California Ups the Ante On Privacy Policy Disclosures

For the past decade, California law has set the template for commercial website privacy policies.  With the passage of a new law, set to take effect January 1, 2014, the state has updated the disclosures required of any commercial website operator who collects personally identifiable information from California residents.

California’s Online Privacy Protection Act.   In 2003, California became the only state to require all websites that collect personal information (“PII”) from visitors – in this case, California residents – to post a privacy policy.   Until then, there was no generally applicable privacy policy requirement under either state or federal law, and, to this day, neither the other states nor the federal government have imposed such a requirement.  Federal privacy policy requirements have been limited to specific kinds of information (such as under Children’s Privacy Protection Act) or industries (under the Health Insurance Portability and Accountability Act).  Under the 2003 law, Internet sites need to identify the “categories” of personally identifiable information collected about “individual consumers”; describe the “categories” of third parties with whom the information may be shared; disclose (if there is one) any process for individuals to review or request changes to their personal information; explain how notice is given to consumers of changes in the privacy policy; and post the policy’s effective date. The definition of PII is more expansive than encountered in data breach statutes, and includes email addresses, partial addresses (including street names and towns), and first and last names.  The privacy policy also must be “conspicuously” posted, as defined by the statute.

Now, however, the law has been significantly expanded.

The New Requirements. Under recently enacted Assembly Bill 370, the privacy policy requirements of California’s Online Privacy Protection Act have been expanded to include (1) disclosure of how the web site “responds to Web browser ‘do not track’ signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party Web sites or online services, if the operator engages in that collection”; and (2) disclosure of “whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service.” The statute was approved by the Governor and chaptered by the Secretary of State on September 27, 2013. It will take effect on January 1, 2014. Fortunately for Internet sellers, the law provides that “[a]n operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.” As a result, potential liability will only attach after a notice of noncompliance. Nonetheless, it is prudent to review and amend privacy policies to conform with the new law to avoid having to implement last minute changes should your company receive notice of non-compliance (which is not defined, and presumably could include a telephone call or email from a consumer).

The Light Still Shines.   Companies should also remain mindful of California’s so-called “Shine the Light” Law, which can be found at California Civil Code § 1798.83, and as to which we’ve previously blogged. Violations of this law, which, among other things, requires privacy policy disclosures, have led to class actions being filed against Internet sellers.  Customers can be awarded up to $3,000 per each violation, plus attorneys’ fees and costs.  Some of these cases have been dismissed, but the costs of defending even an unsuccessful class action lawsuit can be substantial.

The Shape Of Things To Come.  California isn’t stopping there. Beginning on January 1, 2015, all web sites that direct services to minors, or have actual knowledge that minors are using their sites, must provide a “delete” button to permit minors to remove all of their online content (together with clear instructions for doing so). The law will also prohibit Internet marketing of a wide variety of products and services to minors, including aerosol paint (apparently to inhibit graffiti), etching creams, BB guns, and tanning services. Unlike the COPPA, which is directed to persons under the age of 13, the California law applies to all persons under the age of 18.

Beyond California and Massachusetts: Will Collecting Zip Codes Invite Class Actions Across the United States?

Although California and Massachusetts have stolen the spotlight with high profile cases banning zip code collection in connection with credit card purchases, thirteen other states and the District of Columbia have similar laws. With voracious class action attorneys circling, it is critical for retailers to know their legal obligations in these jurisdictions and, if necessary, adjust their privacy practices and policies.

Yet, because these statutes are to varying degrees vague, untested, and archaic, compliance can be difficult. At the same time, the risks could scarcely be higher. Hundreds of companies have already been ensnared in consumer class action lawsuits in California and Massachusetts, and the litigation floodgates may now open in other states as well.  And the math is simple. With penalties as high as $1,000 every single time a zip code, address, or telephone number is collected illegally--for periods going back as far as six years--even a relatively small company could face a liability in the millions or tens of millions of dollars.  You're also likely to be required to pay the plaintiffs' legal fees if you lose, which are often as much as one-third of the penalty calculation.

The State Law Landscape.  A general baseline for state statutes governing the collection of personal information during credit card transactions is a prohibition against retailers requiring customers to provide certain information in connection with a credit card transaction.  California and a few other states, including Wisconsin, go further, barring even the requesting of such information.  Other states, like Massachusetts, prohibit the "writing" of such information, usually on "a credit card transaction form" -- although, as the industry learned in Massachusetts, writing doesn't necessarily mean writing (it can mean inputting information electronically) and a "transaction form" might be interpreted to include a marketing database (the Massachusetts court dodged this issue for now).

Not Just Zip Codes.  Seven states appear to limit their prohibitions to customers' addresses and telephone numbers, and not the sweeping concept of "personal identification information" included in the California and Massachusetts statutes.  (In California, for example, "personal identification information" is defined as information not appearing on the face of a credit card, and so it could include not only zip codes, but also a state of residence, a birthday, an email address, or a person's gender.)

But, even in the states that expressly limit their bans to addresses and telephone numbers, the decisions in Massachusetts and California reveal a path by which these statutes might be interpreted to reach the collection of zip codes only.  For example, the Supreme Court of Massachusetts felt free to deem zip codes to be "personal identification information" because "a consumer's zip code, when combined with the consumer's name, provides the merchant with enough information to identify through publicly available databases the consumer's address or telephone number, the very information § 105 (a) expressly identifies as personal identification information."  As a result, the court found that not extending the prohibition to zip codes "would render hollow the statute's explicit prohibition on the collection of customer addresses and telephone numbers, and undermine the statutory purpose of consumer protection." In other words, even if you are not collecting addresses and telephone numbers in these states, you could still be at risk.

Exceptions.  Most of these statutes have exceptions that benefit direct marketers. California, for example, allows retailers to collect zip codes and other "personal identification information" if it "is required for a special purpose incidental but related to the individual credit card transaction, including, but not limited to, information relating to shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders."  In other states, like Massachusetts, the exception is more narrowly drawn, and, in some states, there are no exceptions at all.  And even for those laws which allow address information to be collected for shipping, the exception does not extend to address collection in gift transactions where the billing address and the shipping address are different.

