In reviewing the social media legal headlines over the past few weeks (sorry for the week long hiatus, my oldest son is "graduating" from kindergarten and end of year festivities have been never ending...I'll try hard to meet my weekly deadline but things like that will always take precedence) I am reminded of an old maxim of my Grandmother's: "Just because its legal, doesn't make it right."
While this was not one of her favorites (those were usually reserved for things that were "colder than..." "battier than..." or "crookeder than...") it was one that I, as an aspiring attorney, tended to hear quite often. This rang true even more so once I entered law school and would attempt to explain to her the differences between what you "knew" and what you "could prove." What you "could prove" never mattered much to Grandma, she was always concerned more with what "was right." Interestingly, my experience with the jury system has born out that her idea of what was "right" was much closer to what a jury is concerned with than what my law school professors had to say about what you could prove...but that's a different blog.
Earlier this month, Facebook updated its promotional guidelines (Facebook Promotional Guidelines) to remove its blanket prohibitions on promotions for tobacco, dairy, gambling, firearms, prescription drugs, and gasoline. In addition, marketers may also now require purchase for entry and target those below age 18 or that live in previously restricted countries.
These changes have obvious implications for those brands that were previously prohibited from promoting their products via the world's largest social network, and likely has my friends in the marketing industry salivating over the opportunity to expand their client's influence and engagement in this arena. However, to paraphrase Grandma..."Just because its alright with Facebook, doesn't make it legal."
Companies and brand managers, as well as marketing and advertising professionals, should remember that the availability of this new arena does not necessarily make sweepstakes and promotions for these (or any other type of products) necessarily "legal" just because Facebook doesn't prohibit them. Instead, what these changes mean is that Facebook will no longer attempt to be the arbiter of these issues. While these promotions may now be "alright" with Facebook, companies hoping to take advantage of this new opportunity must remember that Facebook's members are worldwide, and the catchy promotion, or amazing sweepstakes that you are rolling out may not be as acceptable under the laws of certain jurisdictions.
While your gaming, tobacco, or firearm promotion may be perfectly acceptable, and completely compliant under the laws of Missouri (or whichever jurisdiction you reside) it may not be under the laws of Utah, California, Saudi Arabia, or China. Depending upon where your target market resides, and the size of your national or international operations, the laws of these jurisdictions must also be considered if you hope to avoid potential legal issues. (Additionally, this is yet another reminder how easily international legal issues can arise through the use of social media....while you may have never considered doing business in the UAE or the Ukraine, social media has the potential to take your company just one click away from these jurisdictions....it is important to consider the ramifications).
The implications of these changes reiterate the importance of coordinating your marketing and legal departments. While marketing may (rightfully) be seeking to expand your business into social media in an attempt to take advantage of the unique opportunities that the medium provides, and legal may (also rightfully) be concerned about the relatively unplowed social media landscape, these departments can co-exist. Having your legal and marketing teams on the same page, with each group understanding the benefits, and concerns that each of them see in social media is vital to your success in this rapidly growing arena. If you haven't yet, its time to make sure that they are all on the same page.
Let me know what you think.
P.S. I want to take a second and send thoughts and prayers out to my friends in the Joplin, Missouri area. The storms that have devastated that region are simply indescribable and nothing that anyone can say can really do anything to take away the devastation. Be safe, and know that we are with you.
Monday, May 23, 2011
Tuesday, May 10, 2011
Does your social media campaign expose you to liablity?
Over the past few years there has been no bigger area of growth for the marketing industry than the realm of social media. Facebook, Twitter, and Linkedin have exploded from what was virtually a non-existent market just a few short years ago, into a significant portion of many advertising campaigns. Indeed, over two billion dollars were spent advertising on line last year and it is predicted that this will quadruple to over 8 billion by 2015. (Media Life: Behind the Huge Growth of Social Media). This explosive growth has not gone unnoticed by businesses and thousands have rushed to join the social media world. From Fortune 50 companies, to small family run shops, business of all shapes and sizes are adopting social media as an effective means to reach their target customer.
While this social media explosion has provided an amazing opportunity for customer connection and engagement, there are legal issues that must be considered. Although Facebook accounts are officially available to only those over the age of 12, studies indicate that the use among pre-teens reaches into the millions. (Consumer Reports estimates approximately 7.5 million children under age 13 use facebook). This use by minors may have the potential to expose unwary businesses to some very unexpected liability.
