Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

2024 Recap: Ten Lords A-Leaping!

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

LinkedIN

Earlier this year, the French consumer association UFC-Que Choisir initiated proceedings before the Paris District Court against Google Inc., Facebook Inc. and Twitter Inc., accusing these companies of using confusing and unlawful online privacy policies and terms of use agreements in the French versions of their social media platforms; in particular, the consumer association argued that these online policies and agreements provide the companies with too much leeway to collect and share user data.In a <a href="http://www.quechoisir.org/telecom-multimedia/internet/communique-donnees-personnelles-l-ufc-que-choisir-attaque-les-reseaux-sociaux-et-appelle-les-consommateurs-a-garder-la-main-sur-leurs-donnees">press release</a> published (in French) on its website, UFC-Que Choisir explains that the three Internet companies ignored <a href="http://www.quechoisir.org/telecom-multimedia/internet/communique-l-ufc-que-choisir-met-en-demeure-les-reseaux-sociaux-les-internautes-doivent-garder-la-main-sur-leurs-donnees">a letter</a> that the group had delivered to them in June 2013, containing recommendations on how to modify their online policies and agreements. The group sought to press the companies to modify their practices as part of a consumer campaign entitled “Je garde la main sur mes données” (or, in English, “I keep my hand on my data”).According to the press release, the companies’ refusal to address UFC-Que Choisir’s concerns prompted it to initiate court proceedings. The group has requested that the court suppress or modify a “myriad of contentious clauses,” and alleged that one company had included 180 such “contentious clauses” in its user agreement.The group has also invited French consumers to sign a petition calling for rapid adoption of the EU Data Protection Reform that will replace the current Directive on data protection with <a href="http://europa.eu/rapid/press-release_MEMO-14-186_en.htm">a Regulation</a> with direct effects on the 28 EU Member States. UFC-Que Choisir published two possibly NSFW videos depicting <a href="https://www.youtube.com/watch?v=KniuCvBssD4">a man</a> and <a href="https://www.youtube.com/watch?v=99Q-RIgvpBE">a woman</a> being stripped bare while posting to their Google Plus, Facebook and Twitter accounts. A message associated with each video states: “Sur les réseaux sociaux, vous êtes vite à poil” (or, in English, “On social networks, you will be quickly stripped bare”).The campaign is obviously aimed at catching the attention of the French public, and its timing is not coincidental. In April 2013, the French data protection authority (DPA) started coordinating a joint action among France, Germany, Italy, the Netherlands, Spain and the United Kingdom to investigate and launch penalty proceedings against Google’s new privacy policy. That policy, issued in March 2012, permitted the company to merge data from different Google services and to use that data across different platforms. So far, the French, <a href="http://www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2013/notas_prensa/common/diciembre/131219_NP_AEPD_POL_PRIV_GOOGLE.pdf">Spanish</a> and <a href="http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/3033237">Italian </a>DPAs have issued record fines and the Dutch DPA has condemned the policy.The DPAs observed that any processing of personal information is covered by the national laws of the country where the user resides; this assertion was contested by Google. The DPAs found that Google does not sufficiently inform its users of the conditions under which their personal information is processed, or of the purposes for the processing; as a consequence, users are not able to correctly exercise their rights of access, correction or deletion. Further, the DPAs held that Google doesn’t comply with the obligation to obtain user consent prior to the storage of cookies on their terminal devices, and that it fails to define retention periods applicable to the different data sets it processes, as required under applicable national laws.UFC-Que Choisir also alleges that the three Internet companies provide insufficient information regarding their practices to users. For example, the group argues that the contractual terms displayed on the three companies’ web pages are “inaccessible, unreadable, and full of hyperlinks—between 40 and 100 hyperlinks—sometimes sending back to pages in English.” The group argues in its press release that this allows for the “widespread collection, modification, retention and exploitation of data related to users and their contacts.” The group contrasts Twitter and Facebook policies, which are allegedly “very long and fragmented,” with the Google Plus policy and its “laconic wording.”  The group wants the companies to shorten their contractual terms and notify users when they change their conditions, in order to obtain new and valid consent. According to the group, the three companies afford a “worldwide, unlimited and unremunerated license” to share information with their commercial partners without obtaining valid consent. The group warns consumers: “In short, you are not only being targeted with advertising, but your data may also be commercially exploited without your express consent and without receiving compensation.” UFC-Que Choisir released to the press some examples of allegedly unfair clauses that are currently accessible online.Consumer associations everywhere in Europe want to gain influence over data protection issues. In November 2013, the Berlin District Court upheld similar arguments by the German Federation of Consumer Organisations (VZBV) in proceedings against Google. Germany is expected to pass a bill in the near future that will allow consumer associations to initiate summary proceedings to defend individual rights against infringement of data protection laws. So far, they can only rely on the German Unfair Competition Act where data protection breaches create an economic disadvantage.Consumer associations also think their role will be strengthened by rapid adoption of the EU reform. In its petition (in French), UFC-Que Choisir states that consumers’ control over their own personal information will be put in place as a general principle under the new Regulation. In the provision adopted on March 12, 2014, Parliament increased the fines for companies that violate privacy rules up to EUR 100 million (approximately USD 138 million) or 5 percent of their annual worldwide turnover. Further, the provision reinforces the application of national laws to activities of global companies operating from the U.S. More specifically, the bill clarifies that not only data controllers established outside the EU but also data processors established outside of the EU are subject to EU laws whenever they offer goods or services, regardless of whether payment is required.However, it is questionable whether these developments will be upheld by the Council, as many Member States have stated that they want to remove administrative burdens from companies. While Parliament has expressed the need to rapidly adopt reforms, the Council has not yet started official negotiations to reach a common position. The likelihood of having the proposed Reform adopted by the end of the year is uncertain.As for the case at hand, it may be months before the judge makes a ruling. Paradoxically, the UFC-Que Choisir publicly criticized the much-debated May 13 <a href="http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=req&docid=152065&occ=first&dir=&cid=257118">ruling of the European Court of Justice</a> stating that individuals may compel Google to remove links to contested information based on their right to be forgotten. The association said that publishers are responsible for the personal data on their web pages, and not Google. Neutrality goes along with transparency, free movement and freedom of expression on the Internet, all principles that the association says it wants to promote.

