Data Protection Harm

Data Protection Law - Consumer Protection Law

Data protection harm has become key in courts determining standing in data breach cases.  Data protection harm was analyzed in a case involving breaches and hacking of personal identifiable information (PII).  The 7th Circuit's attention was drawn where it reversed a district court ruling holding that where future harm suffices for standing (Remijas v. Neiman Marcus Group, LLC).  The court reasoned that hackers could potentially have a future affect by their very intention to hack personal information.

The court noted that the retail store offered every customer that was affected by the breach one year of free credit monitoring and ID theft protection. While the plaintiffs asserted a list of claims, they also alleged claims based on imminent injuries arguing on the increased risk of future credit fraudulent charges and their vulnerability to identity theft.  These accompanied their present injuries of the lost value of time trying to remedy their fraudulent charges and to protect themselves against identity theft.  They also alleged loss of control over their personal private information.  They argued that to an undetermined extent they have lost their privacy.

Reversing the district court was drawn on their reasoning that the effort to resolve credit issues and fraudulent charges and or to seek protection from the vulnerability of other possible identity theft clearly sets the basis for standing. The court balanced the consequence of weighing the future harm and the present uncertainty in favor of siding with the plaintiffs.

The court reasoned that it would be unfair to wait for the harm to occur from hacker’s activities, as it recognized that hackers inevitably will use the hacked information to execute future charges and use the identities of the plaintiffs.  The court did underscore that to merely lose personal information is insufficient to establish standing from data breaches.  The decision on the merits awaits.

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.  

Linking Defamatory Content Online

A case from Washington state dealt with online defamation from linking defamatory content online.  The court wrestled with the issues of proving defamation online.  The court articulated that the First Amendment freedom speech is to be protected and the courts hold to that as well when it comes to online speech and linking defamatory content.  In the era of the internet, many a customer especially disgruntled ones take to the internet to disparage a business, either for genuine reasons or out of malice.  Alike to the disgruntled patron, is the competitor who uses the medium for its business purposes raising other issues.
The court analyzed the situation of republication of defamatory content in the context of providing a link to a  site that directed the reader to read defamatory content that was about the plaintiff but it was located on another site.  The court held that the linking to a site where the defamatory statement about the plaintiff resided did not constitute ‘republication.’  Even if the Communications Decency Act, Section 230 applied to the case, the court reasoned that under common law, linking defamatory content to a site is not tantamount to “republication” in the context of defamation.
The court weighed the evidence provided by the plaintiff to substantiate the claims.  However, it found the comments to be mere opinions and not provided to be factual in nature.  It determined that though there was a claimed decline in business, the plaintiff did not provide evidence linking the decline to the statements made on the defendant’s site.   Plaintiff also did not provide evidence demonstrating that individuals were influenced to not to do business with plaintiff as a result of the comments made online.  The statements made on social media sites open for public comments may not meet the requisite elements of defamation.
Life Designs Ranch, Inc. v. Sommer, 2015 WL 7015867 (Wash. Ct. App. Nov. 12, 2015) 

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.  

 

Copyright and Derivative Work

In the realm of intellectual property, copyright and derivative work gets attention when the issue of collaborative rights arises. Copyright and derivative work controversies happen when the joint contributing plans do not materialize as intended between, for example software developers, researchers, writers, or production designers.

The scenario is similar to one dealt with by the First Circuit in Greene v, Ablon, where coauthors conducted a study to collaborate in the writing a research study that was intended for a book. One of the co-authors had a previous work that was being included in the collaborative piece.  At first glance by the District Court, it determined that a contributed derivative work in to the collaborative subsequent work could not be both joint and derivative.

Conversely on appeal, the court found that a co-authored subsequent project could be both a joint product and as well one with an embedded derivative component. The contribution has copyright value for its author though introduced and incorporated in a subsequent collaborated project.

The appeals court upheld the lower court’s decision regarding joint work by underscoring the Copyright Act’s definition, “a work prepared by two or more authors with the intention that their contributions be merged into inseparable or interdependent parts of a unitary whole.”  17 U.S.C. § 101.  The intention of the collaborators is key point.  The appeals court considered the definition of ‘derivative work’ pursuant to the Act as “a work based upon one or more preexisting works.”  17 U.S.C. § 101.

Moreover, the appeals court determined that the author of the previous work holds the copyright on that work and as well holds a copyright on the derivative work that was collaborated on with a co-author using the previous work.  Greene v. Ablon, 794 F.3d 133 (1st Cir. 2015)

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.  

Standing in Data Breach Cases

Standing in data breach cases has been tossed around with the tossing hinging on "harm" and its reality. The Eastern District court for Pennsylvania weighed into this issue. After years of hesitation to find standing in data breach cases, federal courts are now viewing factors to base standing.  When the matter has been the disclosure of personally identifiable information (PII), the courts have not found standing in data breach because they required evidence of actual usage of that PII.  The actual suffering of identity theft attacks brings upon the effects that the courts are seeing as highly relevant to finding standing in data breach cases.

