Deconstructing Data Privacy Class Actions. Law Offices of Clifford A. Cantor, PC

Transcription

1 Deconstructing Data Privacy Class Actions Grace E. Tersigni KamberLaw, LLC Cliff Cantor Law Offices of Clifford A. Cantor, PC

2 DECONSTRUCTING DATA PRIVACY CLASS ACTIONS: Roadmap Investigation Litigation Remediation Resolution

3 INVESTIGATION Consumer complaints Forensics Other sources include news reports, academic publications, and tipsters.

4 COMMON PRACTICES LEADING TO PRIVACY VIOLATIONS Website tracking Mobile tracking Data breaches ISP redirection

5 WEBSITE TRACKING Targets: first and third parties Practices: circumventing users browser controls through: Adobe Flash LSOs aka Flash cookies HTML5 CSS/browser cache hack Dom storage Browser history sniffing P3P compact policy spoofing

6 MOBILE DEVICE TRACKING Unauthorized and unexpected location tracking; and collection and/or disclosure of personal information. Targets include app developers; platform providers; and third parties, i.e., metrics and advertising companies

7 In re iphone App. Litig., No. 5:11-MD-2250-LHK Claims under the California UCL, CLRA, and FAL Geo-tagging location services off idevice data collection by 3rd parties via apps

8 OTHER MOBILE DEVICE TRACKING CASES In RE: Google Android Consumer Privacy Litigation, (N.D. Cal. pending) (Android data collection by 3rd parties via apps) Goodman v. HTC and Accuweather (W.D. Wash.) (HTC cellphones & embedded Accuweather app)

9 VIDEO STREAMING Congress enacted the Video Privacy Protection Act, 8 U.S.C. 2710, aka the Bork Act, in 1988 so that consumers decisions about what videos they want to watch would remain private.

10 VIDEO STREAMING, #2 The VPPA makes it illegal subject to certain narrow exceptions for a video provider to knowingly disclose information that identifies a person as having requested or obtained specific video materials or services, unless the provider obtains the consumer s explicit written, informed consent for each disclosure. 18 U.S.C. 2710(b)(1), (b)(2)(b).

11 VIDEO STREAMING, #3 Violations are subject to a private right of action in federal court. A federal court may award (A) actual damages but not less than liquidated damages of $2,500, (B) punitive damages, (C) reasonable attorneys fees and litigation costs, and (D) equitable relief. 18 U.S.C. 2710(c).

12 WHO IS COVERED BY THE VPPA? VPPA defines video tape service provider as any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials 18 U.S.C. 2710(a)(4) (emphasis added).

13 THE VPPA APPLIES TO DIGITAL DISTRIBUTION OF VIDEOS Indeed the Senate Report discusses extensively the concept of privacy in an evolving technological world. The court concludes that Congress used similar audio video materials to ensure that VPPA s protections would retain their force even as technologies evolve. In re Hulu Privacy Litigation, No. C LB (N.D. Cal. Aug. 10, 2012)

14 2012 VPPA AMENDMENTS The consumer s initial written consent can now be obtained using the Internet, provided that the consent is separate and distinct from any form setting forth other legal or financial obligations of the consumer. In other words, the consent cannot be buried in a long privacy policy or terms and conditions. More significantly, the VPPA Amendments permit the consumer to choose between giving consent either: (1) in advance for a set period of time up to two years or until consent is withdrawn, whichever is sooner; or (2) each time disclosure is sought (as in the old version of the statute).

15 DATA BREACHES Injury: Courts generally do not accept theory that victims are at greater risk of harm after data breach. Will this change with a sympathetic judge? Note: To our knowledge, no federal judge has yet been a victim of identity theft.

16 DATA BREACHES, #2 Courts sometimes accept claims of failure to inform about a security issue. Can be an unfair or deceptive practice. Bell v. Blizzard Entertainment, Inc., No BRO (C.D. Cal. Jul. 11, 2013).

