(2)(i).The staff also points out, in Securities Act Rules Compliance and Disclosure Interpretations Questions 110.02 and 232.16, that an issuer does not need to ensure compliance with Rule 134 and Rule 433 for electronic communications that are re-transmitted by a third party that is not an offering participant or acting on behalf of the issuer, as long as the issuer has no involvement in the third party’s re-transmission of the information other than having initially prepared the communication in compliance with Rule 134 or Rule 433. In this regard, the staff confirms in the context of social media platforms the guidance that the Commission provided in Release No. 33-8591 (July 19, 2005), which stated:[W]hether information prepared and distributed by third parties that are not offering participants is attributable to an issuer or other offering participant depends upon whether the issuer or other offering participant has involved itself in the preparation of the information or explicitly or implicitly endorsed or approved the information.The staff’s guidance appears to be directed at situations where an offering communication prepared in compliance with Rule 134 or Rule 433 is re-tweeted by a third party, or otherwise re-transmitted via a similar social media channel.BUSINESS COMBINATION COMMUNICATIONSThe recent staff guidance also addresses an analogous rule in the context of business combination transactions, Securities Act Rule 165. In Securities Act Rules Compliance and Disclosure Interpretations Question 164.02, the staff notes that the legend required by paragraph (c)(1) of Rule 165 may be provided by use of an active hyperlink, subject to the same conditions specified for Rule 134 notices and Rule 433 free writing prospectuses discussed above. Rule 165(c)(1) specifies that a communication made under the rule must contain a prominent legend that urges investors to read the relevant documents filed or to be filed with the Commission because they contain important information, and the legend also must explain to investors that they can get the documents for free at the Commission’s website and describe which documents are available free from the offeror.The staff also notes that this same interpretation applies with respect to similar legend requirements specified in Rule 14a-12 under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), which deals with written communications that constitute solicitations, and pre-commencement written communications in connection with tender offers that are subject to Exchange Act Rules 13e-4(c), 14d-2(b) and 14d-9(a).CONCLUSIONThe staff’s guidance addresses lingering concerns as to how social media platforms such as Twitter can be integrated into the process of making communications regarding a registered securities offering, business combination transaction, proxy contest or tender offer. While this guidance provides flexibility to utilize these forms of communications more effectively, issuers must be mindful of all applicable Commission filing, civil liability and anti-fraud provisions that are applicable to communications made under these rules.

SEC Staff Guidance on the Use of Social Media in Securities Offerings, Tender Offers, Business Combinations and Proxy Contests

The staff of the Division of Corporation Finance of the U.S. Securities and Exchange Commission (SEC) recently provided guidance on applying its rules regarding

SEC Staff Guidance on the Use of Social Media in Securities Offerings, Tender Offers, Business Combinations and Proxy Contests