istock_000017310089xlarge-1024x682.jpg

French Consumer Association Takes on Internet Giants

French Consumer Association Takes on Internet Giants

Earlier this year, the French consumer association UFC-Que Choisir initiated proceedings before the Paris District Court against Google Inc., Facebook Inc. and 

The European Court of Justice (ECJ) issued a quite surprising <a href="http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=req&docid=152065&occ=first&dir=&cid=257118">decision</a> against Google which has significant implications for global companies.On May 13, 2014 the ECJ issued a ruling which did not follow the rationale or the conclusions of its Advocate General, but instead sided with the Spanish data protection authority (DPA) and found that:<ul><li>Individuals have a right to request from the search engine provider that content that was legitimately published on websites should not be searchable by name if the personal information published is inadequate, irrelevant or no longer relevant;</li><li>Google’s search function resulted in Google acting as a data controller within the meaning of the Data Protection Directive 95/46, despite the fact that Google did not control the data appearing on webpages of third party publishers;</li><li>Spanish law applied because Google Inc. processed data that was closely related to Google Spain’s selling of advertising space, even where Google Spain did not process any of the data. In doing so, it derogated from earlier decisions, arguing the services were targeted at the Spanish market, and such broad application was required for the effectiveness of the Directive.</li></ul>The ruling will have significant implications for search engines, social media operators and businesses with operations in Europe generally. While the much debated “right to be forgotten” is strengthened, the decision may open the floodgates for people living in the 28 countries in the EU to demand that Google and other search engine operators remove links from search results. The problem is that the ECJ mentions a broad range of data that may be erased. Not only should incorrect or unlawful data be erased, but also all those data which are “inadequate, irrelevant, or no longer relevant”, as well as those which are “excessive or not kept up to date” in relation to the purposes for which they were processed. It is left to the companies to decide when data falls into these categories.In that context, the ruling will likely create new costs for companies and possibly thousands of individual complaints. What is more, companies operating search engines for users in the EU will have the difficult task of assessing each complaint they process and whether the rights of the individuals prevail over the rights of the public. Internet search engines with operations in the EU will have to handle requests from individuals who want the deletion of search results that link to pages containing their personal data.That said, the scope of the ruling is limited to name searches. While search engines will have to de-activate the name search, the data can still be available in relation to other keyword searches. The ECJ did not impose new requirements relating to the content of webpages, in an effort to maintain the freedom of expression, and more particularly, press freedom. But this will still result in a great deal of information legally published to be available only to a limited audience.Below we set out the facts of the case and the most significant implications of the decision, and address its possible consequences on all companies operating search engines.FACTS OF THE CASEIn 2010, a Spanish national lodged a complaint before the Spanish DPA against the publisher of a daily newspaper with a wide audience in Spain, La Vanguardia, and against Google Spain and Google Inc. for their refusal to remove web links to the newspaper. The web pages contained the claimant’s personal details in an announcement concerning an auction of real estate connected with a procedure prompted by Social Security debts.The Spanish DPA did not require the newspaper to take down the pages, but it ordered Google Spain and Google Inc. to remove the data from their search results and to render future access to them impossible. Google appealed to the Spanish National High Court, seeking an annulment of the DPA decision.QUESTIONS REFERRED TO THE COURTThe Spanish National High Court referred the following questions to the ECJ for a preliminary ruling:<ul><li>Is Google a data controller with respect to its search engine activity?</li><li>Does the Directive apply even though Google Spain does not carry out any activity related to the search engine?</li><li>Can individuals require the erasure of their personal data by Google in a search engine, regardless of whether third- party content is legitimate?</li></ul>The ECJ is the highest court which decides on the interpretation and application of EU law. Decisions of the ECJ are legally binding on the courts in all EU countries which apply EU law. When a case is referred for a preliminary ruling, the answers of the ECJ must be applied by national courts, which then issue their own ruling on the specific facts of a case. There is no appeal following a preliminary ruling.In this specific case, the case will go back to the Spanish National High Court, which will have to decide on the specific facts while taking into account the principles highlighted by the ECJ.OPINION OF THE ADVOCATE GENERALOn June 25, 2013 the Advocate General at the ECJ Niilo Jääskinen issued an Opinion recommending that Google should not be required to remove links to legitimate third-party content based on data protection principles. In his Opinion, Jääskinen emphasized the importance of freedom of speech and the reservation of historic newspaper reports.The Advocate General agreed that sales offices in EU countries suffice to trigger the application of that country’s data protection law. In his view, the processing of personal data takes place within the context of an ‘establishment’ if that establishment is linked to a service selling targeted advertising in the Member State, even if the technical data processing operations are situated in third countries.However, the Advocate General stated that Google cannot be considered the data controller of data available on third party websites as it does not control the content of these sites. Also, he made it clear that in his opinion, there was no such thing as a general “right to be forgotten” under the current Data Protection Directive.The ECJ ultimately took a very different view. It is an uncommon occurrence that the ECJ disagrees with the opinion of an Advocate General as it has done here.GOOGLE IS A DATA CONTROLLERIn its decision, the ECJ explained that Google’s search engine activity consists of retrieving, recording and organizing personal data which it stores on its servers and, as the case may be, discloses the data to its users in the form of lists of results. In the ECJ’s view, this indexing activity is a processing of personal data, regardless of the fact that the search engine does not distinguish between personal data and other types of data.The ECJ further regarded Google as a data controller in relation to the processing of the data by the search engine. According to the ECJ, Google determines the purposes and means of data processing and its activity is “liable to significantly affect” individuals’ fundamental rights to privacy. The ECJ highlighted that the definition of a data controller in the Directive is broad.The ruling is a surprising result as this means that Google is the data controller of search results even though it cannot control the webpages from which the data are pulled. In fact, third party publishers are the data controllers when it comes to the content of the webpages. This fact however, was not relevant to the ECJ and finding may have broader implications regarding the definition of a data controller in other contexts.APPLICATION OF EU DATA PROTECTION LAW WHERE PROCESSING RELATES TO ACTIVITIES OF LOCAL SALES AGENTSThe ECJ held that the Google’s search engine is subject to EU data protection laws even if Google Spain does not carry out any activity directly linked to the indexing or storing data.In fact, the ECJ said that a broad interpretation of the territorial scope of EU laws was required to ensure the effectiveness of Art. 4.1 (a) of the Directive which states that local EU data protection law applies where “the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable.”The ECJ determined Google Spain constitutes a stable establishment of Google Inc. within the meaning of the Directive, and Google Inc.’s processing is closely related to Google Spain’s activity because it is intended to promote and sell advertising space in Spain in order to make the service offered by the engine more profitable. In doing so, the Court considered whether Spanish users were targeted for marketing and for advertising, a consideration provided in the draft EU Regulation and discussed in literature, but not currently provided in the Directive. Thus, this finding is new and quite unexpected.The ECJ ruling follows the same line as its General Advocate and a common position in the Member States with respect to the meaning of an “establishment”. It held the “establishment” in not just in terms of control over personal data, but also in the economic function of the EU subsidiaries of the foreign companies. The interpretation of the “establishment” has been continuously broadened by the EU DPAs. This may, in the end, be the finding that has the broadest implications for companies. Essentially if an EU subsidiary is intertwined with the goals and purposes of a foreign parent company and if the service is aimed at the local EU Member State market, EU law may be found to apply to the non-EU entity.RECOGNITION OF THE MUCH DEBATED “RIGHT TO BE FORGOTTEN”According to the ECJ opinion, a website operator should remove links to web pages that are published by third parties each time the inclusion of the link is or has become incompatible with the Directive. Opposing the Advocate General’s reasoning, the ECJ stated that a link is incompatible with the Directive not only when the data are false or unlawful (which is the current position in many Member States), but also when the data are inadequate, irrelevant, or no longer relevant, or where the data are excessive or not kept up to date in relation to the purposes for which they were processed. This is a significant expansion of the definition of the correction rights as currently implemented and interpreted in many Member States.The ECJ did make an exception for individuals who are public figures or where the public interest in the information would outweigh the privacy rights of the individuals.In the specific case at hand, the ECJ found that the web pages contained true information that had been lawfully published, but they stated, “having regard to the sensitivity of the information contained on the webpage, and to the fact that its initial publication had taken place 16 years earlier, the data subject establishes a right that that information should no longer be linked to his name.” Thus, the ECJ found that even where the data are lawfully published and the underlying website will not be altered, the individual still has the right to request that the “aggregator” of such information remove the data.  The ECJ, however, did not impose specific requirement as to how much time must pass for a request to be considered valid, leaving that question to search engine operators, data protection authorities and national courts to answer on a case-by-case basis.As a result, while the information was legitimately published, and may remain available off-line and on the Internet, the information should no longer be searchable via the name of the individual. That said, it would still be permissible for the search engine platform to allow the information to be searchable by date, location, or any other keyword.A NEW SOURCE OF CONTENTIONS BEFORE THE DPAsThe ECJ justified the new constraint it imposes on technology companies by the “seriousness of the interference in the private life of the individuals” that may be caused by a name search. In fact, any Internet user, when he or she searches an individual’s name, may obtain a structured overview of the information relating to that individual, the ECJ said. This information potentially concerns a vast number of aspects of an individual’s private life which, without the search engine, could not have been interconnected.What this likely means in practice is that an individual may make a request to a company to have the links based on name be removed. If the company does not agree, then the individual will have the right to go to the Data Protection Authority or the local courts to try to force the company to remove the links. This will thus create quite a bit of additional work for the DPAs and the courts.A DIFFICULT BALANCE TO STRIKE BETWEEN THE INTERESTS OF THE INDIVIDUALS AND THOSE OF THE INTERNET COMMUNITYThe ECJ ruling creates a new requirement that search engine operators and other aggregators of information must seek a fair balance between the interests of the individuals and those of the public. The ECJ stated that the following factors need to be taken into account by the search engine provider in deciding whether to make information available via name search.The balance will depend on (i) the nature of the information, (ii) the sensitivity of the information for the individual’s private life and (iii) the interests of the general public in having that information. Such interest may vary according to the role played by each individual in public life. Again, it is for the companies to assess in which case such role may justify the indexation of the data. This will likely be a costly and uncomfortable position for many companies.PRESS FREEDOM AND FREE SPEECH PRESERVED BUT POTENTIALLY LIMITEDThe ECJ affirmed that publishers of websites are still allowed to publish contested personal data for journalistic purposes. These rights do not, however, extend to search engines. Therefore, while an individual may require the erasure of his or her data by a search engine’s operator, the content of the webpage would be left unchanged.However, it is likely that the decision will affect the activity of journalists and more generally, freedom of expression. The removal of contested links will lower the number of times a webpage is visited, thus adversely affecting freedom of expression. The ECJ did not uphold the Advocate General’s opinion that the erasure of legitimate and legal information would amount to a form of “censorship” by a private party.CURRENT STATE OF PLAY AT EU LEVELThe introduction of a right to be forgotten has been proposed by the EU commission in the proposed General Data Protection Regulation. In a first reading of March 2014, the Parliament adopted a new article 6, which set out that any data which is inaccurate, incomplete or no longer up to date should not be disclosed. The proposed Regulation also sets out that the right to erase incorrect data extends to third parties. However, the Parliament did not retain the Rapporteur’s proposition for a reference to clear time limits. For the proposed Regulation to become law, the Council must agree on a common position with the Parliament. It is not certain that these developments will be upheld by the Council which has stated that it wants to remove administrative burdens from companies. While Parliament has expressed the need to adopt a reform by the end of the year, the Council has not yet formed official positions or started official negotiations to reach a common position. In view of the coming European elections and the appointment of a new Commission, solid legislative work may not restart until next year.In this context, it is still unclear whether the ECJ’s ruling at hand will be integrated in the new Regulation. What is sure is that the decision will be debated at the EU level, whereas it already has implications in the jurisdictions of the 28 Member States.IMPLICATIONSIn addition to putting data protection authorities in a rather uncomfortable position of deciding on the question of what legitimate content should be easily searchable and accessible, this decision will have wide-ranging ramifications for organizations, not just for search engine providers.First, there is a very broad interpretation of the jurisdictional reach of EU Member State law to cover organizations outside the EU whenever users in the EU are targeted.Second, search engine providers, social media and other content providers may have obligations to comply with the data protection laws even where they are not involved in making decisions about the online content provided.Third, the way in which organizations search for data will likely change due to the fact that certain information will now no longer be available by name.

