Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

Social Links: Going Back to Cali

LinkedIN

In the pre-Facebook era, the word “like” was primarily a verb (and an interjection sprinkled throughout valley girls’ conversations). Although you could have likes and dislikes in the sense of preferences, you could not give someone a like, claim to own a like or assert legal rights in likes. Today, however, you can do all of these things and more with Facebook likes and similar constructs on other social media platforms, such as followers, fans and connections. This article explores the emerging legal status of likes and similar social media constructs as the issue has arisen in a number of recent cases.Likes as Protected SpeechOne of the early cases to delve into the legal status of likes was <a href="http://www.ca4.uscourts.gov/Opinions/Published/121671.P.pdf" target="_blank" rel="noopener">Bland v. Roberts</a>, which addressed the issue of whether a Facebook like constitutes protected speech for purposes of the First Amendment. In Bland, five former employees of the Hampton Sheriff’s Office brought a lawsuit against Sheriff Roberts, alleging that he violated their First Amendment rights to freedom of speech and freedom of association when he fired them, allegedly for having supported an opposing candidate in the local election. In particular, two of the plaintiffs had “liked” the opposing candidate’s Facebook page.Although (as we discussed <a href="https://www.sociallyawareblog.com/2012/05/21/whats-not-to-like/" target="_blank" rel="noopener">previously</a>) the district court held that merely liking a Facebook page was insufficient speech to merit constitutional protection, on appeal the Fourth Circuit reversed and held that liking a Facebook page does constitute protected speech. The Fourth Circuit looked at what it means to like a Facebook page and concluded: “On the most basic level, clicking on the ‘like’ button literally causes to be published the statement that the User ‘likes’ something, which is itself a substantive statement.” The Fourth Circuit also found that liking a Facebook page is symbolic expression because “[t]he distribution of the universally understood ‘thumbs up’ symbol in association with [the] campaign page, like the actual text that liking the page produced, conveyed that [the plaintiff] supported [the opposing candidate’s] candidacy.” The Court analogized liking the opposing candidate’s Facebook page as the “Internet equivalent of displaying a political sign in one’s front yard, which the Supreme Court has held is substantive speech.”Likes as PropertyPerhaps most interestingly from a business perspective, various cases have explored the question of ownership of a like (and similar concepts, such as a Twitter follower or LinkedIn connection).  In <a href="https://www.docketalarm.com/cases/Florida_Southern_District_Court/0--13-cv-61582/Mattocks_v._Black_Entertainment_Television_LLC/101/" target="_blank" rel="noopener">Mattocks v. Black Entertainment Television LLC</a>, the plaintiff Mattocks created an unofficial Facebook fan page focused on the television series The Game, which at the time was broadcast on the CW Network (BET later acquired the rights to The Game from the CW Network). BET eventually hired Mattocks to perform part-time work for BET, including paying her to manage the unofficial fan page. During the course of that relationship, BET provided Mattocks with BET logos and exclusive content to display on the fan page, and both Mattocks and BET employees posted material on the fan page. While Mattocks worked for BET, the fan page’s likes grew from around two million to over six million.Mattocks and BET began discussions about Mattocks’ potential full-time employment at BET but, at some point during these discussions, Mattocks demoted BET’s administrative access to the fan page. After losing full access to the fan page, BET asked Facebook to “migrate” fans of the page to another official Facebook fan page created by BET.  Facebook granted BET’s request and migrated the likes to the other BET-sponsored page.  Facebook also shut down Mattocks’ fan page. Mattocks then sued BET in the Southern District of Florida, alleging, among other things, that BET converted a business interest she had in the fan page by migrating the likes. Mattocks argued that the page’s “significant number of likes” provided her with business opportunities based on companies paying to have visitors redirected to their sites from the page.  BET moved for summary judgment.The district court granted BET’s motion for summary judgment on Mattocks’ conversion claim, holding that Mattocks failed to establish that she owned a property interest in the likes. The court explained that “liking” a Facebook page simply means that the user is expressing his or her enjoyment or approval of the content, and that the user is always free to revoke the like by clicking an unlike button. Citing Bland (discussed above), the court stated that “if anyone can be deemed to own the ‘likes’ on a [Facebook page], it is the individual users responsible for them.”  Given the tenuous relationship between the creator of the Facebook page and the likes of that page, the court held that likes cannot be converted in the same manner as goodwill or other intangible business interests.In <a href="https://cases.justia.com/federal/district-courts/california/candce/3:2011cv03474/243145/28/0.pdf" target="_blank" rel="noopener">PhoneDog v. Kravitz</a>, the district court for the Northern District of California denied defendant Kravitz’s motion to dismiss plaintiff PhoneDog’s claims for, among other things, conversion of the Twitter account “@PhoneDog_Noah.” PhoneDog, a mobile news and reviews website, employed Kravitz as a product reviewer and video blogger. Kravitz maintained the Twitter account “@PhoneDog_Noah,” which he used to post product reviews, eventually accumulating 17,000 Twitter followers. At the end of Kravitz’s employment, PhoneDog requested that Kravitz relinquish use of the Twitter account. Kravitz