Tag: Information Privacy Law Spring 2013

  • Google AdWords

    By Owen Kirshner

     

    Part 1 – Google AdWords moves a step closer to global acceptance with a win in Australian court. AdWords has been slowly gaining legitimacy throughout the world with some key wins in court. This most recent win follows a complaint by the Australian Competition & Consumer Commission alleging false advertising claims because AdWords advertisers were buying keyword advertising on their competitors trademarks. The High Court of Australia found that Google was an intermediary and was not liable for the advertising practices of their AdWords users. This case follows several in the US and EU that bring the treatment of internet advertising in line with more traditional advertising platforms, affording them protection from secondary liability. http://blog.ericgoldman.org/archives/2013/02/with_its_austra.htm

     

    Part 2 – A Wisconsin court rejected a publicity rights claim in another AdWords dispute. In this case a personal injury law firm brought suit against a competitive firm that had bought the names of the first firm’s partners on AdWords. The court rejected the claim because the plaintiff’s names were used in an invisible way in the AdWords advertising (they merely led to results, but were not displayed in the results themselves) and thus did not fall under the Wisconsin publicity statute. It should be noted that this type of dispute is often brought as a trademark claim where “use” has often been found in the invisible AdWords process. Although Google was not brought into this suit, it’s  clear that despite increasing global acceptance AdWords will continue to raise privacy issues.  http://blog.ericgoldman.org/archives/2013/02/buying_keyword.htm

  • The right to be forgotten – forget it?

    By Emma Peters

     

    The right to be forgotten has been widely criticized – not only as too far reaching but also as technically impossible to implement. These issues, many of which we touched on in class, are addressed in the articles described below:

     

    In the Stanford Law Review, Jeffrey Rosen, Professor of Law at The George Washington University, states that the proposed European legislation will not only seriously alter the structure of the Internet, damage companies like Google, Yahoo and Facebook, but much more important “represents the biggest threat to free speech on the Internet in the coming decade.”

    Rosen starts by acknowledging that the right to be forgotten addresses an urgent problem in the digital age: it is very hard to escape your past on the Internet as every photo, status update and tweet lives forever in the cloud. Nevertheless, Rosen points out that in its present form the right could cause a dramatic clash between European and American conceptions of the proper balance between privacy and free speech. He argues that the right is too vague and broad.

    Rosen notes that the right to be forgotten as it applies to “any information relating to a data subject”. Thus, it covers not only to information posted (only) by the data subject herself, (which he finds unobjectionable) but also information that has been put up by the data subject but copied or reposted by someone else (II), or that has initially been posted by a third person (III). He thinks that categories II and III pose great threats to free speech: Can Facebook be forced to delete a photo of the data subject, that has been shared by a friend – without the friends’ consent? Can media be forced to take down legally acquired, truthful but embarrassing information – such as a rape victim’s name (alluding to the Supreme Court decision in Florida Star v. B.J.F.)?

    Furthermore, Rosen thinks that the exceptions to protect the right of freedom of expression are not adequate. The regulation puts the burden to assess the difficult balance of privacy rights and free speech and to prove an exemption on the data processor. The envisaged hefty fines could lead data controllers to err on the side of deletion or blocking of all sites referring to the data subject, producing serious chilling effects to free speech.

     

    http://www.stanfordlawreview.org/online/privacy-paradox/right-to-be-forgotten

     

    The European Network and Information Security Agency (ENISA) asks how the government will implement an individual “right to be forgotten” when data are so often plural – concerned with more than one person and freely exchanged with many more. ENISA notes that the right to be forgotten is virtually impossible to enforce in an open, global system such as the Internet. How would a government force the forgetting of a couple’s photograph when one person wants the photo forgotten and the other does not? Furthermore, nothing prevents users from freely copying, storing, and redistributing digital content, including photos. Unauthorized copying of information by human observers is ultimately impossible to prevent by technical means. How can data be tracked down and “forgotten” when we don’t even know who has seen or stored it? Subsequently trying to find and erase the distributed copies is impossible.