Snapchat’s recent settlement with the Federal Trade Commission (FTC) generally provides a comprehensive but not groundbreaking roadmap to the FTC’s privacy and data security expectations in the mobile environment under Section 5 of the FTC Act, with two very notable exceptions:<ol><li>It now appears that companies are required to follow researchers’ blogs and other writings to see if there are any privacy or data security vulnerabilities, and to act on any such information promptly; and</li><li>It also appears that the FTC expects companies to be aware of all third parties who have technology that can interact with an app, and to make sure that when consumers engage in any such interaction, all of the company’s privacy and data security representations remain true. If the FTC continues down this path, it will create unsustainable new burdens on app developers, many of which have very few resources to begin with. Furthermore, if this is the new standard, there is no reason it should be limited to the app environment—analytically, this would lead to a rule of general application.</li></ol>THE BASIC ALLEGED MISREPRESENTATIONThe Snapchat app became very popular because of its branding as an “ephemeral” mobile messaging service. Among other things, the app promised its users and prominently represented—in its privacy policy and an FAQ, among other places—that the “snaps” (e.g., messages) users sent would “disappea[r] forever” after 10 seconds (or less). However, according to the FTC’s <a href="http://www.ftc.gov/system/files/documents/cases/140508snapchatcmpt.pdf">complaint</a>, in addition to other problems with the app’s privacy and security features, it was much too easy to capture these supposedly ephemeral messages, making the company’s claims false and misleading in violation of Section 5. And since the company’s representations were not consistent with the app’s practices, now it’s the FTC that won’t be disappearing any time soon.A NEW DUTY TO DISCOVER POSSIBLE VULNERABILITIESGiven the app’s popularity, along with its unqualified claims (“snaps disappear . . .”), maybe it shouldn’t be surprising that creative users and other opportunistic individuals found ways to preserve these supposedly fleeting messages. As the FTC complaint put it, “several methods exist by which a recipient can use tools outside of the application to view and save snaps indefinitely.” The FTC noted in particular “widely publicized” methods for saving video files sent through Snapchat and for using smartphones’ “screenshot” functionality to capture a snap. With regard to the screenshot work-around, Snapchat also represented that the app would “let you [the sender] know if [recipients] take a screenshot.” But this representation was allegedly misleading because of the well-known means for circumventing the app’s alert mechanism.But the FTC also seems to have collapsed a subtly different type of problem with the app into the discussion of these allegedly “widely publicized,” albeit ad hoc, means to preserve supposedly ephemeral snaps. As the complaint (and <a href="http://www.ftc.gov/news-events/press-releases/2014/05/snapchat-settles-ftc-charges-promises-disappearing-messages-were">press release</a>) put it, a “security researcher” warned the company in 2012 that the way its application programming interface (API) functioned made it possible for third-party apps to download and save photo and video messages sent through the Snapchat service, since the deletion function was wholly dependent on the Snapchat application itself.The fact that this “warning” to Snapchat—note that the complaint does not say if or how Snapchat actually received or learned about this warning, if at all, or that the warning was “widely publicized”—evidently should have been sufficient to put the company on notice that its app had a vulnerability suggests that the FTC may be trying to create a very broad “duty to discover” potential privacy or security vulnerabilities. It’s one thing for this type of flaw to lead to a misrepresentation based on the ephemeral nature of the snaps (since Section 5 is a strict liability statute, and Snapchat’s representations allegedly were facially misleading), but it’s quite unprecedented for the FTC to suggest a duty to be aware of (and therefore respond to) the warnings of “security researcher[s],” especially if those warnings are not “widely publicized.”There is, of course, no guidance in the Snapchat settlement about which researchers companies are supposed to pay attention to, or which warnings they must quickly