refused, changed the Twitter handle to “@noahkravitz” and continued to use the account.PhoneDog claimed an “intangible property interest” in the Twitter account’s followers, which PhoneDog compared to a business customer list. Kravitz disputed PhoneDog’s ownership interest in either the Twitter account or its followers, based on Twitter’s terms of service, which state that Twitter accounts belong to Twitter and not to Twitter users such as PhoneDog. Kravitz also argued that Twitter followers are “human beings who have the discretion to subscribe and/or unsubscribe” to the account and are not PhoneDog’s property. The court held that there was insufficient evidence to determine whether or not PhoneDog had any property interest in the Twitter followers, and denied Kravitz’s motion to dismiss. PhoneDog and Kravitz subsequently settled the dispute so we will never know how the court would have ruled on this issue, but the court’s refusal to dismiss PhoneDog’s ownership claims may indicate that, at least in some circumstances, Twitter followers may constitute property.The district court in the Eastern District of Pennsylvania looked at a similar issue involving ownership of a LinkedIn account in Eagle v. Morgan. Plaintiff  Linda Eagle established a LinkedIn account using the email address of Edcomm, the banking education company that she co-founded with Clifford Brody. As CEO of Edcomm, Brody embraced LinkedIn as a sales and marketing tool for the Edcomm business. Although Edcomm did not require employees to maintain or subsidize the maintenance of LinkedIn accounts, it did develop policies with respect to employee use of such accounts.When Eagle (and Brody) were involuntarily terminated after Edcomm’s acquisition by another company, Edcomm employees accessed Eagle’s LinkedIn account (using the password she had disclosed to certain employees) and changed its password, effectively locking Eagle out of the account. For more than two weeks, Edcomm had full control of the account. During that time, it replaced the account information regarding name, picture, education and experience with information about Sandi Morgan, the newly appointed Interim CEO of Edcomm. As a result, during this time period, an individual conducting a search on either Google or LinkedIn for Eagle (by typing in “Linda Eagle”) would be directed to a URL for a web page showing Sandi Morgan’s name, profile and affiliation with Edcomm. LinkedIn subsequently intervened and restored Eagle’s access to the account.Eagle filed suit against Edcomm, alleging compensatory damages of between $248,000 and $500,000. Eagle used a damages formula that attributed her total past revenue to business generated by the number of connections associated with the LinkedIn account in order to establish a dollar value per LinkedIn connection, and then used that value to calculate her damages for the period of time that she was unable to access the LinkedIn account. The court found for Eagle on a number of her claims—including claims for unauthorized use of name under a Pennsylvania statute, invasion of privacy and misappropriation of publicity—but the court ultimately held that Eagle’s damages request was not supported by sufficient evidence, citing, for example, her failure to connect her past sales to use of LinkedIn.Although Eagle’s claim was unsuccessful, the use of LinkedIn connections to support her damages theory demonstrates the potential monetary value of these connections and the importance for companies to be clear with their employees in delineating ownership of social media accounts and associated likes, followers, fans and connections.Likes as Concerted ActivityThere have been a number of National Labor Relations Board (NLRB) decisions that examined whether an employee’s statements on social media constitute “concerted activity”—activity by two or more employees that provides mutual aid or protection regarding terms or conditions of employment—for purposes of the National Labor Relations Act (NLRA).In Pier Sixty LLC, the administrative law judge decided that a Facebook posting made by an employee about his supervisor constituted protected concerted activity under the NLRA, despite being sprinkled with obscenities. The decision held that the posting constituted part of an ongoing sequence of events related to the employees’ dissatisfaction with the manner in which they were treated by their managers. The administrative law judge specifically mentioned that because the employee was friends on Facebook with several other employees, he could anticipate that those other employees, who were also concerned with the supervisor’s demeaning treatment, would see the posting (at the time, the employee had set his Facebook page so that it could only be viewed by his friends).Similarly, in Richmond District Neighborhood Center, a Facebook conversation between two employees was found to be concerted activity under the NLRA because it involved the employees voicing their disagreement with the management’s running of the center. However, the administrative law judge ultimately concluded that the activity was not protected under the NLRA because it “jeopardized the program’s funding and the safety of the youth it serves” and demonstrated that the two employees were “unfit for further service.”Although these two NLRB cases involved postings and conversations on Facebook rather than just likes, it would not be a huge leap for a future NLRB case to hold that a Facebook like constitutes concerted activity in certain circumstances, particularly in light of the Fourth Circuit’s decision in Bland discussed above.* * * *As the legal status of likes, followers, fans and connections continues to develop, we are likely to see more cases in which courts and litigants struggle with the question of whether and in what circumstances these social media constructs constitute valuable business assets and legitimate forms of speech and communication. At least in the legal sense, “like” has come a long way from the valley girl lexicon—like, a really long way.