     

    ENISA report: http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/the-right-to-be-forgotten)

    The Right To Be … Oh, Forget It

    http://www.hldataprotection.com/2012/11/articles/international-eu-privacy/right-to-be-forgotten-cant-be-enforced-on-the-internet-says-european-security-agency/

  • Google Faces Heat for Privacy Policies

    Shaelyn Dawson

     

    http://www.kqed.org/news/story/2013/02/19/116575/google_faces_heat_for_privacy_policies?category=technology

     

    This article from only two days ago explains how Google is under fire from both Microsoft and the European Union for its violation of privacy laws. Essentially Google’s new policy allows for the tracking and combining of an individuals’ information and usage data when they use any more than one of Google’s services—this means if you use Gmail, Google Calendar, Google Maps, Google News, et cetera you are being tracked. Ultimately, though, the article ends by explaining that the primary reason that Microsoft is after Google is because of Google’s monopoly in the operating system and productivity software markets.

    This article struck me as particularly relevant in light of our class discussion about the Electronic Communications Privacy Act as well as our lecture by Brad Smith.  On Tuesday the class heard two comments: one declaring as to how the advertisements related to an upcoming wedding were exceedingly helpful and another who bristled at the idea of targeted advertising. It seems to me that the take home from this conversation is that there is not a monolithic model that will make everyone happy. As Brad Smith explained in response to my question about the EU, the “notice and consent” model simply do not seem to be working. Thus, in applying Mr. Smith’s advice, a new model should be reworked following this 3-step approach: first, we need updated laws and regulatory measures which create an even playing field for all actors: good and bad. Though the EU model has wider consumer protection, many of the same problems that occur in the U.S. also occur in the EU. Second, we need more self-regulation so that the legal/regulatory foundation can be bolstered and built upon. This means that a company like Google must regulate itself and create internal safeguards in order to comply with recognized laws and regulations. Finally, we need market-based innovation and competition so that actors are incentivized to respect consumers’ privacy as well as legal norms.

    This third prong directly relates to the above article in that the article specifically notes that Microsoft “has seen Google and others erode its monopoly position in the operating-system and productivity software market, and “it’s fighting tooth and nail to try and find a way to get it back.” Thus, the free-market essentially encourages competitors to be watch-dogs of each other. While Microsoft’s motives may not be purely altruistic the fact that it is keeping Google honest ultimately will benefit the consumer.

  • ARE YOU BEING SCROOGLED? (What’s a “Scroogle”?)

    Marissa Schwartz

     

    Brad Smith was an amazing guest speaker! As lead general counsel for Microsoft, he knows the in and outs of the tech market and even more about privacy law.  During the Q&A a student asked him about Microsoft’s new campaign, “Scroogled,” which aims to inform the public of Google’s improper use of Gmail users personal information in order rack up advertising sales. Google’s profit model is based on creating products/services that are then available to the market for free and profiting off advertising revenues.  I have no qualms about this business model up until learning from Mr. Smith that Google was combing my Gmail account and extracting my personal information.

     

    I am not a very private person – I am an active Facebooker, Instagrammer, Tweeter, etc. – but I believe that my Gmail account should be private: THIS IS MY INBOX, which is way more important than my physically locked up mailbox, AND ITS CONTENTS ARE FOR MY EYES ONLY! I have extremely “sensitive” information in my Gmail account (along with the momentarily funny and forever corny chain emails I get from my mother): electronic receipts, travel confirmation numbers, delivery information, subscription records, tickets to see Joan Rivers perform stand-up tonight, employment listings, job contacts, my daily horoscope, and on and on the list could go.

     

    Google should not be allowed to access any of this information and I signed (anonymously of course!) the Microsoft “Scroogle” petition to formally object! You can do so too by clicking here: http://www.thepetitionsite.com/997/086/864/tell-google-to-stop-going-through-your-email-to-sell-ads/?z00m=20503710.