heed. Evidently, the FTC thinks that Section 5 requires app developers to proactively monitor the online community for possible security vulnerabilities. There is no analytical reason to limit this new expectation to app developers. As a result, the FTC risks creating considerable compliance costs for all kinds of companies, and not just mobile app companies.ADDITIONAL SECTION 5 VIOLATIONS – A CHECKLIST FOR MOBILE APP COMPLIANCEGeolocation. The complaint also alleges that the company deceived users about the amount of personal data it collected, and about the security measures in place to protect that data. Until February 2013, Snapchat’s privacy policy claimed that the app did not ask for, track, or access any location-specific information from users’ devices at any time. However, according to the FTC, Snapchat integrated a third-party analytics tracking service in October 2012 that collected users’ WiFi-based and cell-based location information from the app.Accessing contacts. The privacy policy further claimed that the app only collected users’ email, phone number, and Facebook ID for its “Find Friends” feature, which is a way to find other users of the app. But Snapchat collected the names and phone numbers of all contacts in the users’ mobile device address book who utilized the Find Friends feature.Reasonable security. The last count of the complaint alleges that the company failed to secure the Find Friends feature, both by: failing to verify that the phone number that a user entered did, in fact, belong to the mobile device being used by that individual; and by failing to implement restrictions on the number of Find Friend requests that any one account could make. Hackers were allegedly able to exploit flaws in the app’s security to access 4.6 million Snapchat usernames and phone numbers. In light of these vulnerabilities, the FTC alleged that the company’s representations about how it secures users’ data (e.g., “Snapchat takes reasonable steps to help protect your personal information”) were false and misleading as well.Privacy by design. As the FTC has made clear, developers must implement privacy-by-design by building privacy and security into the app’s structure from the outset. A privacy-by-design program should address privacy risks, protect the privacy and confidentiality of personal information, and provide policies and procedures sufficient to cover the nature and scope of the app and the sensitivity of the information collected.* * *The FTC’s allegations in the Snapchat complaint epitomize the FTC’s ongoing and broadening efforts to ensure that companies market their apps truthfully and protect user information. For an app to be in compliance with Section 5, it is clear that: (1) consumer controls must work for every consumer, every time, under all conditions and use cases, even ones that the developer is unaware of; (2) collection of information from users’ address books requires clear disclosure and an opt-out preference; and (3) representations about “reasonable” security create specific legal obligations to protect user data, just as representations about privacy create legal obligations to use information in a manner consistent with those representations.But given the way that the Snapchat app interacted with third-party apps, and the FTC’s allegations relating to those interactions, the Snapchat settlement also suggests that: (1) app developers need to pay attention to privacy and data-security bloggers, and promptly remedy bugs found by these third parties; and (2) representations about which data is or is not collected by an app must extend to third-party tools that can use information generated by the users of that app.CONCLUSIONThough in many ways the FTC’s complaint and consent order are similar to those the FTC has issued recently, the settlement is significant because of its breadth.The Snapchat app itself illustrates current expectations of consumer controls, as well as the notion of privacy as a marketable concept in its own right. The app’s popularity was driven by the idea of privacy itself as a desirable commodity. But, according to the FTC, the app couldn’t deliver on its unqualified promises, and that made it a fairly easy target for the FTC.As more app developers offer consumers privacy options, they need to be certain that they can live up to the promises they make, for every user, every time, under all conditions and use cases; follow researchers’ “warnings”; and understand all use cases continuously, because the FTC’s interest in mobile applications is not ephemeral.