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.

Aaron Rubin

istock_000027051648illustra-300x300-1.jpg

What’s in a Like?

In the pre-Facebook era, the word “like” was primarily a verb (and an interjection sprinkled throughout valley girls’ conversations). Although you could have li

What’s in a Like?

For many companies, the main question about cloud computing is no longer whether to move their data to the “cloud,” but how they can accomplish this transition. Cloud (or Internet-based on-demand) computing involves a shift away from reliance on a company’s own local computing resources, in favor of greater reliance on shared servers and data centers. Well-known examples of cloud computing services include Google Apps, Salesforce.com, and Amazon Web Services. In principle, a company also may maintain its own internal “private cloud” without using a third-party provider. Since many companies choose to use third-party cloud providers, however, this article will focus on that cloud computing model.Cloud computing offerings range from the provision of IT infrastructure alone (servers, storage, and bandwidth) to the provision of complete software-enabled solutions. Cloud computing can offer significant advantages in cost, efficiency, and accessibility of data. The pooling and harnessing of processing power provides companies with flexible and cost-efficient IT systems. At the same time, however, cloud computing arrangements tend to reduce a company’s direct control over the location, transfer, and handling of its data.The flexibility and easy flow of data that characterize the cloud can raise challenging issues related to protection of data in the cloud. A company’s legal obligations and risks will be shaped by the nature of the data to be moved to the cloud, whether the data involve personal information, trade secret information, customer data, or other competitively sensitive information. This article describes the special legal considerations that apply when moving personal information to the cloud. It also offers a framework to help companies navigate these issues to arrive at a solution that meets their own legal and business needs.Determine the categories of personal information to be moved to the cloudAs a general principle, personal information includes any information that identifies or can be associated with a specific individual. Some types of personal information involve much greater legal and business risks than other types of personal information. For example, a database containing health information will involve greater risks than a database containing names and business contact information of prospective business leads. Also, financial regulators in many countries require specific security standards for financial information. Accordingly, a cloud computing service that may be sufficient for the business lead data may fail to provide the legally required level of protection for health, financial, or other sensitive types of information.A company will want to develop a strategy that provides sufficient protection to the most sensitive personal information to be transmitted to the cloud. In some cases, a company may elect to maintain certain types of personal information internally, in order to take advantage of more cost-efficient cloud computing services for its less-sensitive data.Identify applicable laws affecting your outsourcing of personal informationCloud computing, by its nature, can implicate a variety of laws, including privacy laws, data security and breach notification laws, and laws limiting cross-border transfers of personal information.(a) Privacy LawsCompanies operating in the United States will need to consider whether they are subject to sector-specific privacy laws or regulations, such as the Gramm-Leach-Bliley Act (GLBA) or the Health Insurance Portability and Accountability Act (HIPAA). Such laws impose detailed privacy and data security obligations, and may require more specialized cloud-based offerings.Europe-based companies, as well as companies working with providers in or with infrastructure in Europe, will need to account for the broad-reaching requirements under local omnibus data protection laws that protect all personal information, even basic details like business contact information. These requirements can include notifying employees, customers, or other individuals about the outsourcing and processing of their data; obligations to consult with works councils before outsourcing employee data; and registering with local data protection authorities. Similar requirements arise under data protection laws of many other countries, including countries throughout Europe, Asia, the Middle East, and the Americas.(b) Data Security RequirementsEven if a company is not subject to these types of privacy laws, it will want to ensure safeguards for personal information covered by data security and breach notification laws. In the United States, these laws tend to focus on personal information such as social security numbers, driver’s license numbers, and credit or debit card or financial account numbers. One of the key safeguards is encryption because many (although not all) of the U.S. state breach notification laws provide an exception for encrypted data.In contrast, many other countries require protection of all personal information, and do not necessarily provide an exception for encrypted data. Consequently, companies operating outside of the United States may have broader-reaching obligations to protect all personal information. While data protection obligations vary significantly from law to law, both U.S. and international privacy laws commonly require the following types of safeguards:i. Conducting appropriate due diligence on providers;ii. Restricting access, use, and disclosure of personal information;iii. Establishing technical, organizational, and administrative safeguards;iv. Executing legally sufficient contracts with providers; andv. Notifying affected individuals (and potentially regulators) of a security breach compromising personal information.The topic of data security in the cloud has received significant industry attention. Industry groups, such as the Cloud Security Alliance, have suggested voluntary guidelines for improving data security in the cloud. For example, please refer to the CSA’s Security Guidelines for Critical Areas of Focus for Cloud Computing, available at <a href="https://cloudsecurityalliance.org/download/security-guidance-for-critical-areas-of-focus-in-cloud-computing-v3/" target="_blank" rel="noopener">https://cloudsecurityalliance.org/download/security-guidance-for-critical-areas-of-focus-in-cloud-computing-v3/</a>. In Europe, the Cloud Select Industry Group (CSIG), an industry group sponsored by the European Commission, recently issued the Cloud Service Level Agreement Standardization Guidelines, available at <a href="http://ec.europa.eu/digital-agenda/en/news/cloud-service-level-agreement-standardisation-guidelines" target="_blank" rel="noopener">http://ec.europa.eu/digital-agenda/en/news/cloud-service-level-agreement-standardisation-guidelines</a>. The Guidelines recommend contractual stipulations covering (1) business continuity, disaster recovery, and data loss prevention controls; (2) authentication/authorization controls, including access provision/revocation, and access storage protection; (3) encryption controls; (4) security incident management and reporting controls and metrics; (5) logging and monitoring parameters and log retention periods; (6) auditing and security certification; (7) vulnerability management metrics; and (8) security governance metrics. Providers also may choose to be certified under standards such as ISO 27001, although such certifications may not address all applicable legal requirements.(c) Restrictions on Cross-Border Data TransfersA number of countries—e.g., all the European Economic Area (EEA) Member States and certain neighboring countries (including Albania, the Channel Islands, Croatia, the Faroe Islands, the Isle of Man, Macedonia, Russia, and Switzerland), as well as countries in North Africa (e.g., Morocco), the Middle East (e.g., Israel), Latin America (e.g., Argentina and Uruguay), and Asia (e.g., South Korea)—restrict the transfer or sharing of personal information beyond their borders. These restrictions can present significant challenges for multinational companies seeking to move their data to the cloud. Recognizing these challenges, some providers are starting to offer geographic-specific clouds, in which the data are maintained within a given country or jurisdiction. Some U.S. providers have also certified to the U.S.