     

    The marketplace, myself included, does in fact believe some things are not to be aired. The leaders of the tech market should be cognizant of this when designing products and crafting their business models because their costs of doing business should not fall squarely on their consumers. Even though I do feel violated I also shudder at the thought of parting ways with Gmail. I am grateful to Mr. Smith and those other brainiacks at Microsoft who decided to inform the world about Google’s intrusive practices. Further, I applaud this endeavor because it is paving the way for increased self-regulation by market forces. The more the public knows about these companies’ practices (rather than the other way around) the better!

     

    More web chatter about “Scroogled!”

     

    First, we have a comic commercial video of Google reading your Valentines Day love letters, brought to you by Microsoft: http://techcrunch.com/2013/02/14/bing-launches-new-scroogled-video-for-valentines-day-warns-google-will-read-your-love-letters/.

     

    Next, some more inside scoop from the Bay Area: http://www.nbcbayarea.com/news/local/Microsoft-Hits-At-Google-In-New-Scroogled-Ad-Campaign-191738631.html.

     

    And finally, not everyone feels the way I do so here is a criticism of “Scroogled:” http://techland.time.com/2013/02/16/how-microsoft-scroogled-itself/.

  • European Union to take Action Against Google

    Emi Briggs

     

    http://www.bbc.co.uk/news/technology-21499190

     

    http://epic.org/2013/02/europe-prepares-action-against.html

     

    http://mashable.com/2012/01/24/google-changes-again-launches-one-

    privacy-policy-to-rule-them-all/

     

    http://ftc.gov/opa/2012/08/google.shtm

     

    On January 2012 Google launched a new master privacy policy that created an umbrella policy to cover its various products. Shortly after, 26 European countries requested Google address aspects of its policy deemed to be contrary to EU Law. After receiving what it deemed to be inadequate response from Google, the French Data Protection Commissioner, acting on behalf of the European Union will be taking action against Google.

    In light of our recent lecture with Microsoft executive Brad Smith, I felt news on Microsoft’s major competitor, Google, would be particularly relevant.  Furthermore, this investigation highlights the difference between the US and European models of privacy regulation.  The Federal Trade Commission has also investigated Google recently for alleged antitrust violations and settled with the company for violating the privacy of Safari users.  However, it is yet to raise issues concerning the master privacy policy the EU is now contesting.

  • THE STATE OF CFAA AND THE PASSING OF PRIVACY SCHOLAR ALAN WESTIN

    Chad Sandler

    Aaron Swartz was indicted in 2011under the CFAA and wiretapping statute for exceeding his authorized access to the research portal JSTOR and downloading and disseminating articles from JSTOR. He subsequently committed suicide leading to a public backlash against criminal prosecution under the CFAA. This article in Forbes reviews Aaron’s actions and explains how they violated the CFAA. It explains that the misconduct went beyond violating JSTOR’s terms of use to include exceeding authorized use and circumventing identity restrictions.

    http://www.forbes.com/sites/ciocentral/2013/02/15/how-congress-can-create-a-lasting-legacy-for-aaron-swartz/

    Orin Kerr offers a cogent legal analysis defending the actions of federal prosecutors in the case against Swartz. Kerr asserts that under the Wire Fraud statute, Swartz’s use of masked IP addresses and false identification to gain access to JSTOR articles comports with statute’s prohibition on schemes to gain property by false pretenses.

    Kerr then analyzes the case under the CFAA. He notes that the $5,000 threshold is easily met here if one uses the ‘reasonable costs of production’ value that many courts have adopted. With regard to exceeding authorized use, Kerr points out the methods used by Swartz to circumvent detection (and defensive block attempts) by JSTOR.

    The Criminal Charges Against Aaron Swartz (Part 1: The Law)

    Efforts to amend the CFAA include removing liability for exceeding authorized use to perhaps simply access without authorization. This tech crunch article outline some of the legal debate on reformation efforts: http://techcrunch.com/2013/02/11/aarons-law-takes-shape/

    Finally, a few days ago, Alan F. Westin, noted privacy scholar, passed away. This article highlights his contributions to the field of information privacy. He believed privacy “is more than the right to be left alone. It is the ability to control how much information about ourselves we reveal to others, and how and when to share it.”

    http://www.washingtonpost.com/national/alan-f-westin-scholar-of-privacy-in-the-information-ages-dies-at-83/2013/02/19/7258b28c-7aa6-11e2-a044-676856536b40_story.html

  • Bring on the Privacy-Arms Race!