When users sign up for Facebook, their profile displays personally identifying information including their name, photo, school, employer, birthday, hometown and relationship status. Users are also able to further customize their profile by including specific references to personal likes and dislikes such as movies, books, music and other areas of interest. This information provides Facebook a unique ability to offer advertisers a chance to direct their advertisements to a very specific demographic, but when the information relates to minors, it may also present potential problems.
Just last week, a unique issue arose in the United States District Court for the Eastern District of New York which should have Facebook, and all businesses with a presence in social media, reviewing their programs and policies. On May 3, 2011, Scott Nastro, on behalf of his child, J.N., brought a class action suit against Facebook in a matter styled Nastro v. Facebook, Inc., 11-cv-2128, (E.D. N.Y). In this action, plaintiffs allege that Facebook misappropriated the names and likenesses of children for promotional purposes without seeking the required consent from the child's parent or guardian.
Specifically, plaintiffs alleged that Facebook, through its "Social Ads" feature, misappropriates the name and likeness of minors, for commercial advantage, without the consent of the minors parents. Started in 2007, Social Ads is an innovative program which essentially provides Facebook the ability to use an individual Facebook users preferences as an endorsement. Through Social Ads, Facebook users are allowed to see which of their friends has "endorsed" a particular brand or product by displaying the names and likenesses of a user's Facebook friends who have interacted with the ad or the advertiser's brand page. Thus, when a user "likes" a Facebook page, the user's action is recorded on the page along with the users name and likeness. Similarly, when a user "likes" a brand or responds to an event, a message is displayed to their Facebook Friend's home page feed, announcing this action. Because Facebook does not provide an "opt out" to allow a user to prevent their name and likeness from appearing on a page they have liked, users are automatically "endorsers" of any page they like on Facebook. The plaintiffs' suit seeks to recover for these "endorements" by minors which occur without the necessary consent of their parents. While obviously of concern to Facebook, Inc., this proposed class action, could also have major national implications.
Many corporations with Facebook fan pages include areas for their fans to submit many different types of content. This suit is a reminder that even innocently constructed programs likely need review from counsel. From the submission of photos and videos, to the simple ability to add a users name and likness to a list of those "liking" a page, social media's ability to allow users to engage with a company's page may have consequenses that were unheard of just a few years ago. While your markeing department or agency can construct amazing campaigns through social media, make sure they are vetted for potential pitfalls such as those faced by Facebook in Nastro.
Let me know what you think.
While this social media explosion has provided an amazing opportunity for customer connection and engagement, there are legal issues that must be considered. Although Facebook accounts are officially available to only those over the age of 12, studies indicate that the use among pre-teens reaches into the millions. (Consumer Reports estimates approximately 7.5 million children under age 13 use facebook). This use by minors may have the potential to expose unwary businesses to some very unexpected liability.
When users sign up for Facebook, their profile displays personally identifying information including their name, photo, school, employer, birthday, hometown and relationship status. Users are also able to further customize their profile by including specific references to personal likes and dislikes such as movies, books, music and other areas of interest. This information provides Facebook a unique ability to offer advertisers a chance to direct their advertisements to a very specific demographic, but when the information relates to minors, it may also present potential problems.
Just last week, a unique issue arose in the United States District Court for the Eastern District of New York which should have Facebook, and all businesses with a presence in social media, reviewing their programs and policies. On May 3, 2011, Scott Nastro, on behalf of his child, J.N., brought a class action suit against Facebook in a matter styled Nastro v. Facebook, Inc., 11-cv-2128, (E.D. N.Y). In this action, plaintiffs allege that Facebook misappropriated the names and likenesses of children for promotional purposes without seeking the required consent from the child's parent or guardian.
