California Bill to Expand Data Security Breach Notification Law Clears Senate Hurdle

By Rachel Tarko Hudson

Last week, the California state Senate passed S.B. 46, a bill to expand the triggering data under the existing data security breach notification law. Currently, breach notification in California is triggered by the unauthorized acquisition of an individual’s first name or initial and last name in combination with one or more of the following data elements, when either the name or the data elements are unencrypted: social security number; driver’s license or state identification number; account, credit card or debit card number in combination with any required security or access codes; medical information; or health information. S.B. 46 adds to the list of data elements, password, user name or security question and answer for an account other than a financial account. Like the existing list of personal information, this additional information must be in combination with the first name or initial and last name of the individual and one of the elements must be unencrypted in order to trigger the reporting requirement.

Continue Reading...

Who Owns Your Online Persona?

By Paul Cowie and Wayne Chang

Eagle v. Morgan, 2013-11-4303 (E.D. Pa. 2013), represents one of the first trials on the issue of who owns social media accounts: the individual employee who first created the account or the employer whose business was promoted using the account? In Eagle a company's founder sued her former employer for the alleged illegal use of her LinkedIn account. The U.S. District Court for the Eastern District of Pennsylvania held that an employer's conduct, absent a company social media policy, resulted in the torts of unauthorized use of name, invasion of privacy by misappropriation and misappropriation of publicity. The court, however, held the employer not liable for conversion, tortious interference with contract, civil conspiracy and civil aiding and abetting. Lastly, the court rejected the employer's counterclaims of misappropriation and unfair competition.

Continue Reading...

Privacy On The Go: Recommendations For The Mobile Ecosystem

California’s Attorney General today issued recommendations for mobile app developers and the mobile industry to safeguard privacy for consumers.

Pinterest "Pins" New Guidelines For Sweepstakes And Contests

Pinterest has released new Promotions and Marketing Guidelines for retailers, consumer brands and other companies running promotions on its platforms. Among other things, the new guidelines say don’t run a sweepstakes where each pin, repin or like represents an entry.

FTC Enacts COPPA Updates

In October we reported that the FTC had issued its proposed updates to COPPA. Today it enacted these new rules.

California AG to Begin Enforcing Privacy Law Against App Developers - $2500-per-Download Fines

By Rachel Tarko Hudson

Mobile app developers must now conspicuously post and follow privacy policies just like websites and other commercial online services according to California Attorney General Kamala Harris. On October 30, the Attorney General’s office began sending warning letters to app developers notifying them that they had 30 days to comply. Time is now up. And the consequences are potentially substantial with the law carrying fines of up to $2,500 per download.

Continue Reading...

New York AG Addresses Cause Marketing on Social Media

By Rachel Tarko Hudson

The New York Attorney General’s Charities Bureau recently released “Five Best Practices for Transparent Cause Marketing” which contains general best practices for cause marketing campaigns, including campaigns conducted on social media.  Cause marketing, also known as commercial coventures, is the practice by a for-profit company of donating a portion of the purchase price of an item or service to a charity.  Cause marketing is becoming increasingly popular among companies looking to do good as well as to generate positive publicity for their brand.  Many states regulate cause marketing, however, New York’s Best Practices indicate that greater attention may begin to be focused on campaigns conducted using social media and other newer online platforms for giving.

Continue Reading...

FTC Proposes Updates to Children's Online Privacy Law

The Federal Trade Commission recently proposed several updates to the Children's Online Privacy Protection Act of 1998 (COPPA).

COPPA currently provides that operators of websites and other online services that collect personal information online about children under 13, or whose websites or services are directed at children under 13, must:

Continue Reading...

He "Likes" Me, He "Likes" Me Not - Facebook's Sponsored Stories Lawsuit, Fraley v. Facebook, Changes Landscape Of Privacy Litigation; Kids Threaten Proposed Class Settlement

By Elizabeth Berman

Facebook, Inc. was sued in a class action last year over one of its advertising practices called “Sponsored Stories,” which typically consist of a Facebook Friend’s name, profile picture, and an assertion that the person (your Facebook Friend) “likes” an advertiser, coupled with the advertiser’s logo, featured on your Facebook page or News Feed. The idea is that the target of the advertisement (i.e., you) will be more influenced by the company’s advertisement because someone in your network (i.e., your Friend) “likes” that company. The disconnect is that “liking” a page on Facebook does not necessarily mean the user likes that company in the normal sense of the word. For example, one could “like” a page in order to get some promotional benefit from the company or learn more information about the company or its product.

Continue Reading...

Federal Government Targets Privacy Violations by Social Media Companies

By Neil Ray

Continuing its focus on privacy issues, the Federal Trade Commission (FTC) reached a settlement earlier this month with social networking service, Myspace, over charges that it misrepresented its protection of users' personal information. The FTC alleged that Myspace allowed advertisers to access personally identifiable information despite previous assurances to its users that it would keep such information private. The settlement requires Myspace to implement a comprehensive privacy program, and calls for regular, independent privacy assessments for the next 20 years.

Continue Reading...