Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

2024 Recap: Ten Lords A-Leaping!

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

The Better Business Bureau’s Online Interest-Based Advertising Accountability Program (“the Accountability Program”) issued its first ever compliance warning on October 14, a move that is intended to clarify the obligations of websites where data are gathered for Online Behavioral Advertising (“OBA”) purposes.  The result is that operators of such websites are now expected to ensure that consumers receive “enhanced notice” under the Principles, and cannot simply rely in all instances on third parties, such as ad networks, to bring the websites into compliance with the Principles by displaying such notice within OBA ads appearing on the operators’ websites.  Failure to meet this requirement can result in an enforcement action by the Accountability Program beginning on January 1, 2014.The Accountability Program’s compliance warning concludes its investigation into whether a number of websites were in compliance with the Digital Advertising Alliance (“DAA”) <a href="http://www.aboutads.info/resource/download/seven-principles-07-01-09.pdf">Self-Regulatory Principles for Online Behavioral Advertising</a> (the “Principles”) as it relates to first-party obligations (that is, obligations for websites with whom the consumer is interacting, as opposed to ad networks and others, which are generally referred to as “third parties” in the Principles).  According to the Accountability Program, a significant minority of website operators otherwise in compliance with the Principles were not providing “enhanced notice” on every web page where data is collected for interest-based advertising by third parties. (Although the warning focuses on compliance in the context of third-party collection of data for OBA, the requirements also apply in cases where a website operator collects data on its own webpage and transfers the data to a third party for use for OBA purposes on non-affiliate webpages.) This type of notice—in addition to the notice regarding delivery of interest-based advertisements that is commonly provided within the OBA ads themselves—is, according to the Accountability Program, also required by the OBA Principles, at least on those pages where data are collected for OBA purposes but where no such OBA ads bearing the enhanced notice appear.According to the Accountability Program, many companies are “genuinely confused” about their first-party notice obligations under the principles.  Hence the compliance warning, rather than a set of case decisions, which explains that the Transparency Principle of the OBA Principles requires websites to provide notice outside of their privacy policies whenever third parties collect a consumer’s browsing activity for OBA purposes.  As the compliance warning puts it, the Transparency Principle “shines a light on interest-based advertising whenever and wherever it is occurring online.”  This includes the collection of information regarding browsing activities by third parties for their use in interest-based advertising—not just the actual delivery of interest-based ads.Simply put, this compliance warning makes clear that under the DAA’s OBA Principles, first parties have a responsibility to make sure that consumers are aware that OBA activities are occurring on the website, whether by third parties displaying it in or around OBA ads on the website, or on pages where OBA ads are not delivered, by the first party itself.   Since the Accountability Program will start enforcing this requirement on January 1, 2014, websites that allow third parties to collect information for OBA purposes will need to have in place a separate notice mechanism.How to ComplyFirst parties can comply with this requirement by:(1) using a “clear, meaningful, and prominent link” on the website itself (the “enhanced notice link”—this is separate from the privacy policy link, and can be the AdChoices Icon or a text link); which(2) takes the user to the first party’s disclosure of OBA activity, such as the specific portion of the first party’s website that addresses OBA activity; which itself must either: (a) point to an industry-developed Web page such as the DAA’s Consumer Choice Page (e.g., <a href="http://www.aboutads.info/choices">www.aboutads.info/choices</a>); or(b) individually list all third parties engaged in OBA on the website, with links to the choice mechanisms regarding the collection and use of data for OBA for each applicable third party. (The new warning cautions that any website operator that chooses to individually list each third party collecting data for OBA on its website must provide an accurate, up-to-date and comprehensive list, which in practice requires sufficient technical and/or contractual safeguards to prevent unauthorized third parties from engaging in OBA collection.)  Website operators that provide an individual list need to make sure that it is accurate and up-to-date, and that there are no unauthorized third parties engaging in OBA data their websites.Website operators are now on notice that the DAA’s transparency and choice principles for OBA require more than enhanced notice for the delivery of OBA advertisements.  According to the compliance warning, the only way a website operator could be in full compliance without providing the information described above is if OBA ads bearing in-ad notice are served on every page of the website where third parties are also collecting data for OBA—and, even then, those in-ad notices would have to provide information on all third parties collecting data on the website.

A Warning for Websites Allowing Data Collection for Online Behavioral Advertising

The Better Business Bureau’s Online Interest-Based Advertising Accountability Program (“the Accountability Program”) issued its first ever compliance warning on

A Warning for Websites Allowing Data Collection for Online Behavioral Advertising

istock_000022033393illustra-300x300.jpg

The Guide to Social Media and the Securities Laws

Website Operators Await Final Guidance Regarding Compliance With California’s “Do-Not-Track” Disclosure Requirements

REGULATION FD Beginning in 1999 and continuing into 2000, media reports about selective disclosure of material nonpublic information by issuers raised concerns 