Specifically, plaintiffs alleged that Facebook, through its "Social Ads" feature, misappropriates the name and likeness of minors, for commercial advantage, without the consent of the minors parents. Started in 2007, Social Ads is an innovative program which essentially provides Facebook the ability to use an individual Facebook users preferences as an endorsement. Through Social Ads, Facebook users are allowed to see which of their friends has "endorsed" a particular brand or product by displaying the names and likenesses of a user's Facebook friends who have interacted with the ad or the advertiser's brand page. Thus, when a user "likes" a Facebook page, the user's action is recorded on the page along with the users name and likeness. Similarly, when a user "likes" a brand or responds to an event, a message is displayed to their Facebook Friend's home page feed, announcing this action. Because Facebook does not provide an "opt out" to allow a user to prevent their name and likeness from appearing on a page they have liked, users are automatically "endorsers" of any page they like on Facebook. The plaintiffs' suit seeks to recover for these "endorements" by minors which occur without the necessary consent of their parents. While obviously of concern to Facebook, Inc., this proposed class action, could also have major national implications.
Many corporations with Facebook fan pages include areas for their fans to submit many different types of content. This suit is a reminder that even innocently constructed programs likely need review from counsel. From the submission of photos and videos, to the simple ability to add a users name and likness to a list of those "liking" a page, social media's ability to allow users to engage with a company's page may have consequenses that were unheard of just a few years ago. While your markeing department or agency can construct amazing campaigns through social media, make sure they are vetted for potential pitfalls such as those faced by Facebook in Nastro.
Let me know what you think.
Monday, May 2, 2011
Can non-traditional "influencers" legally affect your clients?
Last week I had the opportunity to attend an interesting event presented by @infuz and @stltweets entitled:
The State of Online Influence: Social Reach in St. Louis.
The stated intent of the event was to "put a magnifying glass" on the concept of influence by exploring its roots and the challenges of harnessing it. The event featured presentations and discussions by local Social Media influencers Matt Ridings (@techguerilla), Mayor Francis Slay (@MayorSlay), Jason Fiehler (@jasonfiehler), Brad Hogenmiller (@Javastl), Robert Littal (@BlkSportsOnline), Chris Reimer (@RizzoTees); and Todd Jordan (@Tojosan) and centered upon how Social Media is presenting a unique opportunity for new voices to be heard, and also allowing those in business and politics to have a better, more direct, and more timely mode of communication with their clients and constituents. The climax of the evening was the unveiling of STL Index (@stlindex), which is being billed as a data-centric approach to measuring online influence in St. Louis.
While in many respects the event could be considered a marketing driven "coming out party" for STL Index, there were a couple legal take aways that I thought worth noting.
First, at the end of the day, social media, social marketing, and social networking is still at its heart, networking. Though the presentations were outstanding, the speakers well informed, and the panelists (and audience via twitter posts projected on the screen) entertaining, what made the event successful was the ability for the attendees to meet in person, engage, and converse about their shared interest in social media. While many, if not most, of this crowd had "met" online, via Twitter, Facebook, or one of the dozens of other Social Media sights which each of them frequent, those relationships were expanded and solidified by taking their online communications offline and in person.
Businesses venturing into social media can learn from this. It is simply no longer "enough" to have a Facebook page, or tweet your press releases. The real secret of social media is engagement. If you are not willing to take that step, you won't get as much out of the medium as you should. While my marketing roots believes this wholeheartedly, my legal side understands that this does introduce some challenges and potential risks. When your company, employees, and customers actively engage in social media, you almost inherently lose some control over your brand and message. This lack of control is often sufficiently offset by the tremendous benefits that social media can provide to ensure that you want to be in the space, but there is no reason that you shouldn't take every step you can to also protect your business. Social Media Policies specifically tailored to your company; Training all employees on the proper uses of Social Media and how improper uses can have adverse personal and professional consequences; and coordination between human resources, marketing, and legal to ensure that all are on the same page and working together to make sure your business is protected are just some of the ways to help protect your organization.
Second, for those in the business community, what may be of particular interest, (and some concern) is that these new "influencers" are not necessarily those who we have traditionally considered to be influential. Indeed, out of the STL Top 100 list, I think it is fair to say that there are many more bloggers and marketing types than there are politicians and CEOs. Many of the people you find on this list are more likely to be in your HR department, or a member of your team who bloggs on a topic completely unrelated to your business. Despite these nontraditional roles, these influencers have committed followings, and reach an enormous number of people, however, they are not necessarily traditional spokespeople and that may need to be addressed. Businesses hoping to utilize social media should be aware of this, and ideally, should try to tap their own internal influencers in helping with their social media strategy. Again, this requires thought, and developing policies which address these ever changing areas.
