The Summer of Privacy: With the Government Under Fire, Retailers May Overlook New Rules and Risks

This may one day be known as the Summer of Privacy. From claims that the NSA surreptitiously obtains cellphone (and GPS) information from at least 100,000,000 Americans to the Supreme Court blessing routine collection of DNA evidence from arrestees, it is impossible to avoid almost daily stories on governmental privacy issues. But, don't be fooled by the focus on governmental activity. From advances on the "do not track" front to a vastly expanded federal children's privacy rule going into effect on July 1, 2013, the privacy temperature is rising not just for the government, but for online and multichannel retailers as well.

For someone who has worked in the field of privacy for many years, this summer has involved a much welcome return of focus to the substantial harm that can result from a governmental violations of privacy rights, as opposed to the alleged harms caused by retailers. Unlike the recent privacy case against Michaels Stores in Massachusetts, where the alleged “harm” was the mere receipt of unwanted catalogs, government collection and misuse of private information can lead to dire consequences, ranging from Internal Revenue Service audits to profiling and criminal charges.  Moreover, the privacy issue as it relates to the government is one of constitutional dimensions.  As Justice Brandeis famously (and presciently) said in his dissenting opinion in Olmstead v. U.S., 277 U.S. 438, 478 (1928), the very first wiretapping case heard by the Court, each citizen has “the right to be let alone — the most comprehensive of rights and the right most valued by civilized men. To protect that right, every unjustifiable intrusion by the government upon the privacy of the individual, whatever the means employed, must be deemed a violation of the Fourth Amendment.” Olmstead was ultimately overturned, and Justice Brandeis' famous standard adopted, in Katz v. U.S., 389 U.S. 347 (1967), where the Court found a constitutional “right to be let alone” where a "reasonable expectation of privacy" existed.

Don't Be Fooled.  Even though the media is dominated by stories involving governmental intrusions into our private lives, the government itself remains fixated on pushing “do not track” requirements, with even a Republican FTC Commissioner giving industry what may amount to one last chance to come up with meaningful self-regulation rather than face the “static legislative solution” championed by Democratic FTC Chairwoman Edith Ramirez.  Ramirez recently vowed "to more aggressively regulate Internet companies like Facebook and Google and has called on Congress to pass privacy legislation.” Ironically, the most publicized "do not track" bills of the last few years impacted mostly on smaller online companies, and included gaping loopholes for the likes of Google, Facebook, and Apple.  As a result, every online seller needs to look closely at proposed "do not track" schemes — whether legislative or under voluntary industry standards — and decide whether proactive measures are appropriate, including involvement in industry groups and lobbying.  In all of their various iterations, "do no track" rules could have a considerable negative impact on online and multichannel retailers.

New Children's Privacy Rules.  There are also the new children’s privacy rules that go into effect on July 1, 2013, and which are creating significant compliance issues for many companies. Among other things, the new rule expands the definition of “personal information” to include “persistent identifiers” which can include online user names, cookies, and IP addresses, and the number of web sites that could fall under its requirements may be far larger than under prior law.

Privacy Litigation In Full Bloom.  Finally, litigation over privacy issues continues apace, not only including the now infamous zip code collection class actions, but also actions brought by privacy rights groups against companies like Snapchat.  Snapchat is accused of misleading users by claiming that its messages self-destruct after a fixed period of time.  However, according the Electronic Privacy Information Center, they do not.  This kind of litigation underscores the risks that can result if a company does not accurately describe its privacy-related practices, and reinforces the need to keep a close watch on your business activities to make sure that your privacy policy and other statements to consumers remain accurate.

We will continue to follow developments in privacy as it relates to both merchants and consumers and continue to update our readers in this space.

UPDATE:  The National Journal published a thoughtful and detailed article on June 13, 2013 about what Americans think about privacy, and which institutions they trust most. As the author, Ronald Brownstein explains: "Asked what would do the most to protect people’s personal information on the Internet, just 8 percent picked more government oversight. The biggest group (48 percent) said the key was 'more commitment by companies to not share users’ information with other businesses or government.'"

Google Updates AdWords Policies Following Suit Over Trademark Infringement

After several years of litigation over the use of trademarks in paid search advertisements, or AdWords, Google recently introduced new policies protecting trademark owners. Google now requires written permission from the trademark owner in order to use a trademark term in the text of a paid search ad—even if the advertiser is a legitimate reseller of the trademarked product. This is a curious development considering that it departs from Google’s past practice of being less aggressive with regard to trademark issues. For example, Google long ago abandoned a policy of permitting trademark owners to block bidding on trademarks used as ad words. The explanation for this change appears to be linked to a rare defeat for Google in a lawsuit relating to its AdWords advertising service.