Enforcement.   Of course, one of the biggest issues for direct marketers is the risk of being the subject of a government investigation or a class action lawsuit.  The risk of government enforcement (by a state attorney general, for example) is likely low in all states except in the event of a data breach--which underscores the need for companies to have in place information privacy and security policies that reduce the risks of such a breach.  As importantly, states are unlikely to seek astronomical penalties from retailers, something that is the bread and butter of class action cases.

The risk of a federal or state class action lawsuit--on behalf thousands upon thousands of consumers--is much higher.  These privacy statutes are very attractive to class action lawyers because they often have a "per violation" penalty that can drive potential recoveries into the stratosphere. This, in addition to provisions that allow plaintiffs (but not defendants) to recover attorneys' fees, makes them a very attractive basis for filing a barrage of lawsuits in the hopes that some of them will succeed or, even in failing, provoke lucrative settlements.

In the past, privacy-related class actions have often foundered because the plaintiffs could not demonstrate any "injury."  Many state consumer protection laws, including the one in Massachusetts, require such an injury to allow a suit to go forward.  (Some, like California, Wisconsin, and the District of Columbia, do not require a showing of injury.)  But, we learned from the Michaels case in Massachusetts that courts can stretch the concept of "injury" beyond recognition.  The Supreme Court of Massachusetts found that the "invasion of privacy" caused by the receipt of a just one unwanted catalog was sufficient "injury" to maintain a class action lawsuit.  In Michaels, it was alleged that the retailer used the zip code to obtain customers' mailing addresses, and then sent unsolicited catalogs to those addresses.  That was the extent of the "harm."

California "Right to Know" Act Would Require Companies to Disclose Personal Information to Consumers

A California legislator recently re-introduced a bill that, if passed, would further solidify California’s place at the forefront of privacy regulation among U.S. States. AB 1291, the “Right to Know Act of 2013,” would require businesses to provide to consumers, upon request, a copy of all personal information the company has collected and retained about that consumer, as well as information about any parties with whom that information is shared.

Under California’s existing “Shine the Light” law, California consumers already have a right to request, no more than once a year, a list of third parties with whom a company has shared personal information for direct marketing purposes, and a description of the information shared. Companies may currently comply with the law by allowing consumers to opt-out of having their information shared with third parties for direct-marketing purposes.

The proposed law would broaden a consumer’s right of access considerably, giving consumers a right to obtain a copy of any personal information a company retains about that customer, regardless of whether the information is shared with third party marketers. Significantly, this includes both information a company may collect from a customer in connection with a transaction (e.g. name, email address, mailing address, order history), as well as any information purchased from third-party data brokers and incorporated into the consumer profile maintained by the company (e.g. demographic information provided by data brokers).

It is too early to predict whether the bill will be passed by the California legislature, but it is sure to be controversial. Some privacy advocates have applauded the bill, arguing that consumers need greater transparency regarding data collection practices, and noting that Europeans already enjoy similar rights of access. (An Austrian law student made headlines several years ago when he requested his information from Facebook and received more than 1,200 pages of data). Industry groups, on the other hand, are justifiably concerned about the potential cost of complying with the bill’s mandate, and about potentially increased exposure to lawsuits. As currently written, the bill would allow private consumer lawsuits, which could make litigation attractive to class-action lawyers.

We will continue to monitor developments in this area. Whether or not this particular bill becomes law, it is not the first and will not be the last time we see a push for greater transparency around data collection, particularly with respect to the practice of “data enhancement” or using information about consumers provided by data brokers rather than the consumers, themselves. (See related blog posts, here and here).

The Perils of Zip Code Collection Reach Massachusetts

On March 11, 2013, the Supreme Court of Massachusetts joined California in prohibiting the collection and retention of customer zip codes by retailers in connection with credit card transactions. In Tyler v. Michaels Stores, Inc., the Court based its decision on Massachusetts General Law ch. 93, § 105(a), which provides that retailers cannot “write, cause to be written, or require that a credit card holder write personal identification information not required by the credit card issuer, on the credit card transaction form.”  Like California, the Massachusetts court interpreted "personal identification information" so broadly as to include mere zip codes.

Background.  In 2011, the Supreme Court of California sent shock waves through the retail industry when it ruled in Pineda v. Williams Sonoma Stores, Inc. that zip codes constituted “personal identification information” under California Civil Code § 1747.08 that could not be collected and retained in connection with credit card transactions except in very limited instances. The prohibition against collection of personal identification information applied even if zip codes were requested, but not required, to complete a purchase. As a result of the decision, retailers selling to California consumers have faced costly class action lawsuits (with claims for as much as $1,000 per violation) even if no actual damages or injury could be shown. And while the Supreme Court of California recently held in Apple, Inc. v. Superior Court, that this prohibition did not apply to online transactions involving digitally downloaded products, the Court was careful to state that it was reserving judgment as to whether it applied to “any other transactions that do not involve in-person, face-to-face interaction between the customer and retailer”—explaining that “we express no view on whether the statute governs mail order or telephone order transactions...”

It should be noted that the California prohibition does not apply where address information (including zip codes) is required for “a special purpose incidental but related to the individual credit card transaction, including, but not limited to, information relating to shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders.” Cal. Civ. § 1747.08(c)(4). Thus, in most instances, direct marketers may be outside the scope of California’s prohibition when the address information is required, for example, for shipping. This exclusion, however, may not apply in gift transactions where a product is shipped to a third-party, or where the customer makes arrangements to pick up a product at an in-state location other than his or her home address.   Like California’s law, the statute in Massachusetts defines “personal identification information” broadly, and includes a narrower exception where the information is “necessary for shipping, delivery or installation of purchased merchandise or services or for a warranty when such information is provided voluntarily by a credit card holder.”