    Yoav Simchoni

     

    Vertically-integrated tech companies compete vigorously across multiple product lines to try and capture market share. A large part of this competition revolves around marketing and branding campaigns, by which companies try to capture the loyalty of their target audience. These campaigns have traditionally involved bids to make products or services seem “cool” or useful, but recently this competition has fanned into a new arena of battle – user privacy. Technology consumers are increasingly concerned with privacy issues as a result of the huge amount of information they share online. Just how much users care is unclear, but some companies have begun distinguishing themselves from competitors by advertising their heightened privacy restrictions and lax privacy regulations of their competition.

    The appearance of privacy issues on the “playing field” of corporate advertising may be a significant step towards a market-based solution for privacy regulation. It may prompt a “race to the top” in which companies compete to offer consumers better privacy controls, and make consumers aware of privacy risks posed by competitors. This may seem like a welcome development, but critics warn that privacy based campaigns may also be problematic. The term “privacy” is often vague, and the meaning of byzantine privacy policies is poorly understood by most internet users. Consequently, advertising campaigns can easily be set up to incite panic or concern where it should not exist. These advertising campaigns could serve as a template for smear campaigns and weaken consumers by increasing the amount of misinformation related to privacy issues.

    Microsoft’s recent “Scroogled” campaign highlights how these two views interact. The new campaign is the largest advertising campaign to date that specifically targets privacy conduct. In the “Scroogled” campaign, Microsoft accuses Google’s Gmail service of sifting through user emails to target users with specific advertisements. The campaign also suggests users sign a petition to protest Google’s use of personal user information. The petition informs that Google reads through “every word of every email”. It then insinuates that private emails aren’t safe by stating that “email between a husband and wife, or two best friends, should be completely personal”. The campaign also provocatively asks the user if they “feel violated yet?” and clarifies that Microsoft’s mail client, Outlook, does not “go through your email to sell ads”. So far, this campaign has done little to disrupt Gmail’s dominance in the e-Mail market, but the significance of the campaign has not gone unnoticed.

    Microsoft is hitting where tech companies have traditionally considered off limits, raising the privacy issue is considered by many alarmist and populist. Are Microsoft’s claims even justified? Microsoft’s message seems to fall, like most advertising, between reality and hyperbole. Microsoft argues Google doesn’t care about privacy, and is willing to monetize user data by violating privacy without scruple. Google’s scanner, however does not involve a human reading any emails, it merely let’s an algorithm scan your mail for keywords that might trigger relevant ads, arguably providing the user with more relevant online experience. This algorithm activity, however, might still be problematic. In 2004, Mark Rasch wrote for Security Focus stating scanning practices could set a “dangerous legal precedent” for law enforcement being able to collect data on users in the same way.  But if this is the case, Microsoft is no less a troublemaker, they also use algorithms to scan the content of user mail. Microsoft’s own terms of use state they “may occasionally use automated means to isolate information from email, chats or photos in order to help detect and protect against spam and malware or to improve the services with new features that makes them easier to use.” Accordingly, both companies seem to be scanning e-mail, but only Google is monetizing that data through targeted advertising. Does that make Microsoft any better? Are its descriptions of what Google is doing bordering on the disingenuous? Further dampening Microsoft’s critique, Google offers users to opt out of the demographic categories Google’s advertising algorithms have placed them in, Microsoft does not have these features on Bing.