Snap Judgment: FTC Alleges Snapchat Did Not Keep Its Privacy and Security Promises, But Suggests Broad New Duty in the Process

Snapchat’s recent settlement with the Federal Trade Commission (FTC) generally provides a comprehensive but not groundbreaking roadmap to the FTC’s privacy and 

Snap Judgment: FTC Alleges Snapchat Did Not Keep Its Privacy and Security Promises, But Suggests Broad New Duty in the Process

In the two years since the adoption of the JOBS Act, fundamental changes have developed in the IPO market and perhaps even more significant changes have resulted in the private or exempt offering market. During our session, which will take place at the Michelangelo Hotel in New York on May 8 from 8:30 – 10:00am,  we will review:<ul><li>The status of JOBS Act implementation;</li><li>IPO practices;</li><li>The proposed crowdfunding regulatory framework;</li><li>Up-Cs, two share class deals, and other innovations;</li><li>General solicitation—what is it? And why isn’t there more of it?</li><li>Verifying investor status;</li><li>Ongoing reporting versus Exchange Act reporting; and</li><li>Proposed legislation.</li></ul>Morrison & Foerster is offering participants 1.5 New York CLE credits for attendance.To register for the event, please email Alexa Powers at <a href="mailto:alexapowers@mofo.com">alexapowers@mofo.com</a>.

Complimentary JOBS Act Seminar

In the two years since the adoption of the JOBS Act, fundamental changes have developed in the IPO market and perhaps even more significant changes have resulte

