How Will Privacy Regulation Impact    Your Business In 2012?        Daniel T. Rockey, Esq., CIPP        Holme, Roberts & O...
Legal DisclaimerThis presentation is intended for general informational purposes only and shouldnot be construed as legal ...
How Will Privacy Regulation Impact     Your Business In 2012?I.   Brief History of US Privacy LawII.  A Flurry of Proposed...
The Right to Privacy: US•       No Right of Privacy in US Constitution•       Nevertheless, a right has been implied from ...
The Right to Privacy: US• Historically, right to privacy = right to be free from  intrusion in one’s home   – Rowan v. Uni...
Congress Begins to Recognize Right of       Privacy in Information• Fair Credit Reporting Act of 1970 (granted limited rig...
Targeted Approach: Health and Financial                 Data• HIPAA (1996) (requires express consent to share  health data...
Regulation of Online Data Collection• Children’s Online Privacy Protection Act  of 1998 (COPPA)  – Marks new era of privac...
Following COPPA, Period of Legislative    Inactivity, Emphasis On Self-Regulation• Tremendous technological growth, legisl...
EU Adopts Comprehensive Privacy              Scheme• EU jumps in head first  – EU Data Protection Directive (95/46/EC)  – ...
2008 – 2010: Begins bi-partisan push        toward privacy legislation• High profile privacy snafus (e.g. Facebook,  Raple...
Meanwhile, Legislative Inactivity Leads to     Aggressive Enforcement by FTC• High profile FTC enforcement  actions  –   C...
Meanwhile, Legislative Inactivity Leads to     Aggressive Enforcement by FTC• FTC Saber-Rattling (Leibowitz)  – 2007: "The...
Federal