For those practicing in the social media law sphere, keep these non-traditional influencers in mind when developing policies and assisting your clients. While they may have an enormous potential to help your clients' business, they may not be versed in important areas of the law, and that could have consequences. Make sure your clients don't get caught up in avoidable problems.
Finally, I'd like to give a shout out today to our military leaders, special operations forces, and our President. Job well done.
Let me know what you think.
The State of Online Influence: Social Reach in St. Louis.
The stated intent of the event was to "put a magnifying glass" on the concept of influence by exploring its roots and the challenges of harnessing it. The event featured presentations and discussions by local Social Media influencers Matt Ridings (@techguerilla), Mayor Francis Slay (@MayorSlay), Jason Fiehler (@jasonfiehler), Brad Hogenmiller (@Javastl), Robert Littal (@BlkSportsOnline), Chris Reimer (@RizzoTees); and Todd Jordan (@Tojosan) and centered upon how Social Media is presenting a unique opportunity for new voices to be heard, and also allowing those in business and politics to have a better, more direct, and more timely mode of communication with their clients and constituents. The climax of the evening was the unveiling of STL Index (@stlindex), which is being billed as a data-centric approach to measuring online influence in St. Louis.
While in many respects the event could be considered a marketing driven "coming out party" for STL Index, there were a couple legal take aways that I thought worth noting.
First, at the end of the day, social media, social marketing, and social networking is still at its heart, networking. Though the presentations were outstanding, the speakers well informed, and the panelists (and audience via twitter posts projected on the screen) entertaining, what made the event successful was the ability for the attendees to meet in person, engage, and converse about their shared interest in social media. While many, if not most, of this crowd had "met" online, via Twitter, Facebook, or one of the dozens of other Social Media sights which each of them frequent, those relationships were expanded and solidified by taking their online communications offline and in person.
Businesses venturing into social media can learn from this. It is simply no longer "enough" to have a Facebook page, or tweet your press releases. The real secret of social media is engagement. If you are not willing to take that step, you won't get as much out of the medium as you should. While my marketing roots believes this wholeheartedly, my legal side understands that this does introduce some challenges and potential risks. When your company, employees, and customers actively engage in social media, you almost inherently lose some control over your brand and message. This lack of control is often sufficiently offset by the tremendous benefits that social media can provide to ensure that you want to be in the space, but there is no reason that you shouldn't take every step you can to also protect your business. Social Media Policies specifically tailored to your company; Training all employees on the proper uses of Social Media and how improper uses can have adverse personal and professional consequences; and coordination between human resources, marketing, and legal to ensure that all are on the same page and working together to make sure your business is protected are just some of the ways to help protect your organization.
Second, for those in the business community, what may be of particular interest, (and some concern) is that these new "influencers" are not necessarily those who we have traditionally considered to be influential. Indeed, out of the STL Top 100 list, I think it is fair to say that there are many more bloggers and marketing types than there are politicians and CEOs. Many of the people you find on this list are more likely to be in your HR department, or a member of your team who bloggs on a topic completely unrelated to your business. Despite these nontraditional roles, these influencers have committed followings, and reach an enormous number of people, however, they are not necessarily traditional spokespeople and that may need to be addressed. Businesses hoping to utilize social media should be aware of this, and ideally, should try to tap their own internal influencers in helping with their social media strategy. Again, this requires thought, and developing policies which address these ever changing areas.
For those practicing in the social media law sphere, keep these non-traditional influencers in mind when developing policies and assisting your clients. While they may have an enormous potential to help your clients' business, they may not be versed in important areas of the law, and that could have consequences. Make sure your clients don't get caught up in avoidable problems.
Finally, I'd like to give a shout out today to our military leaders, special operations forces, and our President. Job well done.
Let me know what you think.
Monday, April 25, 2011
TWISML Hat tip: The Now Revolution @ambercadabra and @jaybaer
I wanted to take this take a moment to send out a TWISML Hat tip to the authors of The Now Revolution, Amber Naslund (@ambercadabra) and Jay Baer (@jaybaer).
Amber and Jay were in St. Louis last week as guests of the Social Media Club of St. Louis (@smcstl) and were here to promote their new book: The Now Reviolution: 7 Shifts to make your business smarter, faster, and more social.