The Guide to Social Media and the Securities Laws

Sign offered by <a href="http://stopthecyborgs.org/">Stop the Cyborgs</a> to indicate a ‘no-Glass’ zone. This work is licensed under a <a href="http://creativecommons.org/licenses/by-nc-nd/3.0/deed.en_US">Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License</a>.What Is Google Glass?As most Socially Aware readers know, Google Glass (“Glass”) is a form of <a href="http://upload.wikimedia.org/wikipedia/en/thumb/0/04/GeordiLaForge.jpg/250px-GeordiLaForge.jpg">wearable technology</a> that gives its users hands-free access to a variety of smartphone features by attaching a highly compact <a href="http://electronics.howstuffworks.com/gadgets/other-gadgets/VR-gear1.htm">head-mounted display</a> system to a pair of specially designed eyeglass frames. The display system connects to a smartphone via Bluetooth. In its current form, Glass can pull information from the web, take photographs, record videos, send messages via email or SMS, notify its user about messages and upcoming events and provide navigation directions via GPS. An embellished demonstration of Glass’s features is available at Google’s Glass <a href="http://www.google.com/glass/start/how-it-feels/">web page</a>.Although Glass is in the testing stage as of the time of this writing and boasts only a modest set of features, the device has caused quite a stir in both the mainstream and social media spheres. Wearable technology, however, has been around for quite a while (for an extensive history of wearable computers, pay a visit to Paul Miller’s <a href="http://www.theverge.com/2012/6/26/2986317/google-project-glass-wearable-computers-disappoint-me">article</a> on The Verge) and, although controversial, many of the concerns raised by Google Glass are not entirely new. This post will explore some of the more common concerns raised about Glass in the context of evolving legal and social norms—all premised on the assumption that Glass eventually will ultimately become a widely used, mainstream product.Glass and PrivacyWhen the original Kodak cameras were released in the late 19th century, they caused a huge uproar among both lawmakers and consumers for their ability to do what they are designed to do: that is, <a href="http://continuum.wikia.com/wiki/Cellular_Memory_Review">take pictures</a>. This led to widespread bans on cameras at beaches, the Washington Monument and other locations. Samuel Warren and Justice Louis Brandeis aptly noted in an 1890 Harvard Law Review article:Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good the prediction that “what is whispered in the closet shall be proclaimed from the house-tops.” For years there has been a feeling that the law must afford some remedy for the unauthorized circulation of portraits of private persons[.]As Kodak cameras became more mainstream, society adapted by creating new laws, one of the most important of which was development of the “<a href="http://www.law.cornell.edu/supct/html/historics/USSC_CR_0389_0347_ZC1.html">reasonable expectation of privacy</a>” doctrine, which purports to protect individuals from being photographed in certain places recognized as “zones of privacy”—a designation that does not typically extend to public places.Needless to say, Glass is made of more <a href="http://www.youtube.com/watch?v=JknRYYrV5Vk">advanced technology</a> than the original Kodak cameras, and this new technology raises a whole new set of potential concerns. In particular, (1) taking a photograph with a traditional <a href="http://upload.wikimedia.org/wikipedia/commons/5/53/Box_Camera.jpg">camera</a> is typically more noticeable to subjects and onlookers alike than taking a photograph with a “wearable” device like <a href="http://www.youtube.com/watch?v=j8lScHO2mM0">Glass</a>, and (2) the Bluetooth connection between Glass and its user’s smartphone allows the possibility of <a href="http://www.youtube.com/watch?v=EVSkhYHk6TQ">real-time facial recognition</a>.In part due to these concerns, on May 16, 2013, a bipartisan caucus of congressmen sent Google an <a href="http://www.scribd.com/doc/141962016/Congress-Inquires-About-Google-Glass">inquiry</a> regarding a variety of privacy matters. In response to that inquiry, Google <a href="http://www.forbes.com/sites/petercohan/2013/06/03/google-shivs-developers-by-nixing-glass-facial-recognition/">announced</a> on June 3, 2013, that it would not allow applications with facial recognition on Google Glass. (Naturally, hackers have thumbed their noses at Google’s announcement, reportedly building their own unauthorized software with facial recognition features.)Although banning facial recognition apps may address the second concern noted above, the first concern still stands because people being photographed by a Glass wearer, whether in a “zone of privacy” or in a public place in which there is no reasonable expectation of privacy, simply might not even know it. A handful of establishments have responded by <a href="http://www.nytimes.com/2013/05/07/technology/personaltech/google-glass-picks-up-early-signal-keep-out.html?smid=pl-share">preemptively banning</a> the device from their premises. Seattle’s 5 Point Café was, perhaps, the first to issue such a ban, <a href="http://arstechnica.com/gadgets/2013/03/seattle-bar-bans-google-glass-still-loves-beer-goggles/">announcing</a> via Facebook back in May 2013, “For the record, The 5 Point is the first Seattle business to ban in advance Google Glasses. And a** kickings will be encouraged for violators.” Colorado’s Press Play Bar followed with <a href="http://laughingsquid.com/sign-at-bar-reads-google-glass-is-banned-on-these-premises/">its own ban</a> in July 2013. And <a href="http://www.huffingtonpost.com/2013/08/20/guantanamo-google-glass_n_3787042.html">Guantanamo</a> has banned Google Glass.Only time will tell whether one-off bans on Glass and similar devices are akin to the overreactions—at least we now perceive them to be overreactions—that inspired bans on Kodak cameras in the late 19th century. And, perhaps preemptively, Glass already limits a user’s ability to take photos to cases in which the user either speaks an audible command or makes a visible swipe on the device’s tactile sensor, and limits video recordings to 10 seconds in length without a user holding onto the tactile sensor. Of course, developers have already created an <a href="http://www.theverge.com/2013/5/2/4292594/google-glass-winky-app-take-photo-with-eye-gesture">app</a> that lets users take pictures by simply winking. Glass’s entrance into the mainstream is poised to cause further disruption.Breaking the CasinoIn the 1960s, a group of UCLA and MIT graduate students created a “cigarette pack sized analog device” that increased the expected gain of playing roulette by 44%. The theory behind the device was to feed data concerning the motion of the roulette wheel and ball to a primitive computer that would predict the likely location of the ball’s drop. The premise of such a device was featured more recently in an <a href="http://www.imdb.com/title/tt0534719/">episode</a> of the popular television show <a href="http://www.cbs.com/shows/csi/">CSI</a>, in