    These incongruities lead most critics to believe that Microsoft’s campaign is less about altruism, and more about money. Microsoft has been desperately trying to capture market share from Google in both Search and e-Mail and has been drastically less efficient in monetizing advertising on their search platforms. They have been phasing out Hotmail and converting its user base to outlook.com and in a push to try and pull away some market share from Google, critics argue, they have chosen to inflammatorily target privacy concerns – ironically – because down the road, they want to do just what they accuse Google of doing overzealously, advertise. Supporters of Microsoft argue that it does not earn its money through advertising, and is more interested in users turning to Outlook because it is a better quality product. As a vertically integrated company, the use of one product is a segue towards purchasing more software and hardware devices. Accordingly, Microsoft claims they have the incentive to respect privacy more, because their money does not come from selling user data.

    It is unclear whether the critics or supporters of Microsoft are closer to being on the money. What is clear is that no tech-company is above privacy scrutiny. Microsoft itself has been criticized for privacy policies relating to its Skype product. In late 2012, an open letter signed by 45 privacy-focused organizations demanded Microsoft and Skype clarify their hazy privacy policy. The letter accused Microsoft of using “persistently unclear and confusing statements about the confidentiality of Skype conversations,” regarding what access Microsoft was willing to provide governments to user and conversation data. Microsoft has also been criticized for recent changes to its services agreement which allow it to aggregate customer content from one product, and apply it to another. This means user use patterns from one product, say Windows, can be used to engineer another device, such as the Xbox. Previously, Microsoft limited data use to one product at a time.

    It seems that even if one accepts that Microsoft is a moral exemplar in its war with Gmail, their own privacy lapses suggest they too are willing to “cut corners” when there are big financial ramifications. Despite this fact, two wrongs just make a right when it comes to consumer privacy concerns. If one can stomach hypocrisy, Microsoft’s campaign can be useful to consumers. Arguably, any dialogue that isn’t populist or smearing and that brings privacy issues to the fore and educates the public is welcome. For instance, a Mozaic Group survey found that 70% of Gmail users did not know that their data was being screened. Will those users now switch to Outlook? Doubtful. But at least they will be more educated as a service consumer, and if they day comes when a flagrant violation is highlighted, will be educated enough to move to another service. Perhaps this war of attrition between large technology companies, and the reputational damage they suffer will leave the consumer as the only true benefactor as we become more aware of privacy issues, and have more products to choose from. So bring on the privacy arms race.

     

    My Sources:

    http://washington.cbslocal.com/2013/02/10/sundaysecurity/

    http://www.ibtimes.com/microsoft-rips-email-snooping-google-outlook-any-more-private-gmail-1094118

    http://www.ucstrategies.com/unified-communications-newsroom/microsoft-has-to-tell-the-truth-about-skype-privacy.aspx

    http://www.nytimes.com/2012/10/20/technology/microsoft-expands-gathering-and-use-of-data-from-web-products.html?pagewanted=all&_r=0

    http://www.zdnet.com/three-sides-to-every-scroogled-microsofts-googles-and-the-truth-7000011202/

  • Netflix Privacy Violation Lawsuit

    Alina Mejer

     

    http://news.cnet.com/8301-1023_3-57377084-93/netflix-pays-$9-million-to-settle-privacy-violation-lawsuit/

     

    In keeping with this week’s discussion about statutes that regulate commercial entities’ use of personal data, this recent article about Netflix highlighted how consumers can use the statutes to try and redress any privacy violations.

     

    Netflix settled a class action lawsuit that was filed in January 2011 for $9 million. The case was brought under the Video Privacy Protection Act, a statute that was discussed during Tuesday’s class. Professor Rubinstein noted how the statute was a reaction to prying reporters who tried to get information about Robert Bork’s video rentals during his Supreme Court nomination hearings. The law was passed in 1988 and essentially makes it illegal for video stores to provide information about what their customers rent. The plaintiffs in this lawsuit made the claim that Netflix was in direct violation of this law by keeping records of what they had watched for up to two years after subscribers cancelled their Netflix accounts.