I had the unique opportunity to see Amber and Jay each individually speak about their book and also was in attendance at their joint presentation to the Social Media Club. (A special thank you to @standingpr, @at_law, and @lumiereplace for the invites to these great events). I also had the chance to catch a Cardinals game with Amber and I have to say that I came away impressed.
Amber and Jay have written a unique book which recognizes that Social Media isn't a job, and doesn't focus on Facebook, Twitter, Linkedin or any particular site. What Amber and Jay have done is attempt to help businesses understand that the real secret sauce behind social media is that it allows you to better understand, serve, and communicate with your customers. That's what's really important. Those companies that grasp this fundamental truth have a leg up on their competition.
Amber and Jay were in St. Louis last week as guests of the Social Media Club of St. Louis (@smcstl) and were here to promote their new book: The Now Reviolution: 7 Shifts to make your business smarter, faster, and more social.
I had the unique opportunity to see Amber and Jay each individually speak about their book and also was in attendance at their joint presentation to the Social Media Club. (A special thank you to @standingpr, @at_law, and @lumiereplace for the invites to these great events). I also had the chance to catch a Cardinals game with Amber and I have to say that I came away impressed.
Amber and Jay have written a unique book which recognizes that Social Media isn't a job, and doesn't focus on Facebook, Twitter, Linkedin or any particular site. What Amber and Jay have done is attempt to help businesses understand that the real secret sauce behind social media is that it allows you to better understand, serve, and communicate with your customers. That's what's really important. Those companies that grasp this fundamental truth have a leg up on their competition.
Social Media Posts: What do you do with a "bad" post?
Businesses that are considering using social media often spend an inordinate amount of time worrying about what can go wrong. From the disgruntled customer, to the misguided employee, to the inarticulate spokesperson, there are indeed many things that can go "wrong" when using social media, however, the mere possibility that something could go wrong does not mean your company should go running for the exits.
In truth, things can go "wrong" in almost any area of your business and the mere fact that it occurs on social media has little to do with the media itself. When an employee goes AWOL and posts inappropriate or unflattering content, it has been said that "you don't have a social media problem, you have a hiring problem." Similarly, staying off of social media due to concerns that a customer may say something unflattering is really akin to stating that your business is unwilling to address complaints. (Thanks to Amber Naslund and Jay Baer authors of The Now Revolution, and a TWISML Hat tip preview). In reality, these issues are human resource and customer service problems which every business must address in one form or another. Social media just serves to magnify the problems.
An interesting area where these issues find an interplay with the law is what you do with "bad" posts once they are out there. While at first, it may seem reflexive to delete the post (if you are able), in many instances it might not be that simple.
A recent tragic case arising out of a dorm room incident at Rutgers University has brought about some potentially significant developments in this area of social media law. The case out of Rutgers arose when Dharun Ravi allegedly videoed his roommate Tyler Clementi's relationship with another student via webcam and distributed a link to that webcam via social media. After Clementi learned that his relationship had been broadcast he tragically took his own life. Charges were initially brought against Mr. Ravi alleging counts related to invasion of privacy. While these facts are tragic, what is particularly interesting when considering the application to social media law is that Ravi was also recently charged with tampering with evidence. (For a more detailed account of the incident, see article by Beth DeFalco of the AP Roommate charged with hate crime in N.J. Suicide).
While on its face, this case may seem unrelated to a business' use of social media, the tampering with evidence charges may provide a window into future developments. As with the evidence in this criminal case, a business that knows civil litigation is likely to arise has a duty to refrain from destroying relevant evidence. While, initially, it may seem perfectly reasonable for a business to delete offensive posts, or remove client complaints, this duty to preserve evidence makes it advisable to consider whether the post potentially relates to a larger legal issue.
Although these evidentiary considerations present potential problems, they do not mean that troublesome posts must be left up indefinitely. Even though the law directly relating to this kind of material is in many respects still being written, a business can provide itself with an added layer or protection through the use of a properly crafted social media policy. Addressing how your business will deal with this sort of material, setting up procedures on how to retain/store relevant posts, training employees on how to deal with these issues, and taking proper measures to ensure that you do not run afoul of the evidence tampering laws are all fairly easy ways to protect your business. As with many other legal issues, proper planning on the front end can help minor legal problems from developing in to major legal disasters.