European Court of Justice Strengthens Right to Be Forgotten

The European Court of Justice (ECJ) issued a quite surprising decision against Google which has significant implications for global companies. On May 13, 2014 t

European Court of Justice Strengthens Right to Be Forgotten

In a much anticipated decision in the class action In re Hulu Privacy Litigation, U.S. Magistrate Judge Laurel Beeler of the U.S. District Court for the Northern District of California has shed new light on the meaning of “personally identifiable information” (PII) under the Video Privacy Protection Act (VPPA). This has important implications for companies that host videos on their websites and integrate their services with social media companies or web analytics service providers.The court held on summary judgment that the transmission to a third party of unique user IDs, in and of themselves, along with video viewing history, does not constitute disclosure of PII under the VPPA.In reaching its conclusion, the court distinguished between anonymous IDs that Hulu, LLC provided to the audience metrics company comScore, Inc. (which the court held were not PII) and a social networking service’s user IDs that Hulu provided to the social networking service (as to which the court held there were material issues of fact with respect to whether they could permit the identification of specific persons and thus be PII).The court granted Hulu’s motion for summary judgment with respect to the comScore disclosures but not with respect to the social networking service disclosures.KEY POINTSThe court’s decision shows that, when determining whether unique IDs associated with consumers’ online video viewing history are PII regulated by the VPPA, context matters.In particular, companies that transmit such information should be aware of several key points:<ul><li>First, the decision declined to impose VPPA liability for the disclosure of unique user IDs associated with video viewing history, where such IDs did not identify specific persons and where the record revealed only a hypothetical ability to correlate unique user IDs to specific persons but no evidence that it actually happened.</li><li>Second, the decision makes clear that companies should be mindful of the context in which they share unique user IDs with third parties, particularly with respect to whether the IDs permit the recipient or another party to identify specific persons, either directly or through information to which they already have access.</li><li>Third, the decision highlights the potential danger for companies that integrate social media plug-ins or other functionality on web pages where consumers watch videos. Companies providing online video services should consider taking steps to ensure that: (1) cookies and other data transmitted to another entity, such as a user ID that is matched with the video provider’s user ID for the same person, do not permit identification of specific individuals; and (2) video viewing history is not shared unintentionally, such as through a referrer URL that is transmitted during a standard browser request.</li><li>Finally, the decision highlights other important questions of fact that may exist when evaluating VPPA exposure, including whether the disclosing party had knowledge of the disclosure and whether the consumer consented to it.</li></ul>BACKGROUNDWith limited exceptions, the VPPA imposes liability—including liquidated damages of up to $2,500 per incident—on a video tape service provider that knowingly discloses, to any person, PII concerning any consumer of the video tape service provider. Liability extends to companies that provide online video services, such as Hulu, and the definition of PII includes “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”In this case, the plaintiffs alleged that Hulu wrongfully disclosed its users’ video viewing history to comScore and a social networking service. comScore had provided Hulu with audience metric data about Hulu’s users, and the social networking service had provided social networking features through placement of its “Like” button on Hulu’s video watch pages. Each company received different data from Hulu during the delivery of its services. Among other data, comScore received unique numerical Hulu User IDs and comScore User IDs, while the social networking service had access to its own first-party cookies containing its own unique user IDs. Each company also received the title of the video watched, either as a parameter in a set of data transmitted or in the referrer URL of the page on which the user viewed the video.ASSESSING THE LINK BETWEEN USER IDS AND SPECIFIC PERSONSIn its decision, the court addressed three different disclosures by Hulu:<ul><li>the disclosure to comScore of watch pages and Hulu User IDs;</li><li>the disclosure to comScore of the comScore User ID cookies; and</li><li>the disclosure to the social networking service of watch pages and the social networking service’s cookies.