Chapter 11 Special Topics in Online Privacy

Laissez-faire: French for:

"let people do as they choose"

Remedies that the FTC or the courts have imposed include

(1) cease and desist orders; (2) civil penalties, consumer redress, and other monetary remedies; and (3) corrective advertising, disclosures and other informational remedies.

Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act):

A federal law establishing civil and criminal liability for unsolicited commercial e-mail Has Criminal provisions are for sending sexually explicit email that fails to include a label designating it as sexually explicit. However only the FTC, and certain other state and fed. Agencies have standing to sue!! Also on the civil side, cannot have misleading subject headings... (so spam is not stopped....you just know that it is spam - preempts most state anti-spam statutes and also removed private rights of action granted in state anti-spam statutes.. • the Ninth Circuit's landmark decision in Gordon limits the ability of private plaintiffs to bring a private action under the CAN-SPAM

Federal Trade Commission Act

A federal law that prohibits unfair or deceptive acts or practices in the marketplace, including Internet advertising - Adware - Phishing

Standing

A party's right to make a legal claim or seek judicial enforcement of a duty or right.

Data Mining

A series of techniques used to extract intelligence from vast stores of digital information. • Also defined as encompassing a wide spectrum of data-based activities ranging from "subject-based" searches for information on specified individuals to "pattern-based" searches for unusual or predetermined patterns of activities or relationships.

Online Privacy Policies

An online privacy policy generally outlines for consumers and visitors the data practices of a particular company or organization. • Google's policy addresses 4 of the basic information privacy principle: - Notice - Consent, - Security, and - Access • Specifically, Google's privacy policy has provisions for the kind of information collected, the intended use of information gathered, the availability of opt-out procedures, the data security measures in place, and how the consumer might access the information that is collected.

Miscellaneous Federal & State Claims

Besides the CAN-SPAM Act and FTC Act, plaintiffs may bring actions for unlawful online advertising practices under other federal and state laws, such as the Computer Fraud and Abuse Act and various state laws. • Click Fraud Purposeful: clicks on advertisements by someone other than a potential customer. Click fraud generally encompasses any click made in bad faith.

federal and state laws govern online advertising and marketing

Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act) and the Federal Trade Commission Act (FTC Act).

What does FTC regulate?

False/Deceptive Advertising online buzz marketing and endorsements, including online customer testimonials and celebrity endorsements • "Buzz marketing" is a technique that attempts to generate conversations among and with current and potential customers

Co regulation

Government and industry share responsibility in setting goals, developing rules, and enforcing standards

Internet Search Queries

Internet search queries can contain very sensitive and personal information (e.g. medical information, social security number

U.S. v. Miller

No reasonable expectation of privacy exists in information held by third parties under the Fourth Amendment - Applies to data mining

Workplace Privacy

Private public employer distinction - Generally reduced expectation of privacy in workplace Public employees: For public employees, the courts use the reasonable expectation of privacy test to determine whether a government search of a private (employee) workplace violates an employees 4th amendment rights. Private employees: Are limited in their protection to the laws of the particular state in which they work. Many states have adopted constitutional provisions of right to privacy for employees in the work place, and some state constitutions have been interpreted to have it. NOTE: Courts have found no reasonable expectation of privacy in an employees workplace computer when the employer notifies the employee of the policy, see, U.S. v. Ziegler and Biby v. Bd of Regents Nebraska

Cybersecurity Informations Sharing Act (CISA) PROPOSED

Session of the US Senate voted 74 to 21 to pass a version of CISA that roughly mirrors legislation passed in the House earlier this year, paving the way for some combined version of the security bill to become law. CISA is designed to stem the rising tide of corporate data breaches by allowing companies to share cyber security threat data with the Department of Homeland Security, who could then pass it on to other agencies like the FBI and NSA, who would in theory use it to defend the target company and others facing similar attacks. That landslide vote was no doubt fueled in part by a year of massive hacks that hit targets including the health insurer Anthem, Sony, and the Office of Personal Management. CISA has not yet been acted on by the House, and is not law

CAN-SPAM Act Remedies

Statutory damages of up to $100 per violating message and $1,000,000 in aggregate along with reasonable costs....including reasonable Attorneys' Fees. • The Act also allows for treble damages, or 3x the amount otherwise available, for aggregated or willful violations. • Criminal penalties also available - individual found guilty of fraud or other intentionally deceptive violations could be sentenced up to 5 years in prison • FTC can bring enforcement actions against companies that violate CANSPAM

Privacy Issues w/ SM: Miller Case

The 4th amendment does not prohibit the obtaining of information revealed to a 3rd party even if given to the 3rd party in confidence individuals have no reasonable expectation of privacy under the 4th Amendment when they disclose information to a 3rd party. Individuals have a right to keep information private, but once they share it with others, privacy rights end.

Social Networking Sites

Web based services that allow individuals to: 1. Construct a public or semi public profile within a bounded system. 2. Articulate a list of other users with whom they share a connection; 3. View and traverse their list of connections and those made by others within the system.

Self Reg. vs. Gov. Reg.

While some groups and policy-makers favor government regulation to set strict limits in addressing online privacy, other groups argue that self-regulation offers a better approach Supporters of self-regulation contend that Internet businesses already have a market incentive to protect user privacy to avoid losing customers Government regulation is slow with the ever-changing nature of the Internet, while self-regulation can better predict and respond to new changes in technology.

Self Regulation

a regulatory system in which business representatives define and enforce standards for their sector with little or no government involvement. • Self-regulation has so far prevailed over government regulation when it comes to the protection of online privacy.

FTC's Deception Policy Statement

an ad is deceptive if it contains a material statement that is likely to mislead consumers acting reasonably under the circumstances.

FTC's Unfairness Policy Statement

an ad or business practice is unfair if it causes or is likely to cause substantial consumer injury which a consumer could not reasonably avoid and it is not outweighed by the benefit to consumers.

Adware

any software application that displays advertising banners while the program is running - Zango Inc. paid 3 million $ to settle claim that in downloading their free software results in the installation of adware as being deceptive

Data Brokers

are entities that collect and sell commercial data, including personally identifiable information, to others, including governments. • Increasingly, data brokers extract and analyze personal information from online sources along with public records and other publicly available information ChoicePoint, Acxiom, and LexisNexis are three of the leading commercial data brokers. A few states: Maine, N.H., and Vt have adopted data mining laws/regulations. First Amendment issues with data mining laws. Under current federal and state law, data mining is largely unregulated

It encouraged commercial websites to follow the core principles of

notice/awareness, choice/consent, access/participation, integrity/security, and enforcement/redress. • most fundamental principle is notice.

Phishing

the sending of a fraudulent electronic communication that appears to be a genuine message from a legitimate entity or business for the purpose of inducing the recipient to disclose sensitive personal information