Let me know what you think.
In truth, things can go "wrong" in almost any area of your business and the mere fact that it occurs on social media has little to do with the media itself. When an employee goes AWOL and posts inappropriate or unflattering content, it has been said that "you don't have a social media problem, you have a hiring problem." Similarly, staying off of social media due to concerns that a customer may say something unflattering is really akin to stating that your business is unwilling to address complaints. (Thanks to Amber Naslund and Jay Baer authors of The Now Revolution, and a TWISML Hat tip preview). In reality, these issues are human resource and customer service problems which every business must address in one form or another. Social media just serves to magnify the problems.
An interesting area where these issues find an interplay with the law is what you do with "bad" posts once they are out there. While at first, it may seem reflexive to delete the post (if you are able), in many instances it might not be that simple.
A recent tragic case arising out of a dorm room incident at Rutgers University has brought about some potentially significant developments in this area of social media law. The case out of Rutgers arose when Dharun Ravi allegedly videoed his roommate Tyler Clementi's relationship with another student via webcam and distributed a link to that webcam via social media. After Clementi learned that his relationship had been broadcast he tragically took his own life. Charges were initially brought against Mr. Ravi alleging counts related to invasion of privacy. While these facts are tragic, what is particularly interesting when considering the application to social media law is that Ravi was also recently charged with tampering with evidence. (For a more detailed account of the incident, see article by Beth DeFalco of the AP Roommate charged with hate crime in N.J. Suicide).
While on its face, this case may seem unrelated to a business' use of social media, the tampering with evidence charges may provide a window into future developments. As with the evidence in this criminal case, a business that knows civil litigation is likely to arise has a duty to refrain from destroying relevant evidence. While, initially, it may seem perfectly reasonable for a business to delete offensive posts, or remove client complaints, this duty to preserve evidence makes it advisable to consider whether the post potentially relates to a larger legal issue.
Although these evidentiary considerations present potential problems, they do not mean that troublesome posts must be left up indefinitely. Even though the law directly relating to this kind of material is in many respects still being written, a business can provide itself with an added layer or protection through the use of a properly crafted social media policy. Addressing how your business will deal with this sort of material, setting up procedures on how to retain/store relevant posts, training employees on how to deal with these issues, and taking proper measures to ensure that you do not run afoul of the evidence tampering laws are all fairly easy ways to protect your business. As with many other legal issues, proper planning on the front end can help minor legal problems from developing in to major legal disasters.
Let me know what you think.
Monday, April 18, 2011
Is Social Media information "valuable property"?
An interesting question was raised last week Claridge v. Rockyou, Inc. ((2011 WL 1361588 (N.D.Cal.)): Is the personally identifiable information ("PII") submitted to social media sights "valuable property"? Assuming the answer to this question is yes, an interesting corollary to the question, from a privacy perspective is: What are you doing to protect this valuable property? How your company answers both of these questions could have serious consequences.
THE CASE:
Here's what happened: RockYou develops and distributes applications and services for use on social media sites. Among the applications developed by RockYou are Gourmet Ranch and Zoo World. When customers sign up to use RockYou's applications, they are asked to provide an e-mail address, and registration password which RockYou stores. In certain instances, RockYou also requires customers to provide user names and password information necessary for accessing social media sites.
The Plaintiff, a registered account holder with RockYou, brought suit alleging that RockYou failed to secure and safeguard Plaintiffs PII, including email, passwords, and social media login credentials. Plaintiff alleged that while RockYou promised to safeguard user sensitive PII through a policy which stated that "RockYou! uses commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security of your information..." RockYou instead stored PII in clear or plain text which provided no encryption and easily allowed intruders to read and remove the information. Plaintiffs PII was therefore easily accessible to anyone with a minimal amount of hacking ability (of which this author has none).
Plaintiff alleged that instead of leaving the barn door open (to steal a phrase from Gourmet Ranch) RockYou could have followed any one of a number of commonly used methods of protecting PII.