The Massachusetts Case.  In reaching its holding, the Supreme Court of Massachusetts concluded that zip codes were “personal identification information” because, when combined with a consumer’s name, they provide “the merchant with enough information to identify through publicly available databases the consumer’s address or telephone number…” And while the Court found that a consumer had to show injury in order to sue based upon a violation of § 105(a), such an injury was not limited to a “loss of money or property.” The court ruled that “actual receipt by a consumer of unwanted marketing materials” constituted an actionable injury, as did “the merchant’s sale of a customer’s personal identification information to a third party.” While the court was not presented with the question of whether the law applied to online or mail order transactions, its expansive interpretation could well reach direct marketers who fall outside § 105(a)’s limited safe harbor.  One question the Massachusetts court did not address: whether the law prohibits the entry of a zip code (or other personal information) into a company database, as opposed to its entry on an electronic credit card transaction form. That nuance may provide a ray of hope for retailers caught up in the class action frenzy this decision is likely to trigger.

Nationwide Risks.  Retailers face risks in other jurisdictions that have statutes similar to those in California and Massachusetts, including Delaware, the District of Columbia, Maryland, Minnesota, Nevada, New Jersey, New York, Ohio, Oregon, Pennsylvania, Rhode Island, and Wisconsin. It would be wise to carefully review your information collection rules in these and other states as a first line of defense against class action lawsuits and state enforcement actions.  In combination, the California and Massachusetts decisions are so wide-sweeping as to provide tremendous encouragement to class action lawyers eager to test the reach of laws in other states.

Congressional Privacy Caucus Begins Inquiry into Data Brokers

The Bipartisan Congressional Privacy Caucus, chaired by Representatives Ed Markey (D-Mass.) and Joe Barton (R-Texas), announced this week that they are launching an inquiry into data brokers.  Members of the caucus sent letters to nine data brokers – Acxiom, Epsilon (Alliance Data Systems), Equifax, Experian, Harte-Hanks, Intelius, Fair Isaac, Merkle, and Meredith Corp.  – requesting that they provide information about their practices. 

The Caucus’s letters request information including:

• The names of entities that have provided consumer information to the data broker;
• The data items collected from or about consumers and the methods by which the data was collected;
• Products or services offered to third parties that utilize consumer data;
• The information consumers are given access to, if it is requested, and any policies around sharing or deletion of that data; and
• Encryption or other safety protocols used to protect data.

The data brokers were asked to respond within three weeks. 

This is not the first time data brokers have attracted the attention of Washington policymakers, and it is not likely to be the last.  The data broker Acxiom was recently the subject of a lengthy article in the New York Times, reporting on Acxiom’s comprehensive consumer database, as well as its “PersonicX” product, which assigns individual consumer households to one of 70 specific consumer segments and 21 life-stage groups, with names such as “flush families” or “savvy singles.” The article was specifically mentioned in the Caucus’s letter to data brokers.  Earlier this year, as blogged about in this space, the FTC called for Congress to pass legislation specifically regulating the data broker industry.  Because consumers are rarely even aware of the existence of data brokers, the FTC did not view self-regulation as a realistic option for the sector. 

While data brokers may be anonymous to consumers, they are familiar to many direct marketers, who rely on them for a variety of services.  It is still too early to predict what effect, if any, the recent attention paid to data brokers will have on the industry, or the impact it may have on the services that direct marketers have come to depend on.  It seems likely, however, that any future regulation will require greater transparency for consumers. 

One possible outcome is that data brokers may in the future be subject to the kinds of reporting requirements applicable to consumer credit reporting agencies.  While practices currently vary throughout the industry, data brokers are not consumer-facing, and it is not generally possible for a consumer to get access to the full range of information that a data broker may have collected about him or her.  Julie Brill, an FTC Commissioner, has explicitly drawn the comparison to the credit reporting industry, telling the New York Times that, following the 1996 amendment of the Fair Credit Reporting Act of 1970, the credit reporting agencies shifted from being client-oriented to being consumer-oriented.  “The data broker industry could do the exact same thing,” Commissioner Brill commented. 

We will continue to monitor developments in this space, including responses to the Privacy Caucus’s letters.  The Caucus does not have subpoena power, but other industries have cooperated with it in the past.  Most recently, wireless carriers voluntarily provided information to Rep. Markey in response to letters requesting information about the records they share with law enforcement. Those responses made headlines earlier this month, when it was reported that in 2011 alone, state, local and federal law enforcement agencies made 1.3 million requests for wireless records, and that requests were increasing each month. 

FTC Report outlines Consumer Privacy Framework, urges self-regulation

Following on the heels of the White House’s “Consumer Privacy Bill of Rights,” (recently discussed in this space), the Federal Trade Commission released its own final report on Consumer Privacy last month: “Protecting Consumer Privacy in an Era of Rapid Change, Recommendations for Businesses and Policymakers.” The issue of consumer privacy online continues to receive sustained attention from privacy advocates, policymakers and journalists (see, for example, the Wall Street Journal’s “What they Know” series), and this latest policy paper highlights a number of important areas for retailers.

The Commission’s Report, like the White House Report before it, is at heart a set of recommendations.  Its publication does not change the state of the law, or impose any new obligations on companies with respect to privacy.  While the Commission does urge Congress to pass targeted legislation requiring greater transparency in the data broker industry, its approach is primarily focused on encouraging industry self-regulation.  The advantages of this approach for industry sectors are obvious: by acting affirmatively in an area of public concern, industries can have a hand in shaping the rules so that they appropriately reflect the realities of a particular sector.  An adequate system of self-regulation could eliminate the perceived need for further regulatory or legislative action.  Companies should keep in mind, however, that once they adopt a voluntary code of conduct, they must abide by it, or they may open themselves up to an FTC enforcement action.  The practical lesson is simple: companies should only make promises they intend to keep.

The Commission outlines a privacy framework that it believes should be the basis for the voluntary codes of conduct it hopes companies will develop and adopt.  The four key areas of focus are:

Scope: The Commission applies its privacy framework to all companies that handle personal data, with a limited exception for companies that handle personal data for fewer than 5,000 individuals a year, and who do not share that data with any third parties.  The framework applies to data that is “Reasonably linkable to a specific consumer, computer, or device.”  This definition is an expansion of the traditional definition of “Personally Identifiable Information,” and reflects, in part, the Commission’s concern that data which has been removed of personally-identifiable characteristics, or “de-identified,” can often be re-identified.   