</li></ul>The key issue for the court was whether the disclosures of the video titles were tied to specific identified persons, such that they constituted prohibited disclosures of PII under the VPPA. The court stated that “the statute, the legislative history, and the case law do not require a name, [but] instead require the identification of a specific person tied to a specific transaction . . . .” Providing further explanation, the court stated that “a unique anonymized ID alone is not PII but context could render it not anonymous and the equivalent of the identification of a specific person.” In other words, context matters insofar as the circumstances link the unique user IDs to specific persons.In applying this reasoning, the court held that Hulu’s disclosure to comScore of watch pages and Hulu User IDs did not constitute disclosure of PII: despite the fact that comScore could have used the Hulu User IDs to access Hulu users’ profile pages and obtain their names, there was no evidence that it did so, and there was thus no disclosure of PII for purposes of the VPPA.The court next addressed Hulu’s disclosure to comScore of the comScore User ID cookies. The court explained that, although the comScore User IDs permitted comScore to conduct “substantial tracking that reveals a lot of information about a person,” the disclosure did not violate the VPPA because the tracking did not reveal “an identified person and his video watching.”On the other hand, the court suggested that disclosure of the social networking service’s own, first-party user IDs to the social networking service itself, together with video viewing history, may constitute disclosure of PII under the VPPA. The court noted that “[t]he Facebook User ID is more than a unique, anonymous identifier. It personally identifies a Facebook user. That it is a string of numbers and letters does not alter the conclusion.” In addition, the court emphasized that “a Facebook user—even one using a nickname—generally is an identified person on a social network platform” and that “[the Facebook User ID] identifies the Hulu user’s actual identity on Facebook.” Therefore, the court denied Hulu’s motion for summary judgment with respect to its disclosures to the social networking service.The decision with respect to the social networking service highlights the risk posed by integrations with social media companies on websites that host video services. Such integrations may cause a cookie or other data to be sent from a user’s browser without any affirmative action by the user, which could permit the social media company to identify a specific person and his or her video watch history—and thus trigger VPPA liability, although the court declined to make a decision on this aspect at this stage of the proceedings.In practical terms, this risk means that companies providing online video services should take steps to ensure that: (1) cookies and other data transmitted to another entity, such as a user ID that is matched with the video provider’s user ID for the same person, do not permit identification of specific individuals; and (2) video viewing history is not shared unintentionally, such as through a referrer URL that is transmitted during a standard browser request.OTHER POTENTIAL LIMITATIONS UNDER THE VPPA: “KNOWING” DISCLOSURE AND USER CONSENTThe court ruled that material issues of fact remained regarding whether Hulu disclosed the social networking service’s user IDs knowingly and without user consent. The court stated that “[o]ther cases involving violations of privacy statutes show that in the context of a disclosure of private information, ‘knowingly’ means consciousness of transmitting the private information. It does not mean merely transmitting the code.” Thus, the court stated that “if [Hulu] knew what [the social networking service’s cookies] contained and knew that it was transmitting PII . . . then Hulu is liable under the VPPA.” The court did not, however, grant summary judgment to Hulu based simply on the fact that Hulu’s servers could not read the social networking service’s cookies. Rather, the court held that other evidence may show that Hulu knew that the social networking service was receiving its own first-party user IDs within its cookies and was reading them together with video viewing history.Finally, the court also denied Hulu’s motion for summary judgment with respect to whether consumers had given consent to any disclosures through their acceptance of the social networking service’s privacy policy or whether such “consent,” if found, was sufficient under the VPPA.CONCLUSIONIn light of the court’s decision, companies that—without affected individuals’ VPPA-compliant consent—disclose any type of identifier, together with video viewing history, to any other person or company should pay very close attention to exactly what information they transmit and whether it could be used by the recipient to identify specific individuals.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