In a case where computers were stolen and the files were not encrypted, the court found that the company breached its contract to protect personally identifiable information when the company did not safeguard the computers and did not reasonably invest in cyber security.  The court in that light allowed the restitution claim to proceed as well as the breach of contract to protect the PII of employees and former employees.

The harm claimed by the plaintiff was demonstrated by the misappropriation of the plaintiff’s identity and its bank account, in addition to credit cards usage, financial transactions and employment applications filed using plaintiff’s identity.  Despite the defendant’s claim that plaintiff’s harms were speculative, the court viewed them as a result of the fraudulent transactions that were made using the plaintiff’s identity and that sufficed to give the plaintiff standing in a data breach case.

See  Enslin v. The Coca-Cola Co., No. 2:14-CV-06476 (E.D. Pa. Sept. 29, 2015).

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.  

Personal Identifiable Information under VPPA

Personal identifiable information and its vulnerabilities in the digital age is disconcerting. Digital media law and the digital media industry wrestles with how courts define personal identifiable information under the Video Privacy Protection Act.  This definition is important to companies that stream deliver videos to customers. How broadly the court define the scope of liability will remain a concern with personal identifiable information under the VPPA.

In a case from the Southern District of New York, Robinson v. Disney Online (No. 14-04146), the court set out some demarking points on defining personal identifiable information under VPPA.  The court determined that personal identifiable information is one that identifies the individual who has accessed specific video materials.  The court then distinguished this from the name and address that identifies and individual by statutory criteria.  Yet it set out that identifying the serial number of a device does not identify the individual.

In its explanation, the court stressed personal identifiable information it is the information that is disclosed by a ‘video tape service provider,’ by logical conclusion, then the video tape service provider does the identifying.  Whoever does the identifying is relevant to the equation in order to fit under the requirements of the VPPA and ensure that it is not a nonparty to the issue at hand.

What is important about personal identifiable information under VPPA is how liability is defined based on the disclosed information actually identifying a specific person.  Bits of information separated cannot identify an individual until they are brought together.  The attempt to arrive at some loose basis for identifying an individual would erase boundaries for defining personal identifiable information under VPPA.  A useful definition for PII as raised by the court in Robinson is information identifying a particular person as one who has accessed video content and not the serial number of the device used.

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.  

Personal Data Privacy in Wearable Tech

The industry is concerned with personal data privacy in wearable tech you buy and use. The personal data privacy in wearable tech that is collected has gotten the attention of the consumer electronic industry and have promulgated some guidelines.  They has set a voluntary standard of principles to follow.

The CEA, Consumer Electronics Association has set some principles address for the industry addressing personal data privacy in wearable tech. The concern is with the data the wearable tech can produce and what will be done with it.

The points or principles are as follows and they are aspirational in a homily form:  They addressed security and the company’s responsibilities; emphasized consumer need to know about policy and practice as it relates to comfort and confidence in using the wearable tech; noticed the need for clear and concise notices on how the data collected will be used; stressed transparency in how third-parties may transfer collected data; and underscored the importance of fairness in handling the data results that are generated against the unwelcomed circumstances that may emerge.

The principles ended with ideas on how to enhance the ability review personal data, correct it, and delete it; enhance how consumers will have control over how the data is communicated; and enhance the privacy balanced with governments request for personal data. By all means these are in developmental stages which require consumer input and industry implementation of these principles.

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.  

Website Immunity

 

Website operators, either as defendants or plaintiffs have resorted to Section 230 of the Communications Decency Act (CDA) to determine website defamation immunity and defamation liability.  Under the Section 230, blogs or forums, for instance, benefit from website immunity from tort liability if the information was from a third-party.  That third-party could be a subscriber, a passing through poster, or even a frequent poster of content and comments. The website immunity as it is dealt with by the courts is not settled when the content has characteristics and or origin that embroils the website operator.

The CDA defines interactive computer service as an information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, i.e., a distributor.  The CDA defines information content provider as one typical of a publishers who creates and develops content.

Website immunity is in question when the content’s creation has an element of operator involvement.  Website immunity is also questioned when a website has an interactive function. What the courts have delved to discern to what extent the operator’s conduct was involved in editing and selecting the content which may affect website immunity.

Website immunity can be triggered with an operator’s ‘passive’ hosting activity which is typical of one in a distributor function.  However, if the operator exercises editorial discretion in determining the selection of submitted material or its content, the website immunity will be questioned as with a publisher.   Website immunity hinges on the function of the website operator over the content displayed on its website while the courts have disparately treated the subject.

Lorenzo Law Firm is “Working to Protect your Business, Ideas, and Property on the Web."

Copyright 2015, all rights reserved Lorenzo Law Firm, P.A.