17 DATA BREACHES: Practical Need to Resolve A serious data breach generally needs to be resolved with victims (employees, customers, patients) as a business matter, regardless of potential litigation. Resolution might include: Identity theft insurance Fund for future damages Security audits and updates

18 ISP REDIRECTION ISP redirection of customer communications ISP wiretapping with DPI devices Claims: Electronic Communications Privacy Act; Computer Fraud and Abuse Act (electronic wire-tapping and trespass)

19 MALWARE that steals private information Don t do this. Federal court in Chicago recently certified one of largest classes ever in adversarial litigation. Allegation: Defendant loaded malware onto Internet users computers; constantly collected files, passwords, etc. Claims: violations of Stored Communication Act; Electronic Communications Privacy Act; Computer Fraud and Abuse Act. Harris v. ComScore, Inc., No , 2013 WL (N.D. Ill. Apr. 2, 2013).

20 UDAP STATUTES: The unfair prong The Federal Trade Commission Act of 1914 prohibits unfair or deceptive acts or practices in or affecting commerce. 15 U.S.C. 45(a)(1) (emphasis added). Courts tend to focus on deceptive, not unfair. Now, renewed interest in unfair.

21 FTCA STANDARD FOR UNFAIR For the FTC to find an act or practice unfair, at a minimum the act or practice must cause (or be likely to cause) substantial injury to consumers; which is not reasonably avoidable by the consumers themselves; and not outweighed by countervailing benefits to consumers or to competition. 15 U.S.C. 15(n).

22 WASHINGTON S UDAP STATUTE: New interest in unfair prong Washington s Consumer Protection Act (CPA) prohibits unfair or deceptive acts or practices RCW Courts focused on deceptive. From 1983 to 2013, not a single Wash. case dealt with unfair. Then, in 2013, state supreme court held: The or between unfair and deceptive is disjunctive. Our statute clearly establishes that unfair acts or practices can be the basis for a CPA action. Klem v. Wash. Mut. Bank, 176 Wn. 2d 771, 787 (Wash. 2013).

23 WASHINGTON LAW Standard for unfair No current standard for unfair. 30-year-old case: a) Whether practice is within penumbra of common-law, statutory, or other established concept of unfairness; b) Whether it is immoral, unethical, oppressive, or unscrupulous; c) Whether it causes substantial injury to consumers (or competitors or businesses). Magney v. Lincoln Mut. Sav. Bank, 34 Wn. App. 45, 57 (Wash. App. 1983).

24 WASHINGTON LAW Standard for deceptive Long-time standard for deceptive : An act or practice is deceptive if it has the capacity to deceive a substantial portion of the public. Klem v. Wash. Mut. Bank, 176 Wn. 2d 771, 787 (Wash. 2013) Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wn. 2d 778, 785 (Wash. 1986)

25 WAYS TO REDUCE RISK OF PRIVACY LITIGATION #1 Carefully determine what data you collect, store, and/or release To or about customers, business partners, vendors, credit bureaus To or about employees To targeted advertisers

26 WAYS TO REDUCE RISK OF PRIVACY LITIGATION #2 Secure your data against breaches. In-house data [accidental release, hacking, theft, disgruntled employee] Data on laptops Data on phones Data accessible remotely Data in cloud

27 WAYS TO REDUCE RISK OF PRIVACY LITIGATION #3 Is the data you collect, store, and/or release consistent with expectations? Is it consistent with your advertising? Is it consistent with contractual expectations? Is it consistent with your Terms of Use? Is it consistent with your Privacy Policy?

28 PRIVACY AND SECURITY AUDITS Get regular privacy audits and security that include Computer usage Internet usage Employee privacy Customer privacy Risk assessment

29 USE OF ALTERNATIVE DISPUTE RESOLUTION Companies with direct first-party relationships with consumers can avoid many consumer class actions. How? Use mandatory arbitration agreements with a class-action waiver. Caution: Unconscionability can invalidate the agreement.

30 WIDELY INVALIDATED PRIOR TO 2011 Until 2011, the supreme courts of may states invalidated mandatory arbitration and class-action waivers on the ground that they immunized companies from liability. E.g., Discover Bank v. Superior Court, 36 Cal. 4th 148 (Cal. 2005). Scott v. Cingular Wireless, 160 Wn. 2d 843 (Wash. 2007).