If You Host Videos on Your Website, Read This Blog Post Regarding the Video Privacy Protection Act

In a much anticipated decision in the class action In re Hulu Privacy Litigation, U.S. Magistrate Judge Laurel Beeler of the U.S. District Court for the Norther

If You Host Videos on Your Website, Read This Blog Post Regarding the Video Privacy Protection Act

In a case that could have a broad impact on how companies deliver content to consumers, the Supreme Court heard oral argument on April 22 in American Broadcasting Companies, Inc. v. Aereo, Inc. (No. 13-461).  At issue is whether Aereo’s service engages in public performances under the Copyright Act in transmitting broadcast television content to its subscribers’ wired and wireless devices.  While the Justices questioned both parties on a variety of issues, a clear focus for the Court was the potential impact of its decision on other technologies not at issue in this case.BackgroundAereo provides broadcast television streaming and recording services to its subscribers, who can watch selected programing on various Internet-connected devices, including televisions, mobile phones and tablets.  Aereo provides its service through individual antennas that pick up local television broadcast signals and transmit those signals to a server where individual copies of programs embedded in such signals are created and saved to the directories of subscribers who want to view such programs.  A subscriber can then watch the selected program nearly live (subject to a brief time-delay from the recording) or later from the recording.  No two users share the same antenna at the same time, nor do any users share access to the same stored copy of a program.In 2012, various broadcasting companies sued Aereo for copyright infringement in the Southern District of New York claiming, among other things, that Aereo’s transmission of the plaintiffs’ copyrighted content to Aereo’s subscribers violated the copyright owners’ exclusive right to publicly perform those works.  That public performance right, codified in the 1976 Copyright Act, includes (1) any performance at a place open to the public or any gathering with a substantial number of people outside the “normal circle of family and social acquaintances,” and (2) the transmission of a performance to the public whether or not those members of the public receive it in the same location and at the same time.  This latter provision, commonly referred to as the Transmit Clause, was added to the Copyright Act by Congress in part to overturn prior Supreme Court precedent that had previously allowed cable companies to retransmit broadcast television signals without compensating the broadcaster.The district court denied the broadcast companies’ preliminary injunction requests, finding that, based on Second Circuit precedent, Aereo’s transmissions were unlikely to constitute public performances.  The Second Circuit affirmed the decision, relying on the court’s earlier decision in Cartoon Network LP v. CSC Holdings, Inc., 536 F.3d 121 (2d Cir. 2008) (“Cablevision”), which found that a cable company’s remote-storage DVR system did not run afoul of the public performance right because each transmission was sent only to an individual user.  The Second Circuit held that Aereo does not engage in public performances because, as in Cablevision, Aereo’s system makes unique copies of every recording, and each transmission of a program to a customer is generated from that customer’s unique copy.Aereo has been sued by other broadcasters in other jurisdictions as well.  The District of Massachusetts reached the same result as the Second Circuit, while the District of Utah came to the opposite conclusion.  Further, both the D.C. District Court and the Central District of California have issued preliminary injunctions against FilmOn X, a company that offers a service similar to Aereo’s.Supreme Court Oral ArgumentA recurring theme during the oral argument was the impact the Court’s decision would have on other technologies and industries.  The Justices’ questions focused heavily on how their decision would affect other technologies, such as cloud computing and storage, how to balance technological innovation versus pure circumvention of copyright laws, and on how a decision against Aereo, were the Court to make such a decision, could be squared with the Second Circuit’s Cablevision opinion.Effect on Other TechnologiesJustices Stephen Breyer and Sonia Sotomayor led off the discussion over the expected impact of the Court’s decision on other technologies.  Justice Breyer plainly stated: “And then what disturbs me on the other side is I don’t understand what a decision for [Aereo] or against [Aereo] when I write it is going to do to all kinds of other technologies.”  Justice Samuel Alito echoed this sentiment when he remarked: “I need to know how far the rationale that you want us to accept will go, and I need to understand, I think, what effect it will have on these other technologies.”Neither party had a clear response that seemed to ease the Court’s concerns.  The broadcasters sought to distinguish Aereo’s technology from cloud storage by pointing out that the cloud storage companies provide a “locker” for users to store their own rightfully owned content, and at times urged the Court to avoid the issue of cloud storage altogether—although the Court seemed unsure of how to accomplish that.  Aereo stirred the pot by pointing out that a decision finding that the performance of content stored by a third party constitutes a public performance could result in “potentially ruinous liability” for the cloud storage companies.  Several other companies and technologies were identified by name during the arguments, including Netflix, Hulu and Roku.While the early discussion seemed to focus on how the Court could find Aereo’s service a public performance without broader ramifications to the industry, most of the Court’s questions did not portend how the Court would ultimately rule.  The Court, however, was undoubtedly cognizant that the decision could have an impact beyond the dispute at issue.Questioning the Merits of the TechnologyChief Justice John Roberts questioned both parties on the technological aspects of Aereo’s service, first pointing out to the broadcasting companies that “[y]ou can go to Radio Shack and buy an antenna and a DVR or you can rent those facilities somewhere else from Aereo.  They’ve—they’ve got an antenna.  They’ll let you use it when you need it and they can, you know, record the stuff as well and let you pick it up when you need it.”The broadcasters responded that allowing Aereo to take “a performance off the airwaves and transmit it to all the end-users” contradicts Congress’s specific intent when it enacted the Transmit Clause in response to cable providers’ prior transmissions of content without compensating the content owners.Chief Justice Roberts then questioned Aereo as to the motive behind Aereo’s multi-antenna set-up stating: “I mean, there’s no technological reason for you to have 10,000 dime-sized antenna, other than to get around copyright laws.”  Justice Antonin Scalia followed up with “is there any reason you did it other than not to violate the copyright laws?”According to Aereo, “All Aereo is doing is providing antennas and DVRs that enable consumers to do exactly what this Court in Sony [Corp. of America v. Universal City Studios, Inc.] recognized they can do when they’re in [their] home and they’re moving the equipment . . . .”  Aereo distinguished itself from cable providers by the scope of content they provide (only content available over public airwaves) and how it is provided (upon a user’s initiation).Distinguishing CablevisionThe Court also inquired as to how Aereo’s service differs, if at all, from the remote-storage DVR service provided in Cablevision.  Justice Anthony Kennedy, in particular, seemed reluctant to reach a decision that effectively overruled Cablevision, even asking the broadcasting companies to “assume that Cablevision is our precedent.”  The broadcasting companies attempted to distinguish Aereo’s service from the service in Cablevision by pointing out that the defendant in Cablevision paid royalties to carry programming in the first instance, whereas Aereo does not pay any royalties.In any event, while the outcome of the case is as yet undetermined, it remains to be seen how any decision will impact other existing technologies and serve as a guide to innovators on crafting future technologies to avoid copyright infringement liability.A decision is expected by the end of June.