Privacy By Design: The Commission urges companies to adopt privacy practices consistent with the “Privacy by Design” model.  This means implementing practices that reflect the substantive principles of Data Security, Reasonable Collection Limits, Sound Retention Practices, and Data Accuracy.  These principles recognize that there is often both a business need and a consumer benefit associated with the collection and use of personal data, but requires that the scope of data collection and retention be reasonably related to the purpose for which it is collected.

Simplified Consumer Choice:  The Commission believes that consumers should be given meaningful and understandable choices about the way their personal data is collected and used by companies.  One of the important features of the Framework is its emphasis on context in determining the appropriate level of choice required for a particular data practice.  Thus, companies who collect personal data directly from consumers may use that data without offering a consumer any choice, when they engage in certain “commonly accepted” practices, including 1) product and service fulfillment; 2) internal operations; 3) fraud prevention; 4) legal compliance and public purpose; and 5) most first-party marketing.  For other types of data uses, including tracking across websites for behavior-based advertising, the Commission calls for companies to offer consumers clear choices, provided at a relevant time.  This includes respecting consumers’ use of a “do not track” option on web browsers.  

Increased Transparency: Consistent with its focus on the context in which personal data is collected and used, the Commission calls for increased transparency regarding consumer privacy practices.  It is particularly concerned with practices that take place without consumer awareness, including the practice of “data enhancement,” in which companies take personal data they have collected in the context of a relationship with a consumer, and combine it with data obtained by third party data brokers to create detailed consumer profiles.  Because data brokers – who collect and sell personal information about consumers directly to other businesses for marketing or other purposes – are largely invisible to consumers, it is difficult for consumers to exercise choices about the way their personal data is collected and used by these brokers.  The Commission supports targeted legislation to increase the transparency of the data broker industry, and suggests the creation of a centralized data broker portal, that consumers could visit to learn more about what information data brokers have collected about them, to verify the accuracy of that data, and to exercise appropriate choice.

The Commission’s emphasis on context reflects a new way of thinking about privacy in the internet era.  In a world of social media, consumers are accustomed to sharing some personal data and to making trade-offs relating to privacy, but they are concerned when a company’s collection or use of personal data is surprising or inappropriate to the service being provided.  Google and Facebook, for example, provide free services to consumers in exchange for using consumer-provided personal data to target those consumers for advertising.  Both companies ran afoul of the FTC, however, when they unilaterally made public certain information that consumers had previously assumed to be private.  The Commission deemed these actions to be unfair and deceptive trade practices and brought enforcement actions.  As a result of settlements with the Commission, both Google and Facebook have agreed to obtain affirmative, express consent from consumers before materially altering their privacy policies, and to submitting to 20 years of privacy audits.

For retailers, the Commission’s Report, and its record of enforcement in the Consumer Privacy area, illustrates an important truth about privacy: the practices that will receive the greatest scrutiny, and provoke the strongest reaction – be it public outcry, regulatory enforcement or legislative action – are those practices which are generally unknown to consumers, and which, when they come to light, strike consumers as surprising and inappropriate.  One way to guard against this kind of outcry is to take steps to better explain the ways that personal data is collected and used.  On the other hand, a sure way to provoke outcry and invite regulatory attention is to take a public position on privacy and then unilaterally fail to abide by it.

Regulators generally recognize that the collection and use of personal information is essential to the growth of the internet economy.  With their focus on encouraging self-regulation, the White House and the Commission hope to strike a balance that allows for continued innovation, while giving consumers greater comfort and more control regarding the ways their information is collected and used.  By cooperating with the Commission in developing sector-specific codes of conduct, retailers and other companies who collect and use personal data in the course of business have an opportunity to shape the rules pertaining to acceptable data practices.  The Commission does view these proposed self-regulatory codes of conduct as enforceable, however, and it will investigate companies found to be violating their own commitments.  Companies should thus be cautious in developing their privacy policies, and should only make commitments they are confident they can honor.

Co-authored by Nat Bessey

Obama Administration Releases Consumer Privacy Bill of Rights

In April 2011, Senators Kerry and McCain introduced a bill entitled the “Commercial Privacy Bill of Rights." As discussed in this space, the bill would have required online collectors of information to permit individuals to opt out of the collection of information about browsing and shopping activities and required affirmative consent (opt-in) for the collection of sensitive personally identifiable information, including email addresses. The bill’s introduction was met with significant hand-wringing by the online business community about the impact that it might have on the business practices of even the most reputable electronic merchants. The bill was referred to committee, and little has been heard about it since.

But the issue has not gone away. Apple, Google, Facebook, Path, UPromise, and others have all suffered embarrassing public relations setbacks as a result of the exposure of certain of their practices relating to the collection and use of user information.

In the meantime, the Obama Administration has shifted its focus to a (mostly) non-legislative solution to the perceived need for more robust protection of consumers’ online privacy. On February 23, 2012, the Obama administration published A Consumer Privacy Bill of Rights The Consumer Privacy Bill of Rights provides for industry self-regulation coupled with the prospect of government enforcement in the event that industry fails to do the things that it claims it will do. It would apply to “personal data,” broadly defined as any data that can be linked back to an individual.

The seven principles enshrined in the Consumer Privacy Bill of Rights are as follows:

1. “Consumers have a right to exercise control over what personal data companies collect from them and how they use it.” This principle would require that consumers be given an appropriate measure of control over the personal data that companies collect and use. The control mechanisms should be simple and be commensurate with the scope and sensitivity of the data being collected.
   