While after reading the opinion, one wonders whether this initial security failure would have been enough to let the matter move forward, if Plaintiff's allegations are true, RockYou likely did not help itself when it delayed in responding to the warnings of a noted online security firm that there was a problem with its database. Specifically, the firm informed RockYou of a SQL injeciton flaw which would allow a hacker to introduce malicious code into a company's network. At some point it was alleged that at least one known hacker accessed the database and copied the email and social networking login credentials of approximately 32 million users.
Plaintiff alleged nine separate causes of action: 1) Violation of the Stored Communications Act 18 U.S.C. Section 2702; 2) Violation of California's Unfair Competition Law, Cal. Bus. & Prof. Code Section 17200; 3) Violation of California's computer Crime Law, Cal. Penal Code Section 502; 4) Violation of the California Consumer Legal Remedies Act, Cal. Civ. code Section 1750; 5) Breach of Contract; 6) Breach of implied covenant of good faith and fair dealing; 7) Breach of implied contracts; 8) negligence; and 9) negligence per se. The Court dismissed the majority of these claims, but allowed Plaintiff's breach of contract, implied contract, and negligence based counts to survive.
In allowing these counts to survive, the Court recognized the issue as whether the plaintiff had sufficiently alleged any actionable harm or concrete loss. Plaintiff's general allegations were that defendant's customers paid for its products and services by providing their PII, and that the PII constitutes valuable property that is exchanged not only for defendant's products and services, but also in exchange for defendant's promise to employ commercially reasonable methods to safeguard the PII that is exchanged. As a result, defendant's role in allegedly contributing to the breach of plaintiff's PII caused plaintiff to lose the ‘value’ of their PII, in the form of their breached personal data. See Claridge *4-5.
While the Court recognized that this theory was novel, it declined to hold as a matter of law that Plaintiff failed to allege an injury. Moreover, the Court specifically noted that the unauthorized disclosure of personal information via the Internet is itself relatively new, and likely to raise issues of law not yet settled by the courts. Finding that the Plaintiff's allegations of harm were sufficient to allege a generalized injury in fact, the case was allowed to move forward.
WHY IS THIS IMPORTANT?:The reason that I find this case particularly interesting is the potential messages that it sends to those companies who possess customer PII. While it is unquestionable that it is a good business practice to protect all client data, did RockYou open itself up to additional exposure by expressly promising to do so? Would the Court have found the same potential liability without the express provisions cited by the Plaintiff?(The breach of contract claim surely would have been more difficult to prove.) Would the claim have been different if RockYou had heeded the warnings of the security firm? What if it had basic protections that were nonetheless breached? An even more interesting question is whether the negligence claims would have been allowed to move forward even without the express promises of safety.
Another emerging issue which this case, and those that will surely follow behind it, could have an impact on is how the log on and user information for social media accounts is considered in the employee/employer environment. If this sort of PII is found to be valuable property does that have an effect upon who retains it when an employer/employee relationship ends? What about "personal" blogs which are directly business focused? Is the lined blurred?
Once again, its important to note that as this is still a rapidly developing area, many of these questions have not been definitively answered by the Courts. While they may not solve every problem, having policies and procedures can provide you with a leg up if and when the issue heads before a Court. (Imagine if RockYou had also had a line in their disclosures which said something along the lines of "PII Submitted to this site is NOT valuable property for the purposes of calculating legal damages...would that have helped?) The intersection of Privacy law and Social Media is sure to be a hot area for litigation for years to come.
Let me know what you think.
THE CASE:
Here's what happened: RockYou develops and distributes applications and services for use on social media sites. Among the applications developed by RockYou are Gourmet Ranch and Zoo World. When customers sign up to use RockYou's applications, they are asked to provide an e-mail address, and registration password which RockYou stores. In certain instances, RockYou also requires customers to provide user names and password information necessary for accessing social media sites.
The Plaintiff, a registered account holder with RockYou, brought suit alleging that RockYou failed to secure and safeguard Plaintiffs PII, including email, passwords, and social media login credentials. Plaintiff alleged that while RockYou promised to safeguard user sensitive PII through a policy which stated that "RockYou! uses commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security of your information..." RockYou instead stored PII in clear or plain text which provided no encryption and easily allowed intruders to read and remove the information. Plaintiffs PII was therefore easily accessible to anyone with a minimal amount of hacking ability (of which this author has none).