Back in 2009, Rosetta Stone sued Google for trademark infringement, contributory infringement, and dilution based on Google’s practice of allowing acknowledged counterfeiters of Rosetta Stone software to purchase sponsored search results using Rosetta Stone’s name. Although the suit was initially dismissed by a federal court in 2010, in April 2012, the United States Court of Appeals for the 4th Circuit reinstated Rosetta Stone’s claims. The 4th Circuit found that there was a genuine question of fact as to whether web users would be confused about the source of sponsored search results purchased by acknowledged counterfeiters of Rosetta Stone software. The court’s conclusion was based in part on internal Google documents that showed that consumers are often confused as to the meaning of sponsored search results. Moreover, the evidence in the case showed Rosetta Stone repeatedly notified of Google of paid search ads for counterfeit software—over 190 times in a seven month span.

The Rosetta Stone case is unusual in that it may be the first time that a trademark-related case involving AdWords appeared to be headed to trial. (In the US, that is—Google has lost a number of trademark cases in Europe and in fact has different AdWords policies there as a result). Not surprisingly, the case settled. No specific terms of the settlement have been disclosed, but in a somewhat terse joint statement, Google and Rosetta Stone announced their intention to “collaborate to combat online ads for counterfeit goods and prevent the misuse and abuse of trademarks on the Internet.” Shortly thereafter, Google amended its Ad Words policies. Given the language of the joint statement, and the timing of the subsequent change in Ad Words policies, it seems likely that the Rosetta Stone case is responsible for the new requirement that trademark owners provide permission for the use of trademarks in paid search ad copy.

Beyond the change to Google’s policies, the case is significant going forward as well. It suggests that Google may be held responsible in instances in which it has knowledge that the ads create confusion and/or point to counterfeiters’ web sites. This marks a new development in the area of paid search infringement analysis that bears further watching.

German Court Rules That Google Can Be Held Liable for Defamatory Auto-complete Search Suggestions

Anyone who has performed a Google search in the past several years will likely have noticed Google’s auto-complete function, which automatically suggests search terms as the user types. For example, when a user recently entered the terms “Brann & Isaacson,” Google suggested “Brann & Isaacson law firm.” But what happens if, instead of helpful or innocuous suggestions, Google suggests something scandalous?

Google itself has consistently maintained that it has no direct control over its results or suggestions, which are generated automatically. Because Google’s suggestion algorithm reflects the frequency with which particular search terms are entered, however, it is a natural engine for spreading and legitimizing gossip. The more a rumor is repeated, re-tweeted or re-blogged, and the more it is searched, the louder it becomes, and the more likely it is to find its way into Google’s suggested auto-complete terms. Now, a German Court has ruled that Google can be held liable if its auto-complete function suggests defamatory search results.
 
In Decision VI ZR 269/12 (May 14, 2013), The German Federal Court of Justice (Bundesgerichtshof), Germany’s highest court of ordinary jurisdiction, considered a case brought against Google by two plaintiffs, a company and the company’s chairman, who had sued to remove auto-complete suggestions the plaintiffs considered defamatory. Users who searched for plaintiffs’ names would see suggested search terms including “Scientology” and “Fraud.” The Court ruled that, while Google has no obligation to proof its auto-complete results in advance, it does have an obligation, once it has been put on notice that suggestions falsely imply a factual link between an individual or entity and terms that have negative connotations, to remove those terms from the suggestions and to prevent similar suggestions from appearing in the future.

The case is making headlines in Germany, partly because of its potential effect on a high profile lawsuit brought by Germany’s former first lady, who has sued Google under the same theory, alleging that Google’s suggested search terms gave credence to certain rumors about her past. At this blog, however, we will be paying particular attention to how the ruling plays out in a larger context, and whether any other jurisdictions adopt similar positions.

To date, courts in the United States have rejected attempts by private litigants to hold Google or other search engines liable for unwanted search results or suggestions. Section 230 of the Communications Decency Act provides interactive computer service providers with broad immunity against liability for third-party-created content, providing that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” and that “no cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with this section.” 47 U.S.C. §230(c)(1), (e)(3). This section makes it difficult to hold a search engine liable for defamation in the United States based on search results. A woman in Wisconsin, who objects to the appearance of results and advertisements for impotency drugs in connection with her name, has filed a series of lawsuits against search engines alleging trademark violation and commercial misappropriation, rather than defamation. Her efforts have thus far proven unsuccessful. (See, most recently, Stayart v. Google, 710 F.3d 719 (7th Cir. 2013)).