-European Union Safe Harbor program, in order to accommodate EU-based customers. However, as the Safe Harbor only permits transfers from the EU to the United States, it is not a global solution. Accordingly, a company should assess carefully whether the options offered by a provider are sufficient to meet the company’s own legal obligations in the countries where it operates.To complicate matters, international data protection authorities, particularly in the EEA, have expressed concerns about use of the cloud model for personal information. The Working Party 29 (WP29), the assembly of EEA data protection authorities, and many other local EEA authorities have issued guidance about cloud computing, covering purpose and transfer restrictions, notification requirements, mandatory security requirements, and the content of the contract to be concluded with cloud providers. This guidance includes the WP29 Opinion 05/2012 on Cloud Computing, which is discussed further below. The draft Data Protection regulation currently discussed among the EEA Member States reflects such guidance and should be accounted for prior to engaging cloud providers.Review contractual obligations affecting your outsourcing of personal informationIf your company is seeking to outsource to a cloud provider applications that involve third-party data, such as personal information maintained on behalf of customers or business partners, it is important to consider any limitations imposed by contracts with those third parties. Such agreements might require third-party consent to the outsourcing or subcontracting of data processing activities, or may require your company to impose specific contractual obligations on the new provider or subcontractor.Select an appropriate cloud computing solutionCloud services tend to be offered on a take-it-or-leave-it basis, with little opportunity to negotiate additional contractual protections or customized terms of service. As a result, companies may find themselves unable to negotiate the types of privacy and data security protections that they typically include in contracts with other service providers. Companies will need to evaluate whether the contract fulfills their applicable legal and contractual obligations, as discussed above. Beyond that, companies will want to evaluate the practical level of risk to their data, and what steps they might take to reduce those risks.(a)   Public vs. Private CloudBroadly speaking, a private cloud maintains the data on equipment that is owned, leased, or otherwise controlled by the provider. Private cloud models can be compared with many other well-established forms of IT outsourcing and do not tend to raise the same level of concerns as a public cloud model.A public cloud model disperses data more broadly across computers and networks of unrelated third parties, which might include business competitors or individual consumers. While offering maximum flexibility and expansion capabilities, the public cloud model raises heightened concerns about the inability to know who holds your company’s data, the lack of oversight over those parties, and the absence of standardized data security practices on the hosting equipment. Given these challenges, companies outsourcing personal information will want to understand whether the proposed service involves a private or public cloud, as well as evaluate what contractual commitments the provider is willing to make about data security.(b)   Securing Data Before Transmission to the CloudCompanies also may be able to take measures themselves to protect personal information before it is transmitted to the cloud. Some provider agreements instruct or require customers to encrypt their data before uploading the data to the cloud, for example. If it is feasible to encrypt the data prior to transmission to the provider, this may provide substantial additional protections, as long as the encryption keys are not available to the provider.It is also important to account for applicable security requirements. To this effect, several countries in Europe have very specific statutory requirements for security measures, and some regulators have issued detailed security standards for cloud computing providers. Pursuant to the WP29 Opinion 05/2012, all contracts should include  security measures in accordance with EU data protection laws, including requirements for cloud providers on technical and organizational security measures, access controls, disclosure of data to third parties, cooperation with the cloud client, details on cross-border transfer of data, logging, and auditing processing. The recent guidelines from the CSIG recommends the inclusion of the following provisions in processing agreements: (1) standards or certification mechanisms the cloud service provider complies with; (2) precise description of purposes of processing; (3) clear provisions regarding retention and erasure of data; (4) reference to instances of disclosure of personal data to law enforcement and notification to the customer of such disclosures; (5) a full list of subcontractors involved in the processing and inclusion of a right of the customer to object to changes to the list, with special attention to requirements for processing of special or sensitive data; (6) description of data breach policies implemented by the cloud service provider including relevant documentation suitable to demonstrate compliance with legal requirements; (7) clear description of geographical location where personal data is stored or processed, for purposes of implementing appropriate cross-border transfer mechanisms; and (8) time period necessary for a cloud service provider to respond to access, rectification, erasure, blocking, or objection requests by data subjects.(c)   Contract IssuesIn the majority of cloud computing services, the client is the data controller and the cloud provider is the data processor. However, in certain scenarios (in particular Platform as a Service (PaaS) and Software as a Service (SaaS) in public computing models), the client and the cloud provider may be joint controllers. Under EU guidance, the responsibilities of joint controllers must be very clearly set out in the contract to avoid any “dilution” of legal responsibility.The contract with the cloud services provider needs to set out clearly the roles and responsibilities of the parties. Unlike many outsourcing arrangements, cloud service contracts usually do not distinguish between personal information and other types of data. These contracts may still include at least basic data protection concepts, even if they are not expressly identified as such. At a minimum, companies will want to look for provisions preventing the provider from using the information for its own purposes, restricting the provider from sharing the information except in narrowly specified cases, and confirming appropriate data security and breach notification measures. Various European data protection authorities have underscored that access to cloud data by public authorities must comply with national data protection law and that the contract should require notification of any such requests unless prohibited under criminal law and should prohibit any non-mandatory sharing. Given the difficulty of negotiating special arrangements with cloud providers, it is important to select a cloud offering that is appropriately tailored to the nature of the data and the related legal obligations. It is likely that as cloud computing matures, more offerings tailored to specific business requirements, including compliance with privacy and similar laws, will be made available to companies.Concluding thoughtsWhile cloud computing can substantially improve the efficiency of IT solutions, particularly for small and medium-sized businesses, the specific offerings need to be examined closely. There is no “one-size-fits-all” solution to cloud computing, especially for companies operating in highly regulated sectors or internationally. By understanding their legal compliance obligations, companies can make informed decisions in selecting cloud computing services or suites of services that best meet their needs.