2. “Consumers have a right to easily understandable and accessible information about privacy and security practices.” This principle would require clear and meaningful disclosures of the types of date collected, why the data is needed, how it will be used, and whether and for what purpose it might be shared with third parties.
3. “Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provided the data.” Pursuant to this principle, companies should limit their use and disclosure of data to purposes that are consistent with the relationship that the company has with the consumer, and the context in which the data was disclosed.
4. “Consumers have a right to secure and responsible handling of personal data.” This principle imposes an obligation on companies to handle personal data in a responsible manner and to maintain reasonable safeguards against loss, unauthorized access, or disclosure.
5. “Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate.” This concept would require that, at least with respect to certain kinds of sensitive data, companies should permit consumers to view information that has been archived about them and allow consumers to make corrections to that data.
6. “Consumers have a right to reasonable limits on the personal data that companies collect and retain.” Under this theory, companies should only collect as much data as they need to accomplish the disclosed purpose of their data collection and should delete the data when it is no longer necessary.
7. “Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.” This provision would require training of employees and accountability to enforcement authorities in the event of noncompliance with the principles embedded in the Consumer Privacy Bill of Rights.

The basic provisions of the Consumer Privacy Bill of Rights are so general as to be virtually meaningless without significant additional work. The administration’s plan is to work with stakeholder groups from various industries though what it refers to as a “multistakeholder process” to develop the practices and technologies necessary to implement these general principles. The stated objective is to draft a set of guidelines specific enough to be enforceable But, at least initially, the process does not contemplate enforceable legislation or regulation. Rather, the working groups would establish best practices which companies would then have the opportunity to adopt. In the event that a company fails to comply with the voluntarily undertaken rules, it would be subject to potential enforcement action by the FTC. Ultimately, however, the administration acknowledges that it would be in favor of legislation providing the FTC and the various state attorneys general to enforce the industry-written guidelines.

Although the substantive provisions of the Consumer Privacy Bill of Rights are very general, the document contains some clues as to the administration’s priorities among the specific provisions of the final codes of conduct.   Nevertheless, the text of the report foreshadows some of the specific rules that appear to be important to the administration:

1. It appears likely that changes to browser technology (something akin to Firefox’s “private browsing” tool) may play an important role. Major online players such as Google and the Digital Advertising Alliance were involved in the drafting of the document and the publishers of the major browsers have apparently agreed to honor consumers’ “do not track” selections.
2. On0e of the seven basic principles focuses on accessibility to information and the ability of consumers to correct mistakes.Many collectors of online data currently do not provide either of those capabilities, so it will be interesting to see in what direction the discussion moves on that topic.
3. The “individual control” discussion, a discussion of the complexities presented by third party aggregators of data, must be addressed. These third party aggregators may have no direct relationship with consumers, and include those who search publicly available sources of data for the purpose of building profiles of individuals. These entities currently are not within the reach of privacy regulations, but the focus on that model suggests that they may be within the reach of the new standards.

It remains to be seen whether the process envisioned by the Obama Administration will actually result in any enforceable or meaningful development in the privacy area. And there is no guaranty, of course, that Congress will refrain from acting in the meantime, or that various states may act on their own. It is certain, however, that the conversation will continue, and that the outcome has the potential to be very important to members of the direct and online marketing communities.

Commercial Privacy Bill of Rights Introduced in Congress

The introduction of the so-called Commercial Privacy Bill of Rights by Senators Kerry and McCain on April 12, 2011 suggests that we may be about to enter an era of robust regulation of information gathering regarding the online browsing and shopping habits of consumers. This type of data has come to be an important tool for online marketers to improve the efficiency of online advertising buys, and to improve other marketing techniques. At a minimum, this development presents a risk that online merchants will need to build out substantial new technical infrastructure to accommodate a welter of new rules under this bill. Beyond that, it may make it difficult even for highly respected and responsible merchants to engage in marketing activities that are an important part of their tool kit in the information age.

Among other things, the bill contains the following requirements:

• Collectors of information must implement security measures to protect the information they collect and maintain.

• Collectors of information must provide clear notice to individuals of the collection practices and the purposes of such collection. Additionally, collectors must provide the ability for an individual to opt out of any information collection that is unauthorized by the Act and to provide affirmative consent (opt-in) for the collection of sensitive personally identifiable information. Respecting companies’ existing relationships with customers and the ability to develop a relationship with a potential customers, the bill would require "robust and clear" notice to an individual of his or her ability to opt-out of the collection of information for the purpose of transferring it to third parties for behavioral advertising. It would also require collectors to provide individuals either the ability to access and correct their information, or to request cessation of its use and distribution.

• Collectors must bind third parties by contract to ensure that any individual information transferred to the third party by the collector will only be used or maintained in accordance with the bill’s requirements. The bill requires the collector to attempt to establish and maintain reasonable procedures to ensure that information is accurate.

These requirements can be expected to have significant operational impacts on direct marketers. The requirement for notice and opt-out rights for a series of practices that are quite technical in nature promises to be easier said than done. Existing privacy laws require only notice of the collection of personal information (much more narrowly defined than in this bill) and only very limited opt-out rights–essentially limited to CAN-SPAM compliance. This new bill would potentially require merchants to allow consumers to opt out of the collection of pixel tags, the placing of cookies, and the sharing of data harvested from those tools with third parties. Simply building the tools necessary to collect and implement those requirements would pose significant burdens and costs for online marketers, and may very well be beyond the abilities of many merchants.

Further, the bill stretches the definition of personal information beyond any commonly understood meaning of that term. It includes email addresses and postal addresses, and if "used, transferred or stored" in connection with any of the foregoing, birth date, and most significantly, "unique identifier information." Unique identifier information is defined as "a unique persistent identifier associated with an individual or a networked device, including a customer number held in a cookie, a user ID, a processor serial number, or a device serial number." This definition essentially means that virtually any data collected about a browsing session will be protected by this statute, with strict limits on the ability to use or transfer that data without approval.

The existence of an "established business relationship" exception to some of the requirements of the bill provides cold comfort. It applies not to the commonly understood relationship of customer and merchant, but only to the "establishment of an account." While this may be typical of some merchants' relationships with their customers, many retailers do not require the establishment of an account in order to make a purchase. It is interesting to note, however, that the 800 pound gorillas in the online space, notably Google and Facebook, would be the most likely to benefit from this exception.