     

    Interestingly enough, however, this $9 million payout does little to impact Netflix’s profit margin. Though it decreased their fourth quarter income by fourteen percent, Netflix’s most profitable year was in 2011.  This article highlights how these statutes are used by consumers to try and protect their privacy. However, it is discouraging to see that the incentives for companies like Netflix are not perfectly aligned with the available remedies because it seems like this settlement was more like a slap on the wrist – especially in light of the fact that Netflix admitted no wrongdoing as per the terms of the settlement agreement. It will be interesting to see how future cases are litigated considering the privacy risks that evolving technologies pose to consumers, a broader theme explored in this course.

  • FTC Cracks Down on Mobile Applications and Coppa Violations

    Anisha Mehta

     

     Earlier this month the Federal Trade Commission (FTC) reached an $800,000 settlement with Path for violations of the Children’s Online Privacy Protection Act (Coppa). The Act regulates the collection and use of personal information from children under the age of 13 by websites. Coppa requires websites to post privacy policies describing what information is being collected and how it will be used, and requires the website to obtain verifiable parental consent for the collection of such information. The settlement requires Path to delete collected information from children under age 13, pay a $800,000 civil penalty, establish a comprehensive privacy program, and obtain independent privacy assessments every other year for the next 20 years. Approximately 3000 accounts from children under age 13 have been found out of 6 million users.

    Path targets families to allow them to share personal moments by creating private social networks. The company faced FTC privacy concerns when it was discovered that information from user’s iPhone address books was being uploaded to Path’s servers without their consent. In the process of this investigation in February 2012 the Coppa violations were discovered by the startup and by May 2012 the startup changed the sign-up process so that individuals under the age of 13 were automatically detected and blocked. According to an article in Gigaom.com, the FTC has stated “This settlement with Path shows that no matter what new technologies emerge, the agency will continue to safeguard the privacy of Americans”.

     

    http://gigaom.com/2013/02/01/path-reaches-settlement-with-ftc-agrees-to-pay-800000-fine-for-coppa-violations/

     

    This case also shows the emphasis the FTC is placing on privacy considerations in regard to mobile devices. At the beginning of the month the FTC also published suggested privacy guidelines for mobile apps, which while not binding, show the seriousness with which the agency is looking at mobile privacy. The FTC is not just focusing on major corporations, but also on small businesses that create apps and providing them with recommended strategies to lower their risks of privacy violations.

     

    http://www.nytimes.com/2013/02/02/technology/ftc-suggests-do-not-track-feature-for-mobile-software-and-apps.html

     

  • EU vs US Data Protection

    Johnston Chen

    http://www.nytimes.com/2013/01/26/technology/eu-privacy-proposal-lays-bare-differences-with-us.html?_r=0

     

    In January, the United States government and Silicon Valley lobbied against European efforts to increase consumer information privacy law in the European Union.  At that time, several proposed laws were working their way through the European Parliament.  These proposed laws are designed to give 500 million consumers the ability to block or limit many forms of online web tracking and targeted advertising.  While seen as a major boon in consumer privacy, all major American tech companies have lobbied the European headquarters in Brussels arguing that Europe weaken or remove these limits.

    Ben Wizner of the American Civil Liberties Union highlights that, unlike Europe, the United States has no general data protection law.  As a result, he states that online companies in the United States may conduct “unfettered” data mining.  Under the European proposals, however, Web businesses would be unable to collect and profile individual users without their explicit consent.  Businesses would also have to permanently remove information upon a user’s request.

    Adoption of the bill is expected in early 2014, and is critical for both European and American consumers because the outcome of these information privacy laws could critically affect United States technology companies.  Although based in the United States, many Silicon Valley companies typically generate a third or more of their sales in the European Union.  The profitability and continued success of companies such as eBay, Amazon, Microsoft, Google, and Texas Instruments, among other companies, could depend in large part on how the European Parliament decides to format their information privacy laws.  While these laws are designed to protect the privacy of the consumers, many corporations fear that their loss of data could turn into a loss of sales, hurting both the consumers and the corporation. As a result, the tension between consumer privacy and profitability is highlighted in Brussels’ current struggle over increased European privacy laws.