image21-300x300-1.jpg

Privacy in the Cloud: A Legal Framework for Moving Personal Data to the Cloud

Privacy in the Cloud: A Legal Framework for Moving Personal Data to the Cloud

For many companies, the main question about cloud computing is no longer whether to move their data to the “cloud,” but how they can accomplish this transition.

From our sister blog, MoFo Tech:Within a decade, analysts say, the “Internet of Things” will have transformed our lives. Billions of Internet-connected devices will monitor our homes, businesses, cars, and even our bodies, using the data to manage everything from appliances to heart monitors. Companies like Google— which recently paid $3.2 billion for smart-thermostat company Nest Labs—are already racing to build the IoT. But businesses face fundamental questions regarding the ownership of data, protecting customer privacy, liability when devices fail, and more.The IoT will connect product developers and manufacturers in countless new ways, creating uncertainty about ownership of and rights to customer data. If a company contracts with a big data vendor to store and process consumer information, for instance, each party will need to know that its partner has the legal rights to collect or share data, says Alistair Maughan, a partner in Morrison & Foerster’s London office who is co-chair of the Technology Transactions Group. Then there is the question of who owns the data. “There is a whole supply chain the law is only beginning to grapple with,” Maughan says. “Manufacturers will need to understand the risks when there aren’t clear government standards.”An area of major interest is how companies will protect customer privacy when so much data is in play. Companies need to make sure that what they say about their use of data collected from connected devices is accurate, complete, and up to date. “There is no one-sizefits-all approach to data security,” says Morrison & Foerster partner D. Reed Freeman Jr., who specializes in privacy matters. “The burden for a company is to consider what kind of data you have and how to protect against reasonably foreseeable, unauthorized access to personal information.”Liability, of course, is a paramount concern when connected businesses adjust their use of data for new business or consumer products, says Stephanie Sharron, a Morrison & Foerster partner and a member of the firm’s Technology Transactions Group. Using vast sets of data to find patterns and targets will leave open all sorts of possibilities for technical and human mistakes. “There are questions about who should bear responsibility for inaccurate inferences or patterns that give rise to harm,” Sharron says. “Or who is responsible if a pattern comes from inaccurate data from a malfunctioning sensor.”Then there is the question of who will manage and monitor the electrical systems needed to operate such vast networks—traditional public utility companies, new electricity market participants, or a combination. “Customers will want more choices to accommodate the new technologies and services they get to use” in the IoT, says Robert S. Fleishman, senior of counsel for Morrison & Foerster and an expert on energy regulation law. “Generally it will be up to state public utility commissions to decide who gets to provide the traffic control function and related activities for these things to operate within the system for distributing energy.” Some state utility commissions have already started to look at reforming their regulations and policies.

Entangled in the Web of Things. By Finding New Uses for Data, the Internet of Things Heralds a Host of Challenges.

From our sister blog, MoFo Tech: Within a decade, analysts say, the “Internet of Things” will have transformed our lives. Billions of Internet-connected devices

Entangled in the Web of Things. By Finding New Uses for Data, the Internet of Things Heralds a Host of Challenges.