The bill seeks to accomplish these objectives by requiring the FTC to promulgate regulations effectuating the statute's requirements for the most part within 60 to 180 days after enactment of the bill, depending upon the provision at issue. Accordingly, it will likely be a long time before these requirements take effect (if ever), given the Congressional legislative calendar, and the frequently protracted rule-making process that would attend any promulgation of regulations. During both the legislative process and the regulatory process, the direct marketing industry will have an opportunity to point out the technical challenges presented by this statute, as well as the potential unintended consequences, including damage to the economy, that the statute could create.

Update to eMarketers: Canada’s FISA Broader than US’s CAN-SPAM Act

Last late year, Canada enacted the Fighting Internet and Wireless Spam Act (FISA).  The framework established by FISA is fundamentally different from the United States’s CAN-SPAM Act.  First, while CAN-SPAM applies only to commercial email, FISA applies to any form of electronic message sent for marketing purposes (referred to as a “Commercial Electronic Message,” or “CEM”), including: email; SMS; instant messaging; and social media/networking. U.S. regulations have not to this point targeted communications with customers across social media.

Second, and perhaps more significantly from the standpoint of most U.S. firms, FISA requires affirmative consent from a potential recipient of a message before marketers can send a CEM.  This feature of the law stands in sharp contrast to CAN-SPAM, which permits at least “one free shot” at a recipient, provided that the message itself is CAN-SPAM compliant (ie. the message includes opt-out instructions, clearly identifies the sender, identifies itself as commercial email, etc.).

Accordingly, U.S. companies now will need to differentiate their approach to marketing to Canadian customers from their approach to marketing to U.S. customers in order to ensure compliance with both the Canadian and U.S. statutes.  Commonly utilized techniques for acquiring contact information, such as list rental, if used to market to Canadian customers, now have the potential to expose marketers to a violation of FISA.

The good news is that the Canadian law contains a broad definition of “Consent.”  “Consent” can either be “express” or “implied” and can also include circumstances in which (i) the sender has a business relationship with the recipient, (ii) the recipient has published its electronic address in a prominent manner, or (iii) the recipient has provided its email address directly to the sender.   The conventional wisdom is that a customer who provides an email address in connection with placing an order, for example, has implicitly consented to the receipt of commercial emails.

In short, those merchants who email Canadian customers would do well to take a second look at their method of acquiring emails, and undertake to determine whether their current practices comply with this new requirement.

DMA Wins Landmark Injunction Against State of Colorado

On behalf of the Direct Marketing Association, Brann & Isaacson partners George Isaacson and Matthew Schaefer won a landmark preliminary injunction in federal court in a lawsuit that affects thousands of direct marketers across the country. The ruling prohibits the State of Colorado from enforcing its controversial new law, H.B. 10-1193, that required direct marketers to -- among other things -- report to the state the names, addresses, and purchase amounts of their customers.

To be clear, so long as the injunction remains in place, out-of-state retailers that do not have nexus with Colorado and do not collect Colorado sales tax are no longer required to: (1) give notice to their Colorado customers, in connection with each sale, that the customer must report Colorado use tax (the “Transactional Notice”); (2) send via First Class mail by January 31, to each customer that purchased more than $500 of goods for delivery to Colorado during 2010, a summary of their purchases for the year (the “Annual Purchase Summary”); or (3) submit a report to the Colorado Department of Revenue, by March 1, listing the name, billing and shipping addresses, and total amount of purchases of all customers who purchased goods for delivery to Colorado (the “Customer Information Report”).  See http://www.colorado.gov/cs/Satellite/Revenue/REVX/1251581938320.

The DMA argued that the law violates the Commerce Clause of the United States Constitution by (a) imposing discriminatory obligations upon out-of-state retailers that do not apply to in-state Colorado retailers, and (b) unduly burdening interstate commerce under principles set forth by the Supreme Court in Quill Corp. v. North Dakota, 504 U.S. 298 (1992). The Court accepted these arguments in finding that the DMA had a likelihood of success on both Commerce Clause counts, and concluded that out-of-state retailers subject to the new law would suffer irreparable harm if enforcement of the statute is not barred.

The preliminary injunction entered by the Court does not end the case, but it effectively suspends the law while the litigation continues and until the Court makes a final ruling regarding the law’s constitutionality.

You can read a copy of the order here.

Read previous posts about the lawsuit here and here.

DMA’s Constitutional Challenge to Colorado’s Notice and Reporting Law Will Be Argued In Federal District Court on January 13

A happy new year to our readers. Many internet and catalog retailers have been following with interest the constitutional challenge of the Direct Marketing Association (“DMA”) to Colorado’s new notice and reporting law, H.B. 10-1193, enacted in 2010. In addition to burdensome consumer notice requirements that went into effect last year, the law requires out-of-state retailers that do not collect Colorado sales and use tax to send (by January 31, 2011) annual purchase summaries to customers purchasing $500 or more of goods for shipment to Colorado and, worst of all, to file (by March 1, 2011) with the Colorado Department of Revenue a listing of all of the retailer’s customers who have purchased goods for shipment to a Colorado location, regardless of where the customer resides.

As we previously reported (see our July 2, 2010 post), the DMA contends that the Colorado law violates multiple provisions of the United States Constitution, because it discriminates against interstate commerce, exceeds the State’s regulatory authority over out-of-state businesses, violates the privacy rights of Colorado consumers, infringes the free speech and due process rights of retailers and consumers, and deprives retailers of their valuable customer list information without due process or fair compensation. The DMA has filed a motion for preliminary injunction based on the law’s violations of the Commerce Clause, asking the Court to suspend enforcement of the law’s notice and reporting requirements pending a full adjudication of the law’s constitutionality.

The federal District Court for the District of Colorado has scheduled a hearing on the DMA’s motion to be held on January 13, 2011, at 10:00 a.m. in Denver. B&I senior partner and lead counsel for the DMA, George Isaacson, will argue the motion on behalf of the DMA. We will report on further developments after the hearing.