Complimentary JOBS Act Seminar

In a much anticipated decision in the class action In re Hulu Privacy Litigation, U.S. Magistrate Judge Laurel Beeler of the U.S. District Court for the Northern District of California has shed new light on the meaning of “personally identifiable information” (PII) under the Video Privacy Protection Act (VPPA). This has important implications for companies that host videos on their websites and integrate their services with social media companies or web analytics service providers.The court held on summary judgment that the transmission to a third party of unique user IDs, in and of themselves, along with video viewing history, does not constitute disclosure of PII under the VPPA.In reaching its conclusion, the court distinguished between anonymous IDs that Hulu, LLC provided to the audience metrics company comScore, Inc. (which the court held were not PII) and a social networking service’s user IDs that Hulu provided to the social networking service (as to which the court held there were material issues of fact with respect to whether they could permit the identification of specific persons and thus be PII).The court granted Hulu’s motion for summary judgment with respect to the comScore disclosures but not with respect to the social networking service disclosures.KEY POINTSThe court’s decision shows that, when determining whether unique IDs associated with consumers’ online video viewing history are PII regulated by the VPPA, context matters.In particular, companies that transmit such information should be aware of several key points:<ul><li>First, the decision declined to impose VPPA liability for the disclosure of unique user IDs associated with video viewing history, where such IDs did not identify specific persons and where the record revealed only a hypothetical ability to correlate unique user IDs to specific persons but no evidence that it actually happened.</li><li>Second, the decision makes clear that companies should be mindful of the context in which they share unique user IDs with third parties, particularly with respect to whether the IDs permit the recipient or another party to identify specific persons, either directly or through information to which they already have access.</li><li>Third, the decision highlights the potential danger for companies that integrate social media plug-ins or other functionality on web pages where consumers watch videos. Companies providing online video services should consider taking steps to ensure that: (1) cookies and other data transmitted to another entity, such as a user ID that is matched with the video provider’s user ID for the same person, do not permit identification of specific individuals; and (2) video viewing history is not shared unintentionally, such as through a referrer URL that is transmitted during a standard browser request.</li><li>Finally, the decision highlights other important questions of fact that may exist when evaluating VPPA exposure, including whether the disclosing party had knowledge of the disclosure and whether the consumer consented to it.</li></ul>BACKGROUNDWith limited exceptions, the VPPA imposes liability—including liquidated damages of up to $2,500 per incident—on a video tape service provider that knowingly discloses, to any person, PII concerning any consumer of the video tape service provider. Liability extends to companies that provide online video services, such as Hulu, and the definition of PII includes “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”In this case, the plaintiffs alleged that Hulu wrongfully disclosed its users’ video viewing history to comScore and a social networking service. comScore had provided Hulu with audience metric data about Hulu’s users, and the social networking service had provided social networking features through placement of its “Like” button on Hulu’s video watch pages. Each company received different data from Hulu during the delivery of its services. Among other data, comScore received unique numerical Hulu User IDs and comScore User IDs, while the social networking service had access to its own first-party cookies containing its own unique user IDs. Each company also received the title of the video watched, either as a parameter in a set of data transmitted or in the referrer URL of the page on which the user viewed the video.ASSESSING THE LINK BETWEEN USER IDS AND SPECIFIC PERSONSIn its decision, the court addressed three different disclosures by Hulu:<ul><li>the disclosure to comScore of watch pages and Hulu User IDs;</li><li>the disclosure to comScore of the comScore User ID cookies; and</li><li>the disclosure to the social networking service of watch pages and the social networking service’s cookies.