Not to be outdone by Florida, California has yet again amended its data security breach law and again in groundbreaking (yet confusing) fashion. On September 30, 2014, California Governor Brown signed into law a bill (<a href="http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140AB1710" target="_blank" rel="noopener">“AB 1710”</a>) that appears to impose the country’s first requirement to provide free identity theft protection services to consumers in connection with certain data security breaches. The law also amends the state’s personal information safeguards law and Social Security number (“SSN”) law. The amendments will become effective on January 1, 2015.Free Identity Theft Protection Services Required for Certain Breaches Most significantly, AB 1710 appears to amend the California breach law to require that a company offer a California resident “appropriate identity theft prevention and mitigation” services, at no cost, if a breach involves that individual’s name and SSN, driver’s license number or California identification card number. Specifically, AB 1710 provides, in pertinent part, that if a company providing notice of such a breach was “the source of the breach”:an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached.The drafting of this requirement is far from clear and open to multiple readings. In particular, the use of the phrase “if any” can be read in multiple ways. For example, the phrase “if any” can be read to modify the phrase “appropriate identity theft prevention and mitigation services.” Under this reading, the law would impose an obligation to provide free identity theft protection services if any such services are appropriate. The phrase “if any,” however, could be read to modify the “offer” itself. Under this alternate reading, the law would provide that if a company intends to offer identity theft protection services, those services must be at no cost to the consumer. It is difficult to know how the California Attorney General (“AG”) or California courts will interpret this ambiguity. One thing is clear: until the AG or courts opine, the standard will remain unclear.The drafting of the requirement also is not clear in other ways. For example, the statute does not specify what type of services would qualify as “appropriate identity theft prevention and mitigation services.” For example, would a credit monitoring product alone be sufficient to meet the requirement? Or would the law require something in addition to credit monitoring, such as an identity theft insurance element?Nonetheless, state AGs historically have encouraged companies to provide free credit monitoring to consumers following breaches. In addition, even though not legally required, free credit monitoring has become a common practice, particularly for breaches involving SSNs and also increasingly for high-profile breaches. Nonetheless, California appears to be the first state to legally require that companies offer some type of a free identity theft protection service for certain breaches.AB 1710 is particularly notable in its approach. First, the offer of free identity theft protection services will only be required for breaches involving SSNs, driver’s licenses or California identification card numbers. In this regard, an offer of free identity theft protection services will not be required for breaches involving other types of covered personal information, such as payment card information or usernames and passwords. This approach endorses a position that many companies have long held—that credit monitoring is appropriate only when the breach creates an actual risk of new account identity theft (as opposed to fraud on existing accounts). In addition, the offer of free identity theft protection services will only be required for a period of one year (as opposed to, for example, two years). The length of the offer of free credit monitoring has always been an issue of debate, and California has now endorsed a position that a one-year offer is sufficient.Service Providers Directly Subject to Safeguards Requirements AB 1710 also amends the California personal information safeguards law to impose the state’s safeguards obligations directly on entities who “maintain” information, even if they do not own that information. The state’s safeguards standard historically required companies that “own or license” covered personal information about California residents to “implement and maintain reasonable security procedures and practices appropriate to the nature of the information” in order to protect the personal information from unauthorized activity. The existing standard did not apply directly to third parties, such as service providers, that maintain information, but do not own it. Instead, the existing standard required that owners of personal information contractually require nonaffiliated third parties to whom they would disclose such information to take steps to protect the information.AB 1710, however, specifically amends the safeguards law to impose its reasonable security procedures and practices standard directly on entities that “maintain” covered personal information, even if they do not “own or license” the data. Moreover, AB 1710 eliminates the requirement to pass-through security obligations by contract to certain third parties. Specifically, AB 1710 provides that the third-party contract requirement does not apply to a company that provides covered personal information to a third party that will now be directly subject to the safeguards standard (i.e., a third party that “maintains” covered personal information). As a result, the third-party contract requirement would appear to apply only when a company discloses covered personal information to a nonaffiliated third party that will handle such data, but not “maintain” it.New Prohibition on Sale of SSNSFinally, AB 1710 amends the California SSN law to prohibit any person from selling, advertising for sale or offering to sell an individual’s SSN. Moreover, AB 1710 specifically provides that the “[r]elease of an individual’s [SSN] for marketing purposes is not permitted.” This new prohibition on the sale of SSNs, however, will not apply: (1) if the disclosure of the SSN is incidental to a larger transaction and is necessary to identify the individual in order to accomplish a legitimate business purpose; or (2) for a purpose specifically authorized or allowed by federal or state law. Although AB 1710’s limitation on the sale of SSNs is unique among the many state SSN laws, other state SSN laws do include similar prohibitions, such as the Alaska, Minnesota, North Carolina, South Carolina and Vermont laws.Practical Implications for Businesses The California requirement regarding free identity theft protection services for certain breaches adds yet another layer of complexity for a company that suffers a breach. Companies should be prepared to make difficult decisions regarding how to implement the new requirement. For example, companies should consider:<ul><li>Until further guidance is provided by the AG or courts, how will your company interpret the language of the requirement? For example, will your company take the position that AB 1710 does not actually impose a requirement to offer free identity theft protection services?</li><li>What type of “appropriate identity theft prevention and mitigation” services will your company offer when it believes such an offer is required?</li><li>In the event of a breach involving information regarding residents of multiple states, including California, will your company extend an offer of identity theft protection services to residents of states other than California?</li><li>Will your company offer identity theft protection services in connection with breaches involving personal information other than SSN, driver’s license number or California identification card number?</li><li>When your company offers free identity theft protection services, will it provide the offer only for one year? Are there circumstances in which your company will extend an offer for a longer period?</li></ul>As has been historically true, other states may follow California’s lead. As a result, it will be important to monitor state legislative developments, and if a state imposes a similar requirement, determine if it follows a risk-based approach similar to AB 1710.In addition, companies that provide services to others that involve maintaining personal information relating to California residents that is maintained but not owned should be aware that they will be directly subject to the requirements of the California safeguards law. Before AB 1710’s new requirements become effective, such companies should take a fresh look at their security procedures and practices and consider whether they are appropriate and would comply with the California safeguards requirement.

taylor_nathan_blog_150x150.png

taylor_nathan_common_640x280.jpg

taylor_nathan_heroretina_2700x1160.jpg

taylor_nathan_mobileretina_750x1040.jpg

taylor_nathan_social_600x600.jpg

Recognized as an authority on financial privacy issues, Nathan helps financial institutions and other companies develop practical solutions for complying with privacy and data security laws. In partic

Nathan D. Taylor

Nathan Taylor

istock_000037217352large-300x239-1.jpg

Breaking Old Ground: California Again Amends Data Security Breach Law

New California Privacy Law Revisions Will Impact Website and Mobile App Operators With Users Under Age 18

Not to be outdone by Florida, California has yet again amended its data security breach law and again in groundbreaking (yet confusing) fashion. On September 30

Breaking Old Ground:  California Again Amends Data Security Breach Law

As the quality of visual recognition software continues to improve, privacy concerns have grown concomitantly. Because we now document our lives with so many pictures posted to social media—<a href="http://www.businessinsider.com/facebook-350-million-photos-each-day-2013-9" target="_blank" rel="noopener">Facebook hosts over 250 billion photos, with 350 million new photos added every day</a>—photographs are becoming hugely important to the big data movement. Indeed, some say Facebook stores over <a href="http://geekologie.com/2011/09/facebook-hosts-4-of-all-photos-ever-take.php" target="_blank" rel="noopener">4 percent of all the pictures ever taken in history</a>. What truths may lurk behind all those images—and who wants to know?Cutting-edge visual recognition software programs now make it possible not only to identify a person in a photo on Facebook or elsewhere, but also to determine what that person is doing in the photo.There’s already image recognition software, used by the fashion industry, that lets a shopper take a <a href="http://www.theguardian.com/business/2014/apr/20/fashion-retailers-image-recognition-apps-smartphones" target="_blank" rel="noopener">picture on his or her smartphone of a piece of clothing</a> and then match that piece by color, pattern, and shape to the offerings of 170 retailers that sell something similar. That’s a benign use of this technology. But more ominous applications are already emerging.My sense is that this concern is helping to fuel <a href="http://bits.blogs.nytimes.com/2014/01/27/why-i-use-snapchat-its-fast-ugly-and-ephemeral/" target="_blank" rel="noopener">the growth of ephemeral social media sites such as Snapchat</a>, where—<a href="http://www.ftc.gov/news-events/press-releases/2014/05/snapchat-settles-ftc-charges-promises-disappearing-messages-were" target="_blank" rel="noopener">at least in theory</a>—photos don’t sit there in perpetuity to be exploited by data miners; they last all of 10 seconds.After all, imagine all your online photos being processed into a data profile by advertisers or law enforcement, showing where you live, where you’ve been, with whom you hang out and what activities you’ve participated in. If a single picture is worth a thousand words, what are 250 billion photos worth?

