Litigation Risks of Sharing Internet User Data with Third Parties · 2013. 9. 10. · • The Flash...

Litigation Risks of Sharing Internet User Data with Third Parties:

How to Avoid Becoming aClass Action Defendant

Tonia Klausner

March 10, 2011

Agenda

• Overview of recent privacy class actions

• Steps that may reduce risks

• Q & A

Understanding the Risks of Class Action Suits in the Privacy Arena

• Why should you care? • Significant increase in lawsuits aimed at sharing of

on-line user data

• Although no actual harm, cases invoke statutory claims with statutory damages provisions

• Class action = bet-the-company case

Million Dollar Money Drop

Illustrative Cases

• The Facebook Beacon Lawsuits

– Beacon partners shared customer purchasing data with Facebook

Illustrative Cases

• Facebook Beacon – Claims Asserted:

– Electronic Communications Privacy Act

• $10,000 per violation

– Computer Fraud and Abuse Act

• Minimum $5,000 per violation

– Video Privacy Protection Act

• $2,500 per violation

– And others!

Illustrative Cases

• Tentative settlement amount:

????

??

??

????

??

??

??

?? ??

??

??

????

????

?

?

??

?

?

?

? ?

?

?

??

?

Illustrative Cases

$9.5 million

Illustrative Cases

• The Flash Cookie Lawsuits– Advertising companies

in alleged collusion with affiliates’ websites set “flash-cookies” on online users’ web browsers to circumvent privacy and security control settings

Illustrative Cases

• Flash Cookie – Claims Asserted:

– Computer Fraud and Abuse Act

• Minimum $5,000 per violation

– Cal. Computer Crime Law

– Cal. Invasion of Privacy Penal Law

– Cal. Consumer Legal Remedies Act

– Cal. Unfair Competition Law

– Trespass to Chattels

– Unjust Enrichment

Illustrative Cases

• Tentative settlement amount:

Illustrative Cases

$2.4 million

Illustrative Cases

• Additional Suits:

– Apple Apps

– Affiliate Up-sell

– Facebook Gaming App

– History Sniffing

– Deep Packet Inspection

– More flash cookies

Steps that May Reduce Litigation Risk

1. Clear disclosure in terms of use or privacy policy

Steps that May Reduce Litigation Risk

2. Customer agreement to arbitrate dispute with class action waiver

Steps that May Reduce Litigation Risk

3. Conspicuous opt out at time of collection

Steps that May Reduce Litigation Risk

4. Clear and specific opt In

Steps that May Reduce Litigation Risk

5. Indemnification provision

Litigation Risks of Sharing Internet User Data

Q & A

Citations & References

• Case Citations– Lane v. Facebook, Inc., No. 5:08-cv-03845-RS (N.D. Cal.)

– Harris v. Blockbuster Inc., No. 2:08-cv-00155-DF (E.D. Tex.)

– In re Facebook Privacy Litigation, No. 10-cv-02389-JW (N.D. Cal.)

– White v. Clearspring Technologies, Inc., No. 2:10-cv-05948-UA (C.D. Cal.)

– La Court v. Specific Media, Inc., No. 8:10-cv-01256-JVS-VBK (C.D. Cal.)

– Valdez v. Quantcast Corp. No. 2:10-cv-05484-GW-JCG (C.D. Cal.)

– L.S. v. WebLoyalty.com, Inc. et al, No. 3:10-cv-01372-CSH (D. Conn.)

– Rodimer v. Apple, No. 5:11-cv-00700-PSG (N.D. Cal.)

– In re Zynga Privacy Litigation, No. 10-cv-04680 (N.D. Cal.)

– Bose v. McDonald’s Corp., No.10-civ-9569 (S.D.N.Y.)

– Mortensen v. Bresnan Communications, L.L.C., No. cv-10-13-BLG-RFC (D. Mon.)

Citations & References

• Other references:

– Preliminary FTC Staff Report, Protecting

Consumer Privacy in an Era of Rapid

Change, A Proposed Framework For

Business and Policymakers (Dec. 2010)

– Aleecia M. McDonald & Lorrie Faith Cranor, A

Survey of the Use of Adobe Flash Local

Shared objects to Respawn HTTP Cookies

(Carnegie Mellon Univ. Jan. 31, 2011)

Privacy Class Defensive Check List

• Privacy policy and terms of use

– Clear and prominent disclosure of data sharing practice

– Express affirmative consent by clicking “I have read and agree to be bound” box at bottom of display of TOU

• Class Action Waiver

– Clear and conspicuous in terms of use

– Cannot be substantively modified without notice to the user

– Mechanism in place to notify users of substantive changes

• Opt-outs (if in use)

– Clearly and prominently presented prior to sharing of data

– Easy to find mechanism to change preference

• Opt-in

– Clearly and prominently presented prior to sharing of data

– Easy to find mechanism to change preference

• Indemnification provision in affiliate agreement

– Covers defense cost and any judgment

– Permits company to control defense include selection of counsel of its choice

Contact Information

Tonia Klausner

1301 Avenue of the Americas

40th FloorNew York, NY 10019

Phone | 212-999-5800Email: tklausner@wsgr.com