</li></ul>The key issue for the court was whether the disclosures of the video titles were tied to specific identified persons, such that they constituted prohibited disclosures of PII under the VPPA. The court stated that “the statute, the legislative history, and the case law do not require a name, [but] instead require the identification of a specific person tied to a specific transaction . . . .” Providing further explanation, the court stated that “a unique anonymized ID alone is not PII but context could render it not anonymous and the equivalent of the identification of a specific person.” In other words, context matters insofar as the circumstances link the unique user IDs to specific persons.In applying this reasoning, the court held that Hulu’s disclosure to comScore of watch pages and Hulu User IDs did not constitute disclosure of PII: despite the fact that comScore could have used the Hulu User IDs to access Hulu users’ profile pages and obtain their names, there was no evidence that it did so, and there was thus no disclosure of PII for purposes of the VPPA.The court next addressed Hulu’s disclosure to comScore of the comScore User ID cookies. The court explained that, although the comScore User IDs permitted comScore to conduct “substantial tracking that reveals a lot of information about a person,” the disclosure did not violate the VPPA because the tracking did not reveal “an identified person and his video watching.”On the other hand, the court suggested that disclosure of the social networking service’s own, first-party user IDs to the social networking service itself, together with video viewing history, may constitute disclosure of PII under the VPPA. The court noted that “[t]he Facebook User ID is more than a unique, anonymous identifier. It personally identifies a Facebook user. That it is a string of numbers and letters does not alter the conclusion.” In addition, the court emphasized that “a Facebook user—even one using a nickname—generally is an identified person on a social network platform” and that “[the Facebook User ID] identifies the Hulu user’s actual identity on Facebook.” Therefore, the court denied Hulu’s motion for summary judgment with respect to its disclosures to the social networking service.The decision with respect to the social networking service highlights the risk posed by integrations with social media companies on websites that host video services. Such integrations may cause a cookie or other data to be sent from a user’s browser without any affirmative action by the user, which could permit the social media company to identify a specific person and his or her video watch history—and thus trigger VPPA liability, although the court declined to make a decision on this aspect at this stage of the proceedings.In practical terms, this risk means that companies providing online video services should take steps to ensure that: (1) cookies and other data transmitted to another entity, such as a user ID that is matched with the video provider’s user ID for the same person, do not permit identification of specific individuals; and (2) video viewing history is not shared unintentionally, such as through a referrer URL that is transmitted during a standard browser request.OTHER POTENTIAL LIMITATIONS UNDER THE VPPA: “KNOWING” DISCLOSURE AND USER CONSENTThe court ruled that material issues of fact remained regarding whether Hulu disclosed the social networking service’s user IDs knowingly and without user consent. The court stated that “[o]ther cases involving violations of privacy statutes show that in the context of a disclosure of private information, ‘knowingly’ means consciousness of transmitting the private information. It does not mean merely transmitting the code.” Thus, the court stated that “if [Hulu] knew what [the social networking service’s cookies] contained and knew that it was transmitting PII . . . then Hulu is liable under the VPPA.” The court did not, however, grant summary judgment to Hulu based simply on the fact that Hulu’s servers could not read the social networking service’s cookies. Rather, the court held that other evidence may show that Hulu knew that the social networking service was receiving its own first-party user IDs within its cookies and was reading them together with video viewing history.Finally, the court also denied Hulu’s motion for summary judgment with respect to whether consumers had given consent to any disclosures through their acceptance of the social networking service’s privacy policy or whether such “consent,” if found, was sufficient under the VPPA.CONCLUSIONIn light of the court’s decision, companies that—without affected individuals’ VPPA-compliant consent—disclose any type of identifier, together with video viewing history, to any other person or company should pay very close attention to exactly what information they transmit and whether it could be used by the recipient to identify specific individuals.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