istock_000032361456large-300x221-1.jpg

Picture This: Online Photos and Big Data

As the quality of visual recognition software continues to improve, privacy concerns have grown concomitantly. Because we now document our lives with so many pi

Picture This: Online Photos and Big Data

“Web scraping” or “web harvesting”—the practice of extracting large amounts of data from publicly available websites using automated “bots” or “spiders”—accounted for 18% of site visitors and 23% of all Internet traffic in 2013. Websites targeted by scrapers may incur damages resulting from, among other things, increased bandwidth usage, network crashes, the need to employ anti-spam and filtering technology, user complaints, reputational damage and costs of mitigation that may be incurred when scrapers spam users, or worse, steal their personal data.Though sometimes difficult to combat, scraping is quite easy to perform. A simple online search will return a large number of scraping programs, both <a href="http://scraping.pro/software-for-web-scraping/">proprietary</a> and <a href="http://scrapy.org/">open source</a>, as well as <a href="http://blog.hartleybrody.com/web-scraping/">D.I.Y. tutorials</a>. Of course, scraping can be beneficial in some cases. Companies with limited resources may use scraping to access large amounts of data, spurring innovation and allowing such companies to identify and fill areas of consumer demand. For example, <a href="https://www.mint.com/">Mint.com</a> reportedly used screen scraping to aggregate information from bank websites, which allowed users to track their spending and finances. Unfortunately, not all scrapers use their powers for good. In one case on which we <a href="https://www.sociallyawareblog.com/2014/04/10/jerked-around-did-the-ftcs-jerk-com-complaint-just-turn-api-terms-into-federal-law/">previously reported</a>, the operators of the website <a href="http://jerk.com/">Jerk.com</a> allegedly scraped personal information from Facebook to create profiles labeling people “Jerk” or “not a Jerk.” According to the <a href="http://www.ftc.gov/news-events/press-releases/2014/04/ftc-charges-operators-jerkcom-website-deceiving-consumers">Federal Trade Commission</a> (FTC), over 73 million victims, including children, were falsely told they could revise their profiles by paying $30 to the website.Website operators have asserted various claims against scrapers, including <a href="http://www.internetlibrary.com/pdf/Ticketmaster-Tickets.com-SJ-Motion.pdf">copyright claims</a>, <a href="http://law.justia.com/cases/federal/district-courts/FSupp2/100/1058/2478126/">trespass to chattels claims</a> and <a href="http://law.justia.com/cases/federal/appellate-courts/F3/356/393/539823/">contract claims</a> based on allegations that scrapers violated the websites’ terms of use. This article, however, focuses on another tool that website operators have used to combat scraping: the federal <a href="http://www.law.cornell.edu/uscode/text/18/1030">Computer Fraud and Abuse Act</a> (CFAA).The CFAA imposes liability on “whoever…<a href="http://www.law.cornell.edu/uscode/text/18/1030">intentionally accesses a computer without authorization or exceeds authorized access</a>, and thereby obtains…information from any protected computer…” While the CFAA is primarily a criminal statute, it also provides for a civil remedy where a plaintiff suffers more than $5,000 in aggregate losses during any one-year period arising from a violation of the CFAA. For large website operators asserting CFAA claims against scrapers, the $5000 damages requirement has not proven to be a difficult obstacle to overcome. For example, in CollegeSource, Inc. v. AcademyOne, Inc., the District Court for the Eastern District of Pennsylvania found that the plaintiff’s cost of initiating an internal investigation of the defendant’s website, hiring a computer expert to analyze the scope of the defendant’s actions and implementing increased security measures were well in excess of $5,000. Similarly, in <a href="https://www.eff.org/files/filenode/facebook_power_order.pdf">Facebook, Inc. v. Power Ventures, Inc.</a>, the District Court for the Northern District of California found that the plaintiff’s expenditures made in response to defendant’s specific acts, which included three to four days of engineering time, $75,000 in outside counsel costs and the costs of responding to a minimum of 60,000 instances of spamming by defendant, were well in excess of the statutory threshold. The more difficult question is whether scraping violates the CFAA at all.The CFAA was originally intended as an anti-hacking statute and its application to scraping—which, after all, usually involves accessing publicly-available data on a publicly-available website—is not always a foregone conclusion. Does a scraper access a website “without authorization” or “exceed authorized access” when it harvests publicly available data on a publicly available website? Plaintiffs often argue that scrapers act without authorization because the websites’ online terms of use prohibit scraping and/or prohibit the scrapers’ use of the data that they harvest. As discussed below, such claims have met with success in some cases, but courts have been less willing to find a CFAA violation in other scraping cases.In <a href="https://h2o.law.harvard.edu/collages/41836">Cvent, Inc. v. Eventbrite</a>, Cvent sued Eventbrite for scraping Cvent’s website to obtain venue information and using the information in Eventbrite’s “Venue Directory.” Cvent claimed that this was a violation of the CFAA because Cvent’s terms of use specifically stated that such activities were unauthorized. The District Court for the Eastern District of Virginia held that Eventbrite’s actions did not constitute “hacking” in violation of the CFAA because the information was publicly available; Cvent’s website did not require any login, password or other individualized grant of access; and Cvent’s terms of use were difficult to locate. Therefore, the court granted Eventbrite’s motion to dismiss, concluding that Eventbrite was authorized to access the information on Cvent’s website, and that the mere allegation that Eventbrite used the information inappropriately was not grounds for relief under the CFAA.Power Ventures, the defendant in Facebook, Inc. v. Power Ventures, Inc., operated a social