31 REASON FOR INVALIDATING Example of reasoning: [W]hen disputes predictably involve small amounts of damages, then the waiver becomes in practice the exemption of the party from responsibility for its own fraud Discover Bank v. Superior Court, 36 Cal. 4th 148, (Cal. 2005) (original quotation marks and brackets omitted).

32 CHANGE OF LANDSCAPE 2011 In 2011, U.S. Supreme Court held that, in a case raising state-law claims, the Federal Arbitration Act preempted state-court bans on arbitration / class-action waivers: Arbitration is a matter of contract, and the FAA requires courts to honor parties expectations. AT&T Mobility LLC v. Concepcion, 563 U.S., 131 S. Ct. 1740, 1752 (2011) (Scalia, J.) (5-4).

33 CAN ARBITRATION CLAUSE BLOCK FEDERAL CLAIM? What about relying on an arbitration clause and class-action waiver to block a federal claim in court? Would Congress have intended the Federal Arbitration Act to override prior and subsequent federal laws expressly granting a private right to sue?

34 YES Yes: We consider whether a contractual waiver of class arbitration is enforceable when the plaintiff s cost of individually arbitrating a federal statutory claim exceeds the potential recovery. No Contrary congressional command requires us to reject the waiver of class arbitration. American Express Co. v. Italian Colors Restaurant, 133 S. Ct. 2304, 2307, 2309 (2013) (Scalia, J.) (5-4).

35 Dissent in Amex: AMEX DISSENT The owner of a small restaurant (Italian Colors) thinks that American Express (Amex) has used its monopoly power to force merchants to accept a form contract violating the antitrust laws. The monopolist gets to use its monopoly power to insist on a contract effectively depriving its victims of all legal recourse. American Express Co. v. Italian Colors Restaurant, 133 S. Ct. 2304, 2313 (2013) (dissent).

36 AMEX DISSENT, CONTINUED Dissent in Amex: The owner of a small restaurant (Italian Colors) thinks that American Express (Amex) has used its monopoly power to force merchants to accept a form contract violating the antitrust laws. The monopolist gets to use its monopoly power to insist on a contract effectively depriving its victims of all legal recourse. Here is a nutshell version of today s opinion, admirably flaunted : Too darn bad. American Express Co. v. Italian Colors Restaurant, 133 S. Ct. 2304, 2313 (2013) (dissent).

37 CAN ADR CLAUSE BE INVALID? May an arbitration provision or class-action waiver be invalidated? Yes, upon such grounds as exist at law or in equity for the revocation of any contract. 9 U.S.C. 2 (Federal Arbitration Act)

38 CAN ADR CLAUSE NOT APPLY? Sometimes an arbitration provision or classaction waiver will not apply. When?

39 WHEN? #1 Sometimes an arbitration provision or classaction waiver will not apply. When? 1. When a party to litigation is not a party to the agreement to arbitrate [Wrinkes: successor, agent, parent, sub ]

40 WHEN? #2 Sometimes an arbitration provision or classaction waiver will not apply. When? 1. When a party to litigation is not a party to the agreement to arbitrate [Wrinkes: successor, agent, parent, sub ] 2. When the scope of the agreement to arbitrate does not cover the dispute at issue.

41 INDUSTRIES USING ADR CLAUSES TO BLOCK LITIGATION Industries: Use of arbitration provisions & class-action waivers (case law just since July 2013): Credit cards Banking / lending Software Cellphone service Telecomm Internet service providers Cable TV Employment Consulting Construction Investment / brokerage CBAs Internet / technology Insurance Real estate Publishing Health plans Franchising Biotech ERISA plans Debt settlement Credit reporting Legal

42 BASICS OF RESOLVING A CLASS ACTION A class action, like any litigation, may be resolved by motion (e.g., summary judgment); trial; or settlement. Settlement reduces litigation expenses and uncertainties and allows control over remedies.