Do As I Say, Not As I Do: The FTC "Do Not Track" Initiative Could Cripple E-Commerce

Just as governments – including our own – are pursuing aggressive new initiatives to gather information about our individual browsing habits and electronic communications for law enforcement purposes, the FTC has decided to advise Congress on sweeping initiatives to prevent direct marketers from engaging in far less invasive practices that present none of the grave risks attendant to enhanced government surveillance.  Indeed, many of the commercial practices targeted by the FTC actually benefit consumers by assisting Internet sellers to configure their web sites, adjust their product offerings, and tailor advertising to the specific needs and interests of consumers.  While the FTC shrilly intones that consumer information about Internet browsing has been used by an unidentified "some" in "an irresponsible or even reckless manner," it fails to acknowledge forthrightly that the vast majority of direct marketers use such information solely to better serve their customers, and that new laws and FTC initiatives are unlikely to faze the tiny group of Internet pirates who misuse consumer data.

Although most headlines have focused on the FTC's proposal for a "do not track" list, the FTC report is about much more than that.  It foretells a highly aggressive new regulatory strategy that may change the landscape of Internet privacy without any concern for the cost impact on industry or a realistic assessment of the privacy interests of consumers.  It sweeps so broadly against business as to suggest that–if the FTC has its way–even entirely benign and non-intrusive information collection practices that do not track individual consumers will be sharply curtailed.  At the same time, new and intrusive requirements will be injected multiple times into virtually every consumer experience on the Web.  If you do business on the Internet, you need to know what the FTC is hoping to unleash on eCommerce.

If the FTC has its way, you will need to redesign your web sites and emails to provide real-time notice and choice to every consumer, whether or not they make any purchases.   The overarching theme of the report is highly paternalistic, suggesting that consumers are incapable of making informed choices about their buying decisions and Internet browsing activities.  Thus, privacy policies and full disclosure of information collection practices are viewed dimly by the FTC.  Instead, it commands that “consumers should [repeatedly] be presented with choice about collection and sharing of their data at the time and in the context in which they are making decisions.”  Not only would implementation of such a scheme add substantially to the programming costs of commercial web sites, it could interfere significantly with the consumer purchasing experience.  It is hard to imagine Web sales not suffering. 

The FTC's "Do Not Track" Initiative Creates a Presumption Against Collecting Information About Web Site Usage, Even If that Information Is Not Individually Identifiable.  The item in the report receiving the largest amount of press is the “do not track” recommendation.  It would obligate direct marketers to implement technology – through something “similar to a cookie,” according to the FTC – that would prevent the collection of web browsing activities by individuals or individual browser installations.  This would be mandated even if retailers do not actually collect individually-identifiable personal information.  Indeed, the FTC report supports doing away with the line drawn in existing law between information that is personally identifiable and that which is not, claiming that “traditional distinctions between the two categories of data are eroding.” Because "some" companies allegedly find surreptitious ways to connect non-personal information to specific individuals, the FTC is ready to recommend that all companies be prevented from collecting even aggregate usage data, which could be a significant blow to retailers who use this data to obtain helpful information for their businesses.  Data collection serves important functions that parallel the physical retail environment, including the measuring of foot traffic in certain areas of a store.  Denying this data to retailers in its non-personally identifiable form suggests a significant lack of government understanding of – or at least a gross lack of sensitivity to – legitimate industry needs.

At present, the FTC, itself, believes that it does not have authority to implement a tracking system without further action by Congress.  But, the pressure is on for Congress to enact a potentially sweeping new set of powers for the agency.  In the interim, the makers of at least one popular browser, Firefox, are exploring ways to implement a “do not track” feature that leaves it to consumers to choose whether they will be tracked.  Microsoft has already implemented a similar feature in its most recent release of Internet Explorer.  This approach is far less onerous for retailers, but may rob them of the very data they need to present consumers with meaningful purchasing choices through targeted advertising.  The least effective and most intrusive recommendation – that the FTC appears to favor – involves a “do not track” list that may leave it to Internet companies to figure out whether a person who is visiting their web site has chosen to place themselves on a list.   Because the specifics have yet to be determined, it is unclear what this list would even look like.  The FTC claims that a list of machine specific identifiers (as might be embedded in an operating system or hardware) or IP addresses is not a likely option.

Prepare to Open Your Files.  Some of what the FTC report recommends is positive for the industry, including “standardized” privacy-related notices (which might reduce uncertainty surrounding potential challenges by privacy rights groups, among other things), but the context – including whether federally mandated notices would preempt individual states from enacting different or more complicated disclosure requirements and whether class action lawsuits would be permitted against violators – remains a mystery, and the potential perils for eCommerce are significant.  Other FTC recommendations are chilling, including the requirement that companies provide customers “reasonable access” to all the data maintained about them and that the Children’s Online Privacy Protection Act’s onerous obligations be extended to cover children between the ages of 13 and 17.

What's Next?  The FTC has asked for industry comments as it pushes forward with its new privacy initiative.  This is a critical moment for direct marketers to be heard in petitioning the government to create and implement a more sensible, uniform approach to privacy protection that balances a realistic assessment of the potential harm to consumers against potentially dramatic and commerce-suppressing costs.

B&I Files Constitutional Challenge to Colorado Notice and Reporting Law for The Direct Marketing Association

We've blogged frequently about Colorado's new notice and reporting law (see here and here).

Since our last posts on the topic, Brann & Isaacson's George Isaacson and Matthew Schaefer filed suit in federal district court in Colorado on behalf of The Direct Marketing Association in The Direct Marketing Association v. Roxy Huber.  Filed on June 30, the suit challenges the constitutionality of the new Colorado law.

The Colorado statute, which targets out-of-state retailers, purports to require those retailers to notify Colorado customers of their obligation to self-report use tax and to require those same retailers to turn over confidential purchasing information regarding Colorado customers to the Colorado Department of Revenue. In the complaint, the DMA, the leading global trade association of direct marketing businesses and nonprofit organizations, asserts that the Colorado statute discriminates against interstate commerce, exceeds the State’s regulatory authority over out-of-state businesses, violates the privacy rights of Colorado consumers, infringes the free speech and due process rights of retailers and consumers, and exposes confidential consumer information to the risk of unauthorized disclosure.