media account integration site. As part of a promotion to gain new members, Power Ventures provided users with a list of their Facebook friends, which Power Ventures obtained through scraping the Facebook website, and asked users to select friends to invite to use the Power Ventures site. Facebook notified Power Ventures that its access was unauthorized and blocked Power Ventures’ IP addresses. However, Power Ventures’ scraping technology was designed to circumvent such technological measures and the scraping continued. The District Court for the Northern District of California held that Power Ventures’ accessing of Facebook was without authorization and violated the CFAA and accordingly, granted summary judgment to Facebook on the CFAA claim.CollegeSource, the plaintiff in CollegeSource, Inc. v. AcademyOne, Inc., maintained an archive of college course catalogs in PDF format and a hyperlink service called CataLink, both of which it made available to paying subscribers. AcademyOne, a CollegeSource subscriber, hired a third party to download college catalogs directly from college websites in order to compile a course description database. However, the third party instead copied some of the PDF documents from CollegeSource through CataLink. AcademyOne removed the CollegeSource documents from its system after receiving a cease and desist letter from CollegeSource, but CollegeSource nonetheless proceeded to bring a number of claims against AcademyOne, including CFAA claims based on the argument that AcademyOne accessed the documents without authorization and exceeded authorized access. The court held, however, that AcademyOne did not access the documents without authorization because those documents were available to the general public. CollegeSource’s argument that AcademyOne exceeded authorized access was based on AcademyOne’s alleged violation of CollegeSource’s terms of use. The Court acknowledged that accessing a website in violation of the applicable terms of use has been held to support a CFAA claim in some cases, but was unconvinced by CollegeSource’s argument here because CollegeSource’s subscription agreement did not cover CataLink. Accordingly, the court granted summary judgment to AcademyOne on the CFAA claims. In <a href="http://www.volokh.com/wp-content/uploads/2013/08/Order-Denying-Renewed-Motion-to-Dismiss.pdf">Craigslist Inc. v. 3Taps Inc.</a>, 3Taps allegedly scraped Craigslist’s website and republished Craigslist ads on its own site, craiggers.com.  In response, Craigslist sent 3Taps a cease and desist letter revoking 3Taps’s authorization to access Craigslist’s website for any purpose, and reconfigured the website to block 3Taps.  When 3Taps allegedly continued its scraping activities by using different IP addresses and proxy servers to conceal its identity, Craigslist brought suit under the CFAA.  Even though Craigslist’s website was publicly available, the District Court for the Northern District of California declined to grant 3Taps’ motion to dismiss the CFAA claim.  According to the court, while Craigslist may have granted the world permission to access its website, it retained the power to revoke that permission on a case-by-case basis, a power it exercised when it sent the cease and desist letter and blocked 3Taps’s IP addresses. Therefore, 3Taps’ continued access was without authorization. The court also rejected 3Taps’ attempt to invoke the Ninth Circuit’s decision in United States v. Nosal.  In Nosal, the Ninth Circuit had held that an employee’s use of information in violation of an employer’s policies did not constitute a CFAA violation where the employee’s initial access to the employer’s computer system was authorized.  The court in 3Tap’s concluded, however, that the “calculus is different where a user is altogether banned from accessing a website,” as was the case with 3Taps.Fidlar, the plaintiff in <a href="http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1565&context=historical">Fidlar Technologies v. LPS Real Estate Data Solutions, Inc.</a>, provides its Laredo program to governmental agencies, such as county clerks’ offices, which use Laredo to make public records available for viewing over the Internet. Laredo prevents users from downloading or electronically capturing the documents they view. Users who want a copy of a public record must pay the county a print fee. LPS, a real estate analytics company, contracted with many counties to access their public records using Laredo, but used a scraping program to capture documents electronically without paying any fees. Fidlar sued LPS for violating section 1030(a)(5)(A) of the CFAA, which imposes liability on anyone who “…knowingly causes the transmission of a program, code, or command, and as a result…<a href="http://www.law.cornell.edu/uscode/text/18/1030">intentionally causes damage without authorization, to a protected computer</a>.” The District Court for the Central District of Illinois denied LPS’s motion to dismiss the CFAA claim, holding that Fidlar’s complaint properly alleged that LPS undertook intentional actions that, among other elements of damage, compromised the integrity of Laredo.In light of the cases discussed above, it seems that plaintiffs are likely to have more success asserting CFAA claims against scrapers where they clearly and unambiguously revoke authorization to access their websites and take affirmative steps to block the scrapers, as in 3Taps and Power Ventures. In contrast, when the scraper ceases scraping after access is revoked and takes remedial action, as in CollegeSource, courts may be less willing to impose CFAA liability. As seen in Cvent, a mere terms of use violation, particularly where the scraper may not have actual notice of the terms of use, may not support a CFAA claim. Whether the scraper is simply using software to collect publicly available information more efficiently or to do something else—such as to avoid paying fees for the information, as seen in Fidlar—may also be relevant. In any event, in an era when data is expensive to collect, valuable to have and cheap to take, the CFAA, when properly used, remains a viable tool to combat scrapers.

7-b2-1024x1024-1.jpg

Data for the Taking: Using the Computer Fraud and Abuse Act to Combat Web Scraping

Data for the Taking: Using the Computer Fraud and Abuse Act to Combat Web Scraping