Which Way is Aereo Pointing? The Supreme Court Hears Arguments in Public Performance Copyright Case

In a case that could have a broad impact on how companies deliver content to consumers, the Supreme Court heard oral argument on April 22 in American Broadcasti

Which Way is Aereo Pointing? The Supreme Court Hears Arguments in Public Performance Copyright Case

The Federal Trade Commission’s (FTC) <a href="http://www.ftc.gov/news-events/press-releases/2014/04/ftc-charges-operators-jerkcom-website-deceiving-consumers">announcement</a> that it had filed a complaint against Jerk, LLC and its websites like “jerk.com” (“Jerk”) looks at first glance like a run-of-the-mill FTC Section 5 enforcement action involving allegedly deceptive practices online. But hidden in the facts of Jerk’s alleged misbehavior is a potentially significant expansion of the FTC’s use of its deception authority.According to the FTC’s <a href="http://www.ftc.gov/system/files/documents/cases/140407jerkpart3cmpt.pdf">complaint</a>, Jerk allegedly led consumers to believe that the profiles on its websites were created by other users of the website. The company also allegedly sold “memberships” for $30 a month that supposedly included features that would enable consumers to alter or delete their profiles, or to dispute false information in the profiles. Jerk also charged consumers a $25 fee to email Jerk’s customer service department, according to the FTC’s complaint.The FTC alleges that Jerk created between 73.4 million and 81.6 million unique consumer profiles primarily using information such as names and photos pulled from Facebook through application programming interfaces, or APIs. The complaint states that “[d]evelopers that use the Facebook platform must agree to Facebook’s policies,” such as obtaining users’ explicit consent to share certain Facebook data and deleting information obtained from Facebook upon a consumer’s request.These alleged facts lend themselves to a straightforward violation of Section 5 of the FTC Act for deceptive acts or practices. Jerk allegedly represented that the content on its websites was user-generated, while it was in fact primarily pulled by Jerk from Facebook, making Jerk’s representation false and misleading. The FTC, however, has gone well beyond this straightforward deceptiveness accusation here. Rather than simply alleging that Jerk’s representations were false and misleading because the content was not generated by users, but rather from Facebook information, the complaint goes much further in alleging that Jerk “populated or caused to be populated the content on the vast majority of Jerk profiles by taking information from Facebook in violation of Facebook’s policies….” (Emphasis added.) The fact that the information was pulled from Facebook in violation of Facebook’s policies does not seem to be material—let alone essential—to the deceptiveness allegation. Nonetheless, the complaint only alleges that “the representation [regarding the source of the content] was, and is, false or misleading” after stating that Jerk took information from Facebook in violation of Facebook’s policies.The FTC is breaking new ground here. Jerk is not the first time the FTC has brought a case based (in part) on an alleged violation of another company’s terms or policies, but it is the first time the FTC has alleged that the violation of another company’s terms or policies can be part of a violation of Section 5 in its own right. In January 2000, the FTC brought a complaint against ReverseAuction.com (“Reverse Auction”), an auction website that was attempting to compete with eBay. The FTC’s complaint was based, in part, on the allegation that Reverse Auction obtained and used email addresses and user IDs of eBay customers “after registering as an eBay user and agreeing to comply with and be bound by eBay’s User Agreement.” (Emphasis added.)Like Facebook, eBay requires users to adhere to its applicable policies. In both the Reverse Auction and the Jerk matters, the FTC charged that the applicable website operator failed to comply with the policies that applied to such website operator’s actions. The crucial difference in the cases is that, in Reverse Auction, the FTC’s theory of deception was that Reverse Auction “represented to eBay” that Reverse Auction would comply with eBay’s policies. In light of this precedent, Jerk is significant because the FTC’s complaint alleges only that Jerk made false representations about the source of its information, not about its compliance with Facebook’s policies per se. In other words, the FTC’s complaint can be read to suggest that simply using information pulled from Facebook in violation of Facebook’s policies is a deceptive act or practice, without any alleged misrepresentation to Facebook regarding the use of the information. The FTC’s Jerk action thus breaks away from Reverse Auction by characterizing actions inconsistent with a third party’s policies as deceptive in their own right, as opposed to finding any representation regarding compliance with those policies to be deceptive. In that light, the FTC appears to have taken a case with ugly facts (including, allegedly, public availability on Jerk’s websites of photos of children that had been tagged as “private” on Facebook) and leveraged such case to allege that noncompliance with Facebook’s policies themselves is part of a violation of Section 5 in its own right. If the FTC continues to pursue this theory, it would essentially be turning Facebook’s policies into “federal law,” with compliance effectively enforced by the threat of Section 5 enforcement simply for using Facebook content in violation of Facebook’s policies.

istock_000025507919large-1024x1024.jpg

Jerked Around? Did the FTC’s “Jerk.com” Complaint Just Turn API Terms Into Federal Law?

Jerked Around? Did the FTC’s “Jerk.com” Complaint Just Turn API Terms Into Federal Law?

The Federal Trade Commission’s (FTC) announcement that it had filed a complaint against Jerk, LLC and its websites like “jerk.com” (“Jerk”) looks at first glanc

On March 27, 2014, the highest court in the European Union—the Court of Justice for the European Union (CJEU)—<a href="http://curia.europa.eu/juris/document/document.jsf;jsessionid=9ea7d0f130d66b28097e9d2c44d0ada7e2ae3f514902.e34KaxiLc3eQc40LaxqMbN4OaN8Te0?text=&docid=149924&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=181631">decided</a> that copyright owners have the right to seek injunctions against Internet service providers (ISPs) requiring the ISPs to block access to pirate websites illegally streaming or making copyright material available for download.The case arose out of a dispute in Austria between two movie companies and an Austrian ISP, UPC Telekabel Wien GmbH. The movie companies were concerned about access to an illegal streaming site, Kino.to, which was making copies of films such as <a href="http://www.imdb.com/title/tt1167599/">Vicky the Viking</a> and <a href="http://www.imdb.com/title/tt1149362/">The White Ribbon</a> available to its subscribers. The Austrian Supreme Court had asked the CJEU whether the movie companies were entitled under European law to seek an injunction against the ISP, not just against the illegal streaming site.EU law allows holders of intellectual property rights to seek an injunction against any “intermediary” that provides services to third parties and, in doing so, helps them to infringe copyrighted works. The Austrian Supreme Court asked the CJEU for a ruling on whether ISPs in this position were considered to be an intermediary for the purposes of the European legislation.The CJEU answered in the affirmative, finding that “a person who makes protected subject matter available to the public on a website without the agreement of the right holder is using the services of the business which provides internet access to persons accessing that subject matter.” So, in effect, an ISP such as UPC Telekabel that allows its customers to access protected subject matter made available to the public on the Internet by a third party is an intermediary whose services are used to infringe copyright.The ISP had argued that it could not be held responsible for the material on the streaming site because it had no business relationship or cooperation with the operators of the unauthorized streaming site and because there was no proof that any of the ISP’s subscribers had actually used Kino.to to access pirated films.The CJEU had little sympathy for the ISP. It noted that EU copyright law does not require there to be a specific relationship between the person infringing copyright and the intermediary against whom an injunction might be sought, nor is it necessary to prove that end users have actually used the site at issue.To some extent, the decision is not surprising—but it is important that it comes from Europe’s highest court. Previously, in a case in 2011 in the UK, the Motion Picture Association of America and various film studios sought an injunction against BT, a UK ISP, seeking to block access to a website that facilitated the sharing of materials infringing their copyrights.In that case, the infringing website, www.newzbin.co.uk, had originally been shut down following legal action but then immediately reappeared outside the UK and therefore not within the UK court’s jurisdiction. As a result, the claimants stepped up a level and applied for an injunction against BT as the ISP. BT argued that it did not have actual knowledge of the infringements, that it was a mere conduit and that an ISP was not obligated to monitor activity over its service.In that case, the judge did not feel the need to refer the case to the CJEU and proceeded to grant the injunction. He held that BT had actual knowledge that some form of copyright infringement was happening in the sense that BT was aware that the service was being used to infringe—but it was not necessary to show actual knowledge of any specific instances of infringement.The Telekabel case goes further and is more broadly-based than the BT case—which will be of considerable comfort to copyright holders. The film industry has been seeking to enforce copyright rights against illegal streaming sites for some time, and the CJEU’s decision in this case is of significant importance in underlining that a key weapon in that fight—the ability to seek injunctions against the ISPs that facilitate access to online streaming sites—is valid.Other copyright owners may be sharpening their swords for battle in the European courts.

Autodesk

HM Revenue and Customs

Home Office, Department for Communities and Local Government, Department of Health

Intel

ITworx

lastminute.com

NYSE-listed health tech company

Alistair Maughan

The Umpire Strikes Back: European Court Rules That ISPs Can Be Forced to Block Pirate Websites