We'll continue updating you as developments arise.

Have a safe and happy Independence Day!

The "Draft" Federal Privacy Bill: Uniformity, But at What Cost?

On May 3, 2010, Representatives Rick Boucher, Democrat of Virginia, and Cliff Stearns, Republican of Florida introduced a “discussion draft” of a bill “[t]o require notice to and consent of an individual prior to the collection and disclosure of certain personal information relating to that individual.”  The bill seeks to provide uniform, national regulation of information collection and disclosure practices for a wide range of companies--governing not only the Internet, but all other channels of interaction between businesses and consumers--and it has already generated controversy.  Not only does it include a definition of private information that goes far beyond all existing laws, it contains strict notice and consent provisions that may be difficult and costly to implement.  It is unclear what triggered the drafting of the bill, nor what compelling public interest would warrant such a degree of intrusion into private business practices.

It is important to keep the draft bill in perspective.  Numerous privacy and security bills have been proposed over the years and Congress has, to date, been unable to pass anything coming close to comprehensive national legislation.  For example, repeated attempts to pass federal security breach legislation have failed, resulting in a plethora of state laws which are both confusing and inconsistent.  If Congress can't bring itself to pass uniform rules dealing with the very real issue of security breaches involving the theft or loss of sensitive personal information, the likelihood of it passing a comprehensive law governing the collection and use of personal information -- a far less serious matter -- seems limited, at best.

Nevertheless, it remains useful to examine the bill and how it addresses key issues that affect eCommerce companies.  Even if the bill fails to gather support in Congress, individual states may feel inspired to adopt some of its provisions.

Background.  To date, the laws governing online information collection and usage have been a patchwork.  While some states, like California, have enacted more general Internet-related privacy laws, the federal government has never seen fit to act globally in this arena, leaving businesses generally to self-regulate through the voluntary adoption of privacy policies.  Although it may come as a surprise to some, there is no federal law mandating privacy policies as a general matter.  Instead, Congress has limited such requirements to discrete categories of businesses (such as online businesses catering to children, banks and financial institutions, and health care providers, among others).

Key protections for business.  Most notably—and importantly—for direct marketers, the draft bill has a clear preemption provision.  In other words, it supersedes “any provision of a statute, regulation, or rule of a State that includes requirements for the collection, use, or disclosure of covered information.”  This would dramatically simplify the initial task of understanding the scope of a company's legal obligations in this arena, and would prohibit overlapping regulation by the states.  Just as importantly, the bill provides no private right of action in federal or state court, not even the much abused class action lawsuit.  Enforcement would rest in the hands of regulators rather than plaintiffs’ lawyers—removing a profit motive for enforcement which often prevents reasonable settlements.  Unlike plaintiffs' attorneys, regulators will take into account the unique facts and circumstances of each case and exercise something akin to "prosecutorial discretion" in determining which cases to bring and the appropriateness of any resulting penalty.

Who is subject to the requirements of the bill?  The only companies that escape its reach are those that (1) collect “covered information” from less than 5,000 individuals in any 12-month period and (2) do not collect “sensitive information.”  Unless you meet both of these criteria, you are subject to all of the bill's requirements.

What information does the bill cover?   In terms of what is deemed to be private information, the bill's reach is unprecedented and ought to be very worrisome to the industry.  A person's name, alone, is suddenly protected, as any individual's postal address, telephone number, or email address.  To date, no state or federal law reaches this far, and, as drafted, it leads to absurd results.  For example, it could mean that telephone companies have broken the law by publishing their local "white pages," since names and/or telephone numbers are deemed private.  Private information also includes fax numbers, unique biometric data, any government-issued identification number, financial account numbers (including credit and debit card numbers) along with any password necessary to permit access, any “unique persistent identifier,” including an IP address, and even preference profiles.  (Under the bill, a "preference profile" means “a list of information, categories of information, or preferences associated with a specific individual or a computer or device owned or used by a particular user that is maintained by or relied upon by a covered entity.”)  “Sensitive information” is defined to include all medical information; race or ethnicity; religious beliefs; sexual orientation; financial information associated with a financial account; and “precise geolocation information.”

The following is a sampling of some of the substantive provisions of the bill:

• The bill requires a “privacy notice” to be made available to every individual from whom “covered information” is obtained.   Where information is collected via the Internet, the notice must be clearly and conspicuously posted and accessible from the home page.  Given FTC guidance in this area, the clear and conspicuous requirement would mean the link should be visible without scrolling down.  Where information is collected by means other than the Internet, the notice must be provided in writing before the information is collected.  It appears that this requirement could be met by with a counter display or printed handout.  However, such a sign or handout would be far more than a simple "heads up" notice.

• There are fifteen separate content requirements for a “privacy notice." It would need to include  the nature of the “covered information” collected; how such information is collected; the specific purposes to which such information is put; how (and how long) such information is stored; how such information may be combined with other information obtained about the individual from other sources; how the information is disposed of; the purposes for which such information is disclosed to third parties and the “categories” of such third parties; the choices available to consumer to limit or prohibit collection or disclosure; the means by and extent to which the individual may obtain access to such information; the process by which notice is given of changes to the policy; and the effective date of the policy.  While some of these disclosures are familiar to online sellers, they—in whole—exceed customary industry practices.

• Businesses must obtain the prior consent of the individual to collect and use “covered information.”  Such consent must be either an “affirmative grant” or a failure “to decline consent,” either of which must follow the provision of the privacy statement to the individual.  Strikingly, however, the law allows the consumer to withdraw consent to the use information at any time, even if it was previously collected after consent was obtained.  

• With some exceptions, express affirmative consent must be obtained in the event of any material change to the privacy notice or any new use of information which an individual would reasonably “not expect based on the covered entity’s prior privacy notice.”

As might be expected, consumer groups are already arguing that the bill fails to go far enough.