43 REQUIREMENTS FOR CLASS ACTION SETTLEMENTS A class action may be settled in federal court only after: the judge directs notice in a reasonable manner to all class members who would be bound; class members have an opportunity to object; the judge holds a hearing and determines that the settlement is fair, reasonable, and adequate. Fed. R. Civ. P. 23(e).

44 COMMON FORMS OF RELIEF Common forms of relief included in privacy settlements: Payments (or credits, for current customers) To all class members; or To class members who submit a claim. Injunctive relief Changing the challenged practice; Purging of data collected under old practice; Identity-theft protection / insurance. Cy pres fund Establish fund for as near as possible remedy in addition to or in lieu of relief to individual class members.

45 DIRECT PAYMENT VS. CLAIMS PROCESS Payments to all class members: Pro: Everyone who was affected gets some relief Con: Amount may be nominal, which can annoy your customers Con: You may not know names & addresses Payments to only those who submit a claim: Pro: Fewer payments means each payment will be larger and more meaningful to recipient Pro: Claimants are self-identifying; you know names & addresses Con: Relief is likely to go to only a small fraction of class

46 BEST PRACTICES Evolving best practices for claims process Use a robust notice program Differentiate the notice of settlement from junk mail or spam Make the claims process streamlined Choice: online or mail Claim web-page should be clear and simple: Check, Check, Check, Submit. Claims administrator should work with claimants whose claims are deficient

47 In re Baby Products Approval evolving standards or errant case law? Some new case law indicates a settlement might not be approved unless the judge knows either a minimum amount to be paid or a total amount to be paid. We vacate the District Court s orders approving the settlement Most importantly, it did not know the amount of compensation that will be distributed directly to the class. In re Baby Prod s Antitrust Litig., 708 F.3d 163, 175 (3rd Cir. 2013).

48 PRIVACY SETTLEMENTS WITH CY PRES COMPONENT It may be difficult to distribute funds directly to intended beneficiaries i.e., the class members. Judges allow distributing funds for their next best use, a purpose (often charitable) reasonably approximating the interests pursued by the class. The term cy pres comes from the Norman French expression cy près comme possible, which means as near as possible.

49 NEW CASES ON SETTLEMENTS WITH CY PRES COMPONENT #1 The Ninth Circuit requires that cy pres beneficiaries be tethered to the nature of the lawsuit, the objectives of the underlying statutes, and the interests of the class. In settling a class action alleging deceptive practices, donation of $5.5 million to provide food for the indigent was unacceptable. An appropriate cy pres recipient would be an organization dedicated to protecting consumers from deceptive practices. Dennis v. Kellogg Co., 697 F.3d 858, 867 (9th Cir. 2012).

50 NEW CASES ON SETTLEMENTS WITH CY PRES COMPONENT #2 In the Ninth Circuit, the cy pres distribution must bear a substantial nexus to the interests of the class members In a case involving online privacy, forming a new entity to receive and distribute cy pres funds to other entities that promote the causes of online privacy will benefit class members and passes muster. Lane v. Facebook, Inc., 696 F.3d 811, 821 (9th Cir. 2012), petition for cert. filed (Jul. 26, 2013).

51 NEW CASES ON SETTLEMENTS WITH CY PRES COMPONENT #3 In the Ninth Circuit, if the cy pres donation is a dollar amount of goods as opposed to cash, the settlement should specify how the goods are to be valued i.e., retail, wholesale, at cost? And if the defendant already donates to charities, the settlement should specify whether the cy pres donation is in addition to what the company previously budgeted. Dennis v. Kellogg Co., 697 F.3d 858, 867 (9th Cir. 2012).

52 COUPON SETTLEMENTS Coupon components of class-action settlements are disfavored. Such settlements are treated critically in statute and case law. In re HP Inkjet Printer Litig., 716 F.3d 1173 (9th Cir. 2013).

53 WHEN YOU GET BACK TO THE OFFICE: To Do (1) Find out what personal data you collect/store and why. (2) Find out to whom you give or sell the data and who has access to it. (3) Ask: Is this consistent with everyone s reasonable expectations (employees, customers, web users, vendors, the public, )?