If You Host Videos on Your Website, Read This Blog Post Regarding the Video Privacy Protection Act

In a much anticipated decision in the class action In re Hulu Privacy Litigation, U.S. Magistrate Judge Laurel Beeler of the U.S. District Court for the Norther

If You Host Videos on Your Website, Read This Blog Post Regarding the Video Privacy Protection Act

In a case that could have a broad impact on how companies deliver content to consumers, the Supreme Court heard oral argument on April 22 in American Broadcasting Companies, Inc. v. Aereo, Inc. (No. 13-461).  At issue is whether Aereo’s service engages in public performances under the Copyright Act in transmitting broadcast television content to its subscribers’ wired and wireless devices.  While the Justices questioned both parties on a variety of issues, a clear focus for the Court was the potential impact of its decision on other technologies not at issue in this case.BackgroundAereo provides broadcast television streaming and recording services to its subscribers, who can watch selected programing on various Internet-connected devices, including televisions, mobile phones and tablets.  Aereo provides its service through individual antennas that pick up local television broadcast signals and transmit those signals to a server where individual copies of programs embedded in such signals are created and saved to the directories of subscribers who want to view such programs.  A subscriber can then watch the selected program nearly live (subject to a brief time-delay from the recording) or later from the recording.  No two users share the same antenna at the same time, nor do any users share access to the same stored copy of a program.In 2012, various broadcasting companies sued Aereo for copyright infringement in the Southern District of New York claiming, among other things, that Aereo’s transmission of the plaintiffs’ copyrighted content to Aereo’s subscribers violated the copyright owners’ exclusive right to publicly perform those works.  That public performance right, codified in the 1976 Copyright Act, includes (1) any performance at a place open to the public or any gathering with a substantial number of people outside the “normal circle of family and social acquaintances,” and (2) the transmission of a performance to the public whether or not those members of the public receive it in the same location and at the same time.  This latter provision, commonly referred to as the Transmit Clause, was added to the Copyright Act by Congress in part to overturn prior Supreme Court precedent that had previously allowed cable companies to retransmit broadcast television signals without compensating the broadcaster.The district court denied the broadcast companies’ preliminary injunction requests, finding that, based on Second Circuit precedent, Aereo’s transmissions were unlikely to constitute public performances.  The Second Circuit affirmed the decision, relying on the court’s earlier decision in Cartoon Network LP v. CSC Holdings, Inc., 536 F.3d 121 (2d Cir. 2008) (“Cablevision”), which found that a cable company’s remote-storage DVR system did not run afoul of the public performance right because each transmission was sent only to an individual user.  The Second Circuit held that Aereo does not engage in public performances because, as in Cablevision, Aereo’s system makes unique copies of every recording, and each transmission of a program to a customer is generated from that customer’s unique copy.Aereo has been sued by other broadcasters in other jurisdictions as well.  The District of Massachusetts reached the same result as the Second Circuit, while the District of Utah came to the opposite conclusion.  Further, both the D.C. District Court and the Central District of California have issued preliminary injunctions against FilmOn X, a company that offers a service similar to Aereo’s.Supreme Court Oral ArgumentA recurring theme during the oral argument was the impact the Court’s decision would have on other technologies and industries.  The Justices’ questions focused heavily on how their decision would affect other technologies, such as cloud computing and storage, how to balance technological innovation versus pure circumvention of copyright laws, and on how a decision against Aereo, were the Court to make such a decision, could be squared with the Second Circuit’s Cablevision opinion.Effect on Other TechnologiesJustices Stephen Breyer and Sonia Sotomayor led off the discussion over the expected impact of the Court’s decision on other technologies.  Justice Breyer plainly stated: “And then what disturbs me on the other side is I don’t understand what a decision for [Aereo] or against [Aereo] when I write it is going to do to all kinds of other technologies.”  Justice Samuel Alito echoed this sentiment when he remarked: “I need to know how far the rationale that you want us to accept will go, and I need to understand, I think, what effect it will have on these other technologies.”Neither party had a clear response that seemed to ease the Court’s concerns.  The broadcasters sought to distinguish Aereo’s technology from cloud storage by pointing out that the cloud storage companies provide a “locker” for users to store their own rightfully owned content, and at times urged the Court to avoid the issue of cloud storage altogether—although the Court seemed unsure of how to accomplish that.  Aereo stirred the pot by pointing out that a decision finding that the performance of content stored by a third party constitutes a public performance could result in “potentially ruinous liability” for the cloud storage companies.  Several other companies and technologies were identified by name during the arguments, including Netflix, Hulu and Roku.While the early discussion seemed to focus on how the Court could find Aereo’s service a public performance without broader ramifications to the industry, most of the Court’s questions did not portend how the Court would ultimately rule.  The Court, however, was undoubtedly cognizant that the decision could have an impact beyond the dispute at issue.Questioning the Merits of the TechnologyChief Justice John Roberts questioned both parties on the technological aspects of Aereo’s service, first pointing out to the broadcasting companies that “[y]ou can go to Radio Shack and buy an antenna and a DVR or you can rent those facilities somewhere else from Aereo.  They’ve—they’ve got an antenna.  They’ll let you use it when you need it and they can, you know, record the stuff as well and let you pick it up when you need it.”The broadcasters responded that allowing Aereo to take “a performance off the airwaves and transmit it to all the end-users” contradicts Congress’s specific intent when it enacted the Transmit Clause in response to cable providers’ prior transmissions of content without compensating the content owners.Chief Justice Roberts then questioned Aereo as to the motive behind Aereo’s multi-antenna set-up stating: “I mean, there’s no technological reason for you to have 10,000 dime-sized antenna, other than to get around copyright laws.”  Justice Antonin Scalia followed up with “is there any reason you did it other than not to violate the copyright laws?”According to Aereo, “All Aereo is doing is providing antennas and DVRs that enable consumers to do exactly what this Court in Sony [Corp. of America v. Universal City Studios, Inc.] recognized they can do when they’re in [their] home and they’re moving the equipment . . . .”  Aereo distinguished itself from cable providers by the scope of content they provide (only content available over public airwaves) and how it is provided (upon a user’s initiation).Distinguishing CablevisionThe Court also inquired as to how Aereo’s service differs, if at all, from the remote-storage DVR service provided in Cablevision.  Justice Anthony Kennedy, in particular, seemed reluctant to reach a decision that effectively overruled Cablevision, even asking the broadcasting companies to “assume that Cablevision is our precedent.”  The broadcasting companies attempted to distinguish Aereo’s service from the service in Cablevision by pointing out that the defendant in Cablevision paid royalties to carry programming in the first instance, whereas Aereo does not pay any royalties.In any event, while the outcome of the case is as yet undetermined, it remains to be seen how any decision will impact other existing technologies and serve as a guide to innovators on crafting future technologies to avoid copyright infringement liability.A decision is expected by the end of June.

Which Way is Aereo Pointing? The Supreme Court Hears Arguments in Public Performance Copyright Case

In a case that could have a broad impact on how companies deliver content to consumers, the Supreme Court heard oral argument on April 22 in American Broadcasti

Which Way is Aereo Pointing? The Supreme Court Hears Arguments in Public Performance Copyright Case

When most Americans think of drones, they think of unmanned, often weaponized aircraft that are used by governments in areas of conflict for intelligence or combat purposes.  However, the proverbial sky is the limit on the potential commercial use of drones.  For example, in a December 2013 60 Minutes interview, Jeff Bezos, the founder of Amazon.com, <a href="http://www.cbsnews.com/news/amazons-jeff-bezos-looks-to-the-future/">described</a> his company’s efforts to develop GPS-programmed, autonomous drones (or in his words, “octocopters”) to serve as “delivery vehicles” to provide half-hour delivery of your future Amazon order.  Although there will be hurdles to the widespread commercial adoption of drones as the Federal Aviation Administration works out the regulatory issues surrounding the licensing and use of drones in our airspace, our not-too-distant future could involve a world in which drones are literally buzzing above our heads.Drones are, among other things, unmanned, light, easy to deploy and relatively cheap.  As a result, companies could use drones for numerous purposes, including scientific research and exploration, monitoring livestock or gas pipelines, remote troubleshooting of technology, finding lost shipments or even as a substitute for the Super Bowl blimp.  Because of advances in camera, video and audio technology (and the decreasing cost of that technology), however, drones could also be used to collect and communicate massive amounts of information about individuals and their everyday lives.  Imagine a company taking its drones out for a spin on a Saturday morning in your town to conduct market research, observing how the average person mows the lawn, when the average person goes to grab coffee or how many bags of groceries the average person leaves with from the supermarket.  Or, imagine a company flying a drone around its factory or retail location to monitor when its employees go on break or what end-caps its customers gravitate to or avoid.  As is true with many new technologies, drones raise complex and often troubling privacy issues (remember your first cell phone…it didn’t have a camera or location services, right?).In fact, it’s safe to say that many Americans would view the commercial use of drones with suspicion.  Consistent with those suspicions, state legislatures have begun scratching the surface on some of the privacy implications of drones.  Over the past two years, legislatures in almost every state have considered some form of legislation. As of today, at least twelve states have enacted laws regulating the use or licensing of drones.  Many of these laws are focused on limiting government and law enforcement activities.  See, e.g., the Florida Freedom from Unwarranted Surveillance Act, Fla. Stat. § 934.50; the Illinois Freedom from Drone Surveillance Act, 725 Ill. Comp. Stat. §§ 167/1–167/35.  Other laws have a more unique focus, including an Illinois law criminalizing a person from committing “hunter or fisherman interference” by knowingly “us[ing] a drone in a way that interferes with another person’s lawful taking of wildlife or aquatic life.”  720 Ill. Comp. Stat. § 4/48-3.However, several new state “drone” laws are clearly intended to address privacy concerns beyond those raised in government and law enforcement contexts, and could impose limitations on a company getting drones off the ground for commercial purposes.  For example, an Idaho law, effective July 1, 2013, prohibits any person from using a drone “to intentionally conduct surveillance of . . . or collect information about, or photographically or electronically record specifically targeted persons or specifically targeted private property.”  Idaho Code § 21-213(2)(a).  In fact, the Idaho law would require that a company first obtain an individual’s written consent to use a drone to collect information about an individual or that individual’s dwelling.  Idaho Code § 21-213(2)(a)(i).  The Idaho law also imposes a written consent requirement for the public dissemination of any photograph or recording of an individual obtained by a drone.  Idaho Code § 21-213(2)(a).Similarly, a Texas law, effective September 1, 2013, criminalizes and creates a private right of action for the use of a drone “to capture an image of an individual or privately owned real property . . . with the intent to conduct surveillance on the individual or property” or to possess, disclose or otherwise use such images.  Tex. Gov’t Code §§ 423.003, 423.004.  Although the Texas law includes nearly 20 exceptions to this broad prohibition, including permitting the collection of images with the consent of the individual who owns or lawfully occupies the real property captured in the image, these exceptions are largely limited to government, law enforcement and energy-related purposes.  See Tex. Gov’t Code § 423.002.In addition, an Oregon law provides a private right of action for any person who owns or lawfully occupies real property against a person that “operates a drone . . . flown at a height of less than 400 feet over the property if” that operator has previously flown a drone over the property at a similar low altitude and the owner/occupant of the property notified the operator that she “did not want the drone flown over the property at a height of less than 400 feet.”  Ore. Rev. Stat. § 837.380.  That is, the Oregon law essentially creates a low-flying drone “opt out,” if you will.Implications for BusinessAs state legislatures continue to grapple with the privacy implications of drones, it is safe to say that the Idaho, Texas and Oregon laws will not be the last state laws that impose privacy requirements or limitations that would apply to the commercial use of drones.  As with the underlying technology, this will continue to be a rapidly changing legal front.  Because drones have not yet been adopted in this country for commercial purposes in any meaningful way, your company likely has not begun considering how it could use drones in the future in its day-to-day operations.  However, as noted above, the proverbial sky is the limit.  Inevitably, many companies will consider whether they have any viable use of drones.  If you are asked about the legal implications to your company, it will be critical to be mindful of potentially applicable state limitations.  Moreover, you will have to revisit and consider any privacy policies or other public statements your company has made regarding if, when and how the company collects information about consumers and how it uses and discloses that information.

taylor_nathan_blog_150x150.png

taylor_nathan_common_640x280.jpg

taylor_nathan_heroretina_2700x1160.jpg

taylor_nathan_mobileretina_750x1040.jpg

taylor_nathan_social_600x600.jpg

Recognized as an authority on financial privacy issues, Nathan helps financial institutions and other companies develop practical solutions for complying with privacy and data security laws. In partic

Nathan D. Taylor

Nathan Taylor

Next Generation State Privacy Law: Regulating the Commercial Use of Drones