which (again) a pair of students created a device that would send video data from the casino back to an off-site computer run by one of the students, who would then relay the predictions back to the player on-site.The possibility of improving gamblers’ odds over the house’s odds goes further than just roulette. For instance, with the assistance of a computer, even average blackjack players could accomplish feats reserved for the most skilled card counters; this is why Nevada gaming regulators issued an <a href="http://arstechnica.com/apple/2009/02/casino-operators-issue-warning-over-iphone-card-counting-app/">alert</a> to casino operators in February 2009, warning them about the use of a then newly released simple card counter app. Wearable computers at the poker table can even be used to transmit hand information from one play to another, enabling collusion.Perhaps it’s only natural that casino operators are fearful of Google Glass. The Associated Press <a href="http://news.yahoo.com/nv-regulators-urge-ban-google-145001701.html">reported</a> on June 12, 2013, that the Nevada and New Jersey Gaming Commissions have urged casinos to ban gamblers from wearing Google Glass on their premises. Some casino operators, such as Caesar’s Palace, have <a href="http://www.pressofatlanticcity.com/business/regulators-say-atlantic-city-casinos-can-ban-google-glasses-with/article_c8ffdec6-cd62-11e2-98b0-0019bb2963f4.html">already forbidden</a> their customers from wearing Glass while in their casinos, and Delaware has <a href="http://www.businessweek.com/ap/2013-07-12/delaware-casinos-ban-google-glass">banned</a> Glass from its own casinos. None of this is surprising, given casinos’ long history of taking strong measures to prevent players from gaining an edge over the house. And given the level of deference that state gaming commissions afford casinos in limiting the use of electronics on their premises, Glass is likely to be unwelcome at gambling houses for the foreseeable future.Safety While DrivingIn February 2013, <a href="http://www.google.com/about/company/facts/management/">Sergey Brin</a>, Google co-founder and Glass developer, commented during a segment of TED Talks that one of Project Glass’s goals was to change how people interact with their smartphones. According to Brin, the goal is to “free your hands” and “free your eyes” by limiting the need to look down at a phone screen. One Glass feature that best embodies this goal is <a href="http://www.youtube.com/watch?v=IZdkIVS53Uw">turn-by-turn navigation</a>.In its current iteration, Glass’s turn-by-turn navigation is relatively simple, capable only of providing pop-up notifications of upcoming turns. In the future, Glass may be capable of <a href="http://www.theverge.com/2012/6/26/2986317/google-project-glass-wearable-computers-disappoint-me">layering</a> information over a user’s peripheral vision, and even augmenting that information with information from the web. Yet, even in light of the device’s relatively simple set of current navigational features, the possibility of using Glass while driving has caused plenty of stir.Daniel Simons and Christopher Chabris, psychology professors at the University of Illinois and Union College, respectively, explored the potential safety concerns arising from using Glass while driving in a May 24, 2013 <a href="http://www.nytimes.com/2013/05/26/opinion/sunday/google-glass-may-be-hands-free-but-not-brain-free.html?_r=1&">New York Times op-ed piece</a>. Simons and Chabris argue that people are fundamentally incapable of looking away from where they’re headed for more than a couple of seconds without losing their bearings. Drivers “intuitively grasp” this limitation by only glancing at the car radio or speedometer briefly before returning their eyes to the road. (Meanwhile, other distractions have been shown to be far more dangerous; the op-ed cites a study that demonstrated that drivers who texted with their mobile devices looked away from the road for as long as 4.6 seconds during a given six-second period, more than sufficient time to cause a major accident.)Glass tries to circumvent this limitation by only displaying turn-by-turn information at relevant times, that is, just before turns that are coming up, as demonstrated in <a href="http://www.youtube.com/watch?v=IZdkIVS53Uw">this video</a>. Still, Simons and Chabris believe that it will be a challenge to find the right balance of information that can be safely displayed directly in drivers’ fields of vision.Safety concerns like these are the motivation behind West Virginia State Rep. Howell’s <a href="http://edition.cnn.com/2013/03/25/tech/innovation/google-glass-driving">proposed legislation</a> that would amend driving laws to prohibit “using a wearable computer with head mounted display” while driving. Delaware’s lawmakers have introduced <a href="http://www.nydailynews.com/news/national/google-glass-wearable-computers-pose-driving-hazard-article-1.1397898">similar legislation</a>. And according to <a href="http://www.theguardian.com/technology/2013/jul/31/google-glass-drivers">some</a> reports, the UK <a href="https://www.gov.uk/government/organisations/department-for-transport">Department for Transport</a> is considering its own ban on using Google Glass while driving.It is unclear whether a blanket legal ban on head-mounted displays is the best approach to maximize safety. Arguably, Glass may strike the right balance by providing drivers with the same information they would typically retrieve by glancing down at a GPS system—without making drivers look away from the road. Head-mounted systems like Glass could be also used as a sort of “warning system” that alerts drivers that they are, say, approaching the speed limit, again without having to look down at separate speedometers. On the other hand, any guidelines for when and how head-mounted displays like Glass can be used on the road would probably need to be both granular and flexible to accommodate what will undoubtedly be a rapidly evolving technology.The FutureCan you envision the first time someone uses Glass to surreptitiously record a feature film at the local multiplex? According to Fast Company, a VP at the <a href="http://www.natoonline.org/" target="_blank" rel="noopener">National Association of Theatre Owners</a> has imagined just such a situation and says that his group anticipates working with its hundreds of members to develop Glass usage policies for their theaters. Can you picture the first time someone uses Glass to record a concert whose producer or venue enforces a strict “no videotaping” policy, or to secretly photograph sensitive documents containing trade secrets? Or the first time someone is wearing Glass while committing a crime? How will workplaces handle Glass, whether worn by visitors or used by their own employees on or off the job?Countless situations are going to be influenced by Google Glass and similar wearable technologies. And given the range of issues that have already arisen in beta, these technologies’ impact on laws and social norms is bound to be more than just a matter of where you can or can’t wear your Glass.