Plaintiff alleged that instead of leaving the barn door open (to steal a phrase from Gourmet Ranch) RockYou could have followed any one of a number of commonly used methods of protecting PII.
While after reading the opinion, one wonders whether this initial security failure would have been enough to let the matter move forward, if Plaintiff's allegations are true, RockYou likely did not help itself when it delayed in responding to the warnings of a noted online security firm that there was a problem with its database. Specifically, the firm informed RockYou of a SQL injeciton flaw which would allow a hacker to introduce malicious code into a company's network. At some point it was alleged that at least one known hacker accessed the database and copied the email and social networking login credentials of approximately 32 million users.
Plaintiff alleged nine separate causes of action: 1) Violation of the Stored Communications Act 18 U.S.C. Section 2702; 2) Violation of California's Unfair Competition Law, Cal. Bus. & Prof. Code Section 17200; 3) Violation of California's computer Crime Law, Cal. Penal Code Section 502; 4) Violation of the California Consumer Legal Remedies Act, Cal. Civ. code Section 1750; 5) Breach of Contract; 6) Breach of implied covenant of good faith and fair dealing; 7) Breach of implied contracts; 8) negligence; and 9) negligence per se. The Court dismissed the majority of these claims, but allowed Plaintiff's breach of contract, implied contract, and negligence based counts to survive.
In allowing these counts to survive, the Court recognized the issue as whether the plaintiff had sufficiently alleged any actionable harm or concrete loss. Plaintiff's general allegations were that defendant's customers paid for its products and services by providing their PII, and that the PII constitutes valuable property that is exchanged not only for defendant's products and services, but also in exchange for defendant's promise to employ commercially reasonable methods to safeguard the PII that is exchanged. As a result, defendant's role in allegedly contributing to the breach of plaintiff's PII caused plaintiff to lose the ‘value’ of their PII, in the form of their breached personal data. See Claridge *4-5.
While the Court recognized that this theory was novel, it declined to hold as a matter of law that Plaintiff failed to allege an injury. Moreover, the Court specifically noted that the unauthorized disclosure of personal information via the Internet is itself relatively new, and likely to raise issues of law not yet settled by the courts. Finding that the Plaintiff's allegations of harm were sufficient to allege a generalized injury in fact, the case was allowed to move forward.
WHY IS THIS IMPORTANT?:The reason that I find this case particularly interesting is the potential messages that it sends to those companies who possess customer PII. While it is unquestionable that it is a good business practice to protect all client data, did RockYou open itself up to additional exposure by expressly promising to do so? Would the Court have found the same potential liability without the express provisions cited by the Plaintiff?(The breach of contract claim surely would have been more difficult to prove.) Would the claim have been different if RockYou had heeded the warnings of the security firm? What if it had basic protections that were nonetheless breached? An even more interesting question is whether the negligence claims would have been allowed to move forward even without the express promises of safety.
Another emerging issue which this case, and those that will surely follow behind it, could have an impact on is how the log on and user information for social media accounts is considered in the employee/employer environment. If this sort of PII is found to be valuable property does that have an effect upon who retains it when an employer/employee relationship ends? What about "personal" blogs which are directly business focused? Is the lined blurred?
Once again, its important to note that as this is still a rapidly developing area, many of these questions have not been definitively answered by the Courts. While they may not solve every problem, having policies and procedures can provide you with a leg up if and when the issue heads before a Court. (Imagine if RockYou had also had a line in their disclosures which said something along the lines of "PII Submitted to this site is NOT valuable property for the purposes of calculating legal damages...would that have helped?) The intersection of Privacy law and Social Media is sure to be a hot area for litigation for years to come.
Let me know what you think.
Monday, April 11, 2011
TWISML Hat tip: Eric Goldman (@ericgoldman)
Wanted to throw out a hat tip to Eric Goldman (@ericgoldman) and his Technology & Marketing Law Blog (http://blog.ericgoldman.org/), for his April 9, 2001 post on People v. Welte (2011 WL 1331900). In Welte the Court considered whether communications with those on a public Facebook friends list violated a no contact order or could be considered stalking.
Just one more reminder as to why its important to know and understand your privacy settings.
Just one more reminder as to why its important to know and understand your privacy settings.
Subscribe to:
Posts (Atom)