google-glass-ban4-225x300-1.png

Peering Into the Future: Google Glass and the Law

Peering Into the Future: Google Glass and the Law

Sign offered by Stop the Cyborgs to indicate a ‘no-Glass’ zone. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported L

California’s AB 370, if signed by Gov. Jerry Brown, would be the first piece of legislation in the world directly addressing “do not track” (DNT) to become law. It has passed both houses of the California Legislature and would likely take effect in January. The bill, which would amend California’s existing Online Privacy Protection Act (CalOPPA), requires website operators to explain how they respond to DNT signals or “other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party Web sites or online services, if the operator engages in that collection.” See Cal. Bus. & Prof. Code §§ 22575(5).Like California’s data breach notification law, this would be a disclosure law, not a law creating new consumer rights or imposing substantive requirements on companies. That said, like the data breach notification law before it, its aim seems to be to pressure companies to make substantive changes (here, by responding to DNT signals; in the case of the breach notification law, by developing better data security practices to reduce the frequency of embarrassing disclosures).Because CalOPPA applies to any website, online service or (according to the California Attorney General) mobile application that collects personally identifiable information from “consumers residing in California” (each, a “Site”), the law, if enacted, would have a de facto nationwide reach. As a result, while there have been rumblings about federal DNT legislation, California would set a new nationwide disclosure standard.The big question, however, is what exactly Site operators would need to disclose. The challenge they would face is made particularly acute by the fact that the meaning of DNT is not clear, nor clearly defined, in the law itself or by industry, despite more than two years of negotiations at the World Wide Web Consortium (W3C).WHAT IS CALOPPA? CalOPPA currently requires Site operators to post a privacy policy that does the following:• Identifies the categories of personally identifiable information collected;• Provides a description of the process for an individual consumer who uses or visits a Site to review and request changes to his or her personally identifiable information that has been collected, if the Site offers such a process;• Describes the process by which consumers will be notified of material changes to the privacy policy; and• Identifies the effective date of the policy.AB 370 AND “DO NOT TRACK” Assuming the Governor signs AB 370—and it survives near certain legal challenges—Site operators will need to: (1) explain in their privacy policies how they respond to web browser DNT signals and (2) disclose applicable third-party data collection and use policies.Before getting into the nuts and bolts of the new disclosure requirements, it might be helpful to step back to look at exactly what DNT is—or is intended to be. The idea behind a DNT mechanism is that it should provide consumers with an easy means to control the tracking of their online activities. DNT is technically straightforward. When a DNT preference is enabled in a device browser or mobile app (including if it is enabled by default), the “DNT:1” header is transmitted to the requesting server along with other header information. DNT is intended to be an expression of the user’s preferences regarding online tracking; however, the actual meaning of DNT—and what “honoring” DNT means—has been a considerable obstacle to its implementation. In other words, once the DNT header is received, what is the receiving server supposed to do?For more than two years, a W3C working group has struggled with these issues. The collection and use of data by the Site the user is on (i.e., the first party Site) may not be covered by the DNT opt-out. But what about third parties? The latest W3C working draft would bar third-party data collection, use and sharing upon receipt of the DNT:1 header unless such collection, use or sharing falls into an exception, such as fraud detection, marketing research or analytics—and even those exceptions were vigorously contested. With the W3C process currently stalled and without a leader, California has entered the fray, albeit without attempting to address these difficult and disputed questions.WHAT DOES THE NEW “DO NOT TRACK” DISCLOSURE MEAN FOR SITE OPERATORS? The amended CalOPPA would require Site operators to explain in their privacy policies how they respond to DNT signals or “other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party Web sites or online services, if the operator engages in that collection.” See Cal. Bus. & Prof. Code § 22757(5).The problem is what to say in order to comply with this requirement. Sites face the lack of a clear definition of what exactly DNT entails, and thus of how exactly to disclose their response to DNT signals. For now, it would be a mistake to represent that one “honors” DNT signals because that representation may be interpreted to mean more than the company’s actions warrant. Assuming the bill takes effect, it would be best, for the time being, to comply with the facts: if your Site engages in activities triggering the required disclosure, do you do anything in response to the DNT:1 header? If not, say so. The law requires only a disclosure. If, on the other hand, you do something in response to receipt of a DNT:1 disclosure, say exactly what you do (e.g., do you continue to collect data but stop the creation of profiles for online behavioral advertising purposes?). This is a disclosure law, not a law establishing new consumer rights, and it can be breached by failure to disclose, or to disclose accurately, the required information.The required disclosure may be made by link within an operator’s privacy policy “to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that [do not track or other] choice [mechanism].” See id. § 22575(7). That is, there can be some central website or entity—perhaps even an industry self-regulatory website—that can provide an industry-wide response to the DNT question.Finally, AB 370 addresses third-party data sharing. It would require Site operators to disclose “whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service.” See id. § 22575(6). In other words, an operator must inform users about the data collection and use practices of other entities on its own Site, if those entities are also collecting data on different websites over time.Since AB 370 simply expands the requirements of CalOPPA, the rest of the current CalOPPA regime will presumably apply. That means that Site operators will have violated the revised statute only if they fail to post a compliant privacy policy within 30 days of notice of non-compliance. Furthermore, while there is no private right of action, the California Attorney General can enforce the law. Any penalties for a violation would be under the California Unfair Competition Law, which imposes a maximum civil penalty of $2,500 per violation.While California has not by legislative fiat defined DNT or what honoring DNT means in terms of data collection and use, the prospect of new CalOPPA disclosure requirements certainly creates an additional incentive for the players in the online ecosystem to reach a consensus on what honoring DNT means. In the meantime, Site operators will have to be careful to avoid promising something that they cannot honor, if only because they cannot define it.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

istock_000017199405large-300x200.jpg

“Do Not Track” Comes to CalOPPA

California’s AB 370, if signed by Gov. Jerry Brown, would be the first piece of legislation in the world directly addressing “do not track” (DNT) to become law.

“Do Not Track” Comes to CalOPPA

Today’s consumers want to engage in a new way with the companies from which they buy goods and services.  Although some UK financial services organisations are leading the way in terms of their use of social media, on the whole, engagement in social media by UK financial services firms is still relatively limited. This is particularly evident when compared against activity in other sectors and when compared against the level of social media engagement by U.S. and Asian firms. Are legal and regulatory concerns to blame?Current State of MarketHow financial services (FS) organisations engage with social media can help differentiate them from their peers. Particularly when dealing with younger consumers such as the student market, FS organisations need to engage with consumers in the most effective way, which could be by placing a topical blog on Pinterest, a fun video on YouTube or interacting with consumers via Twitter or Facebook (rather than running a traditional print or broadcast campaign). Simply having a Twitter account or Facebook page which pushes out information is no longer enough. Genuine interactive engagement is what consumers are looking for and is the key to the most successful social media strategy.The best users of social media in the FS sector appreciate that harnessing of social media is as much about raising your brand profile, as promoting specific products or services. Consider the huge success of Comparethemarket.com’s <a href="https://twitter.com/Aleksandr_Orlov">Russian meercat brand ambassador </a>who has almost 60,000 followers on Twitter. Also, consider that the winner of the Shorty Award 2013 for Best Use of Social Media for Financial Services  was Citi for its Citi-Connect: Professional Women’s Network on Linked-In. Neither of these campaigns directly relates to the products and services offered by the relevant firm, but both have been very successful in terms of brand awareness. Social media can also be used to good effect to highlight organisations’ corporate social responsibility and philanthropy initiatives – to help counteract the ‘fat cat’ perception of bankers and financiers. Given that social media enables disgruntled consumers to find a louder voice and journalists are increasingly using social media to get stories, firms need to use social media to try to change the online conversation about their organisations. In fact, the best social media strategies can go beyond engaging consumers and actually convert them into advocates for a brand. The perceived benefits of brand advocacy are huge. According to research, recommendations from personal acquaintances or opinions posted by consumers online are the most trusted forms of advertising. But social media is not just a marketing tool – it can bring wider business value. For example, it can be used in recruitment, customer insights, research and development, issue/crisis management and customer services.  (It is also worth pointing out that social media is not just for retail banks and consumer-focused FS firms. It can also be harnessed by firms in the B2B sector. For example, some companies are creating networking and educational communities for their target audience (e.g. SMEs, IFAs, etc.) within more business-focused social media platforms such as LinkedIn.)However, despite the myriad of opportunities that social media offers and the size of the UK FS sector compared to other sectors, the use of social media by FS organisations still appears to be in its infancy. The reluctance by UK financial organisations to fully engage with social media may be down to general conservatism on the part of the sector, a fear of public dialogue with customers and a lack of understanding and expertise in-house in terms of social media and its value. However, it also appears in no small part to be down to uncertainty as to the application of financial laws and regulations to social media. So, what are the legal and regulatory considerations that UK FS organisations have to consider when embarking on a social media strategy and, with the recent replacement of the Financial Services Authority (FSA) by the <a href="http://www.fca.org.uk/">Financial Conduct Authority</a> (FCA) and the <a href="http://www.bankofengland.co.uk/pra/Pages/default.aspx">Prudential Regulatory Authority</a> (PRA), will we see any change?Financial RulesIn the U.S. various regulatory guidance, including from FINRA, FFIEC and the SEC, on the use of social media has been published. However, to date, in the UK, there has been very limited regulatory guidance regarding social media and the FCA has recently reiterated that it has no current plans to issue any further guidance on the basis that it believes that its rules are media neutral. So it remains up to firms to evaluate their activities carefully against the applicable rules. Some of the key issues for firms to consider include the following.Principles for BusinessIn terms of overarching obligations, when operating online, a firm must pay attention to the fundamental principles contained in the <a href="http://www.fshandbook.info/FS/html/FCA/PRIN/2/1">FCA Handbook</a>, in particular, to treat customers fairly and provide information that is clear, fair and not misleading.Communications and PromotionsFirms need to ensure that all social media activities comply with the applicable rules concerning communications and promotions (“FCA Promotion Rules”). Per Section 21 of the <a href="http://www.legislation.gov.uk/ukpga/2000/8/contents">Financial Services and Markets Act</a>, a financial promotion is a communication that is an invitation or inducement to engage in investment activity that is communicated or approved by an authorized person. Financial promotions must comply with all of the applicable FCA Promotion Rules, with the overriding requirement that promotions must be ‘fair, clear and not misleading.’As indicated above, the FCA believes that its rules apply in a way that is media neutral; the rules focus on the content of communications and not on the medium used. Therefore, in its opinion, applying the rules to financial promotions using new media is no different to financial promotions made using any other medium. (However, this is easier said than done – the FCA Promotion Rules were created to apply to traditional forms of advertising, but now, for example, need to be interpreted in terms of a 140 character tweet!)Organisations should note that:<ol start="1"><li>banner ads, tweets, sponsored links, hyper-text links, posts on LinkedIn and Facebook and other communications made using social media may all be considered promotions. (There are certain exceptions in relation to image advertisements (see below));</li><li>tweets posted by customer would not be financial promotions, but re-tweets by a firm could be;</li><li>just because products or services are not explicitly mentioned in a communication does not mean that the communication is not a promotion;</li><li>in terms of references to past performance, firms will need to include a 5-year chart plus suitable risk warning;</li><li>risk warnings must be displayed prominently and clearly. (Be aware that roll-over type risk warnings will not be sufficient as the FCA considers that many people may read an advert without hovering over it);</li><li>there is no ‘one-click’ rule; being one-click away from the necessary information does not automatically make a promotion requirement. Each promotion must be ‘standalone compliant’ – it is not acceptable for a firm to omit important information or risk statements from promotions on the basis that the information will be provided later on in the process; and</li><li>even if a communication is not classed as a promotion (e.g., it’s a response to a query, complaint or general correspondence, etc.) it will still need to be clear, fair and not misleading.</li></ol>An image advertisement will not be considered a promotion in terms of investment and mortgage products, but there is no equivalent exception for insurance products. However, note that an image advertisement is narrowly construed and is limited to an advertisement which contains (i) the name of the firm, (ii) a logo or other image, (iii) contact details and (iv) a reference to the types of regulated activities the firm provides or its fees or commissions (investments) or a brief factual statement of the firm’s main occupation (mortgages). Anything more and the communication will fall into the category of promotion.The potential consequences for breaching the FCA Promotion Rules include: (a) criminal penalties; (ii) agreements entered into as a result of the promotion being unenforceable and compensation payable; and/or (iii) the promotion being banned.To ensure compliance with the FCA Promotion Rules, firms should:<ol start="1"><li>have appropriate policies and procedures in place;</li><li>consider whether social media is a suitable method for the communication, taking into account the nature and complexity of the product or service (e.g., given the space limitations of the particular channel);</li><li>consider whether the promotion meets the requirements for standalone compliance;</li><li>be mindful of the rules when purchasing (or instructing third parties to purchase) search terms from search engine providers;</li><li>keep appropriate records of all financial promotions; and</li><li>review communications regularly to ensure that promotions posted via social media remain up-to-date (new media may date more quickly than traditional media).</li></ol>Complaints HandlingPer the <a href="http://www.fshandbook.info/FS/html/FCA/DISP">Financial Conduct Authority Handbook</a>, when handling complaints, firms must: (i) investigate each complaint competently, diligently and impartially, (ii) assess each complaint fairly, consistently and promptly, (iii) provide fairly and promptly a clear assessment of the complaint and an offer of redress or remedial action, if appropriate and (iv) ensure any offer of redress or remedial action that is accepted is settled promptly. The FCA classes a complaint as any oral or written expression of dissatisfaction, whether justified or not, about the provision of, or failure to provide, a financial service or a decision by a firm in relation to a consumer redress scheme.  Generally the complaint must allege that the complainant has suffered (or may suffer) financial loss, material distress or material inconvenience. In the context of social media, the challenge for firms is whether they can identify when complaints are being made via social media and whether their complaint handing procedures capture such complaints.OutsourcingIf a firm outsources any critical activities as part of its social media strategy it will need to take account of the applicable outsourcing rules and guidance contained in <a href="http://www.fshandbook.info/FS/html/FCA/SYSC/8">SYSC 8 of the FCA and PRA Handbook</a>.Market AbuseA firm is required to comply with applicable market abuse and related rules, including:<ol><li>not make false or misleading statements or omit material information;</li><li>not disclose any inside information or commit any other form of market abuse;</li><li>not disclose inside information;</li><li>keep the market reasonably informed; and</li><li>comply with its obligations in terms of announcements;</li></ol>To avoid falling foul of the applicable rules via social media communications, firms should: (i) put in place appropriate social media policies, procedures and training for employees, (ii) synchronize any social media release with any formal release to the market; and (iii) carry out appropriate internal and external monitoring (e.g., of employees statements on social media and any statements made on linked third-party sites).FCA MonitoringFirms should note that even if they are not monitoring what is being said about them online, the regulator might be. When the Bank of Scotland was fined £4.2 million in 2012 for failing to keep accurate mortgage records, this failure was spotted by the regulator through monitoring complaints posted on a consumer forum website. Indeed, in March 2013, the new FCA chief executive indicated that the FCA plans to carry out pro-active monitoring of firms via social media, both for spotting illegal promotional activity and for wider market trends. “…What’s new is that we won’t just be relying on regulatory reports back from firms, but on reports from consumer bodies, internet monitoring, the media and even on Twitter. In the past, the emphasis was on firms’ regulatory reporting. We will be much broader in our approach.”General IssuesOf course, there are a whole host of general legal issues arising from social media that will also need to be considered, e.g., in terms of:<ul><li>employees’ use of social media (monitoring, policies, training, liability, disclosure of confidential/proprietary information, etc.);</li><li>use of social media in recruitment;</li><li>privacy;</li><li>security;</li><li>crisis management and damage to reputation;</li><li>protection & infringement of intellectual property rights;</li><li>general advertising and marketing rules;</li><li>consumer protection/unfair terms & trading rules;</li><li>user generated/third party content (user terms & conditions, notice & takedown policies and procedures, disclosure of material connections with third party bloggers, etc.); and</li><li>insurance.</li></ul>Lastly, many firms are global institutions and so it is always going to be important for firms to ensure that individuals outside of the UK are not unintentionally targeted by any UK social media campaigns, or if they are intended to be targeted, for firms to consider any specific rules that they will need to comply with in the applicable jurisdiction.StrategyAbove all, if financial organisations want to fully harness the potential of social media, they need to spend time and effort creating a social media strategy which has the full backing of relevant stakeholders. When pulling together their strategy, firms will need to take into account all relevant legal & regulatory issues, but they will also need to consider wider factors such as:<ul><li>what they want to stand for in social and what they want to use social media for? What value will it bring to the company? What value will it bring to their customers?</li><li>understanding social media across all business lines – it’s no longer just a marketing issue;</li><li>understanding their audience and relevant influencers (e.g., bloggers, journalists, forums, etc.);</li><li>putting in place adequate and appropriate resources, policies and procedures to manage social media activities;</li><li>thinking like a publisher – what is engaging content for customers and influencers?; and</li><li>how they can respond quickly and appropriately to online criticism.</li></ul>ConclusionAs a result of the recent financial crisis, consumers’ trust in financial organisations is at an all-time low and so it is increasingly difficult for financial organisations to get the positive attention of consumers. New competitors (e.g., from retail and telecoms, as well as start-ups) are moving into the FS market, many of which may be more agile and better equipped in terms of a digital strategy than the traditional finance brands. Social media provides great opportunities for firms to engage with customers in a new and interactive way and whilst organisations need to be careful to comply with the relevant laws and regulations, they need to get on board, and fast, if they want to be one of the winners in the new digital world.

Behind the Curve – Are Legal and Regulatory Concerns Preventing UK Financial Service Companies From Fully Harnessing Social Media?

Today’s consumers want to engage in a new way with the companies from which they buy goods and services.  Although some UK financial services organisations are 

Behind the Curve – Are Legal and Regulatory Concerns Preventing UK Financial Service Companies From Fully Harnessing Social Media?

Businesses are increasingly using social networks and online forums for marketing, recruiting, customer service, branding and PR purposes. The UK privacy regulator, the <a href="http://www.ico.org.uk/">Information Commissioner</a> (ICO), has recently published <a href="http://www.ico.org.uk/~/media/documents/library/Data_Protection/Detailed_specialist_guides/social-networking-and-online-forums-dpa-guidance.ashx">new guidance</a> on the use of social networking and online forums. This replaces its 2007 guidance on the subject and is a helpful reminder to companies of their data protection obligations when operating online in the UK.The UK <a href="http://www.legislation.gov.uk/ukpga/1998/29/contents">Data Protection Act 1998</a> (DPA) sets out an extensive data protection regime by imposing broad obligations on those who collect personal data, as well as conferring rights on individuals about whom data are collected. Broadly speaking, data controllers must ensure that personal data are processed in accordance with a number of “data protection principles” set out in Schedule 1 to the DPA, which require that:<ol><li>Data must be processed fairly and lawfully;</li><li>Data must be obtained only for specified lawful purposes and not further processed in a manner which is incompatible with those purposes;</li><li>Data must be adequate, relevant and not excessive in relation to the purposes for which it is processed;</li><li>Data must be accurate and, where necessary, kept up to date;</li><li>Data must not be kept for longer than is necessary;</li><li>Data must be processed in accordance with the rights of data subjects;</li><li>Appropriate technical and organizational security measures must be taken to prevent unauthorized or unlawful processing, accidental loss of or destruction or damage to, personal data; and</li><li>Personal data must not be transferred outside the EEA unless the destination country ensures an adequate level of protection for the rights of the data subject in relation to the processing of personal data.</li></ol>The DPA details certain circumstances where processing is exempt from these data protection principles.The new guidanceThe new guidance confirms that Section 36 of the DPA (which provides a <a href="http://www.legislation.gov.uk/ukpga/1998/29/section/36">domestic purposes exemption)</a> does not cover: (i) an organization’s use of social networks and online forums, or (ii) an individual’s use of social networks/forums for non-domestic purposes (e.g., in connection with running a sole trader business).Accordingly, organizations and businesses that use social media and online forums will have privacy compliance obligations under the DPA: (i) if they post personal data on their own or a third party’s website, (ii) if they download and use personal data from a third party’s website or (iii) if they run a website (e.g. a blog) which allows third parties to add comments or posts about living individuals and they are a data controller of that third-party content.The ICO states that the DPA will apply even where an organization asks an employee to carry out processing via their own personal social media page (e.g., their Facebook or LinkedIn page, or a personal blog) for business purposes. This is because, in such circumstances, the employee will be acting on behalf of the organization, so the processing will be for the organization’s corporate purposes and not for domestic purposes. However, the ICO acknowledges that there are situations where the purpose of using a social network or online forum will not be particularly clear-cut. Some users of social media may use it for mixed purposes, e.g., not only for personal, family and recreational purposes, but also to promote business interests. The ICO states that in such circumstances, individuals will need to ensure that any posts that involve personal data and are not made for domestic purposes comply with the DPA.Of course, the first issue that businesses will need to consider if running an online forum or social networking site is the extent to which they will be considered a data controller under the DPA. <a href="http://www.legislation.gov.uk/ukpga/1998/29/section/1">Section 1 of the DPA</a> states that a “data controller” means “the person (who either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed”.The ICO confirms that the operator of a social network or online forum will be a data controller in relation to any contact information or other personal data that the site operator processes about the users of such network or forum, and will need to comply with the DPA.In relation to any personal data that is posted on the social network or online forum by third parties, the ICO acknowledges that the position is less clear-cut. For an illustration of a situation where an operator would be considered a data controller in respect of third-party posts, the ICO refers to the 2011 case of <a href="http://www.bailii.org/ew/cases/EWHC/QB/2011/3185.html">The Law Society and Ors v Rick Kordowski EWHC 3185 (QB).</a> In this case, Mr Kordowski ran a website, “Solicitors from Hell”, which encouraged the public to name and shame solicitors. Mr. Kordowski moderated posts made by users and charged fees for adding or removing posts. The court held that Mr Kordowski was a data controller under the DPA, and this was not disputed by either party. It was clear that Mr Kordowski had decided the purpose and manner in which the personal data was processed.However, the ICO states that this does not mean that moderation is always an essential factor – even if the site operator does not carry out moderation in advance it could still be deemed to be a data controller. For example, if a site only allowed posts subject to terms and conditions which covered acceptable content, and posts could be removed if they breached those terms and conditions, then the operator would still be determining, to a certain extent, the purposes and manner in which personal data was processed and therefore would be deemed to be a data controller.If a business is deemed to be a data controller of third-party posts, it will need to take reasonable steps to ensure that any personal data posted on its site are accurate and, where necessary, kept up-to-date in order to be compliant with the DPA. The ICO indicates that what amounts to “reasonable steps” will depend on the nature of the site and how active a role the operator takes in selecting, allowing or moderating content. For example, if (i) the vast majority of posts on a site are third-party posts, (ii) the volume of such posts is significant, (iii) posts are not moderated in advance and (iv) the site relies upon users complying with user policies and reporting problems to the site operator, the ICO acknowledges that it would not be reasonable to check every individual post for accuracy.However, the ICO would consider “reasonable steps” to include:<ol><li>having clear and prominent policies for users about acceptable and non-acceptable posts;</li><li>having clear and easy-to-find procedures through which users can dispute the accuracy of posts and ask for them to be removed; and</li><li>responding to disputes about accuracy quickly, and having procedures which enable access to content to be suspended until the dispute has been settled.</li></ol>In addition, the ICO states that it expects site operators to have appropriate internal policies in place to deal with: (a) complaints from individuals who believe that their personal data may have been processed unfairly or unlawfully because of derogatory, threatening or abusive third-party posts, (b) disputes between individuals regarding the factual accuracy of posts; and (c) complaints about how the organization processes personal data provided by users.Best practicesBusinesses should take note of the new guidance when using social networks and online forums. In addition, we suggest the following best practices to ensure privacy compliance.<ul><li>Understand the privacy terms that apply in respect of your use of third-party social networks and online forums.</li><li>Understand the privacy risks associated with users posting third-party content and take appropriate steps to minimise such risks.</li><li>Put in place appropriate terms of use and privacy policies.</li><li>Ensure that privacy policies comply with the DPA and: <ul><li>include a description of how user data will be processed/used;</li><li>ensure that appropriate consents are obtained from users; and</li><li>limit the company’s liability for privacy breaches by users.</li></ul></li><li>Don’t keep personal data that has been collected via social networks and online forums for longer than necessary.</li><li>Obtain the consent of employees if any of their information will be posted to social networks or online forums.</li><li>Create an appropriate social media policy, and provide training to employees to ensure employees understand their obligations in respect of their use of social networks and online forums including: <ul><li>setting out rules about accessing social media sites at work;</li><li>making clear in what circumstances employees will represent the company and in what circumstances employees will act in a personal capacity and the rules relating to each (e.g., when acting in a personal capacity, employees       should write in the first person (“I” as opposed to “we”) and should include a prominent disclaimer stating that the views expressed are their own, and not necessarily those of their company); and</li><li>making clear to employees that they must not post personal information about colleagues on social networks and online forums.</li></ul></li><li>Put in place practical security measures for employees who have been approved to administrate/operate blogs and social media pages.</li></ul>Other social media issuesOf course, in addition to data protection and privacy, there are a whole host of other issues that businesses need to consider as part of their social media strategy, such as:<ol><li>employees use of social media (monitoring, policies, training, liability, disclosure of confidential/proprietary information, etc.);</li><li>use of social media in recruitment;</li><li>security;</li><li>crisis management and damage to company reputation;</li><li>protection and infringement of intellectual property rights;</li><li>advertising, marketing and promotion rules;</li><li>consumer protection/unfair terms and trading rules;</li><li>user-generated and third-party content (user terms and conditions, notice and takedown policies and procedures, disclosure of material connections with third-party bloggers, etc.);</li><li>insurance; and</li><li>applicable industry rules and regulations.</li></ol>Lastly, where a UK organization is a global business, it will be important for the organization to ensure that individuals outside of the UK are not unintentionally targeted by any UK social media campaigns; or if they are targeted intentionally, it will be important for organizations to consider any specific rules that they will need to comply with in the applicable jurisdiction.

New Guidance From UK Privacy Regulator on Social Networking and Online Forums

Businesses are increasingly using social networks and online forums for marketing, recruiting, customer service, branding and PR purposes. The UK privacy regula

New Guidance From UK Privacy Regulator on Social Networking and Online Forums

We’ve all seen the ads on the Internet—computer-optimization software designed to make your old PC operate like it’s brand new. Many consumers see these advertisements and, frustrated with the performance of their computers, purchase such software with the aim of speeding up their sluggish machines. But what happens when the software doesn’t work as advertised? The answer for Christopher Rottner was to file a lawsuit.In <a href="https://casetext.com/case/rottner-v-avg-techs-usa-inc">Rottner v. AVG Technologies, U.S., Inc.</a>, Rottner claimed to have downloaded a free trial of AVG Technologies’ program, PC TuneUp. After an initial scan of his computer, PC TuneUp reported that Rottner’s computer had critical errors, which it had repaired. The program then recommended that Rottner purchase the full version of the software to maintain the integrity of his computer. He did so. After installing the full version of PC TuneUp and an update, however, his computer crashed, causing Rottner to lose all of his personal files—yet he had purchased PC TuneUp to prevent this very scenario from occurring.Rottner filed a class action lawsuit in federal court in Massachusetts against AVG Technologies (“AVG”), alleging that AVG had falsely inflated the effectiveness of PC TuneUp. More specifically, Rottner alleged six different bases for the lawsuit, but one is of particular importance: a claim for breach of express warranty. AVG moved to dismiss Rottner’s claims, which the court granted in part, but denied with regard to the breach of express warranty claim.Applying Massachusetts choice-of-law principles, the Rottner court initially determined that Delaware law applied to this dispute because of the Delaware governing law provision in PC TuneUp’s End User License Agreement (EULA). The court then had to determine whether PC TuneUp constituted a good or a service because the <a href="http://delcode.delaware.gov/title6/c002/sc01/index.shtml">Delaware Uniform Commercial Code (UCC) </a>governs only the sale of goods and has specific provisions with regard to express and implied warranties. AVG argued that its agreement with Rottner was for the sale of a service, not a good, and that the UCC was inapplicable to the dispute. The court, however, disagreed.Delaware, like many other states, uses a “predominance test” when assessing whether a contract is for the sale of goods or services. <a href="http://blog.ericgoldman.org/archives/2013/06/court_applies_a.htm">This test can be rather complicated</a> when dealing with software because software is not easily classified as a good or a service in any given context.For example, under this test, software may constitute a service when it is specifically designed to accommodate a business’s unique practices (i.e., software that is designed to operate a manufacturing company’s patented machines).In contrast, software may constitute a good when it is an off-the-shelf commodity, such as word processing software. The Rottner court concluded that the PC TuneUp software was a good, and not a service, noting that PC TuneUp was generally available; that it was not specifically designed to meet Rottner’s computer needs; and that Rottner was able to purchase, download and install PC TuneUp in a single transaction.The court’s characterization of PC TuneUp as a good meant that the UCC’s provisions regarding express and implied warranties applied to the sale of PC TuneUp. The UCC states that express warranties are created when a seller makes a promise to a buyer about the goods, or when a seller offers a description of the goods (meaning that the goods must conform to the description). The court also noted that a clause “generally disclaiming ‘all warranties, express or implied’ cannot reduce the seller’s obligation with respect to such a description.”In Rottner, the EULA for PC TuneUp included an express warranty that the software would “perform substantially in accordance with the applicable specification.” Rottner argued that this language was vague and undefined—and the court agreed. Without a meaningful definition of PC TuneUp’s “applicable specifications,” the court found that the “only rational recourse for the consumer is to turn to the advertising claims and the claims broadcast by PC TuneUp itself as the ‘applicable specifications.’” In its advertisements, PC TuneUp purported to boost Internet speed, eliminate freezing and crashing, optimize disk space and speeds, extend battery life, protect privacy, monitor hard drive health and restore the PC to its peak performance. The court held that—even if the EULA’s express warranty were not vague—these representations constituted an express warranty of PC TuneUp’s functionality. That is, the court looked beyond the EULA’s express warranty to define its provisions. Rottner serves as a reminder that software companies should be very careful when advertising their products and should take care not to overstate their functionality.Rottner also brought a claim for breach of the UCC’s implied warranty of merchantability, but this claim was dismissed. The implied warranty of merchantability covers a range of buyer’s expectations in a transaction, including the expectation that goods are fit for the ordinary purposes for which such goods are used. Unlike Massachusetts law, which Rottner argued unsuccessfully was the applicable law, Delaware law allows merchants to disclaim the implied warranty of merchantability so long as the disclaimer is conspicuous to the consumer and specifically mentions merchantability. The court dismissed Rottner’s claim for breach of implied warranty because AVG’s EULA disclaimed the implied warranty of merchantability in all capital letters.Rottner v. AVG Technologies has important implications with regard to software lawsuits. First, the decision serves as a reminder that a company’s advertising claims may be regarded as express warranties, especially if, as in Rottner, the company’s EULA incorporates a vague express warranty.Second, the more commoditized and generic the software, the more likely such software may be treated as a good rather than a service, at least under Delaware law. This tendency to treat commoditized software as a good should encourage software developers to be very clear in their EULAs regarding their express warranties because they are often operating in a gray area of the law.Finally, a software vendor should be aware of the significant differences among states regarding these issues and should choose wisely in selecting a particular state’s law to govern the vendor’s EULA, including any warranty provisions in such EULA.

istock_000019870729medium-1024x681.jpg

Court Finds Uniform Commercial Code Applies to Commoditized Software

Court Finds Uniform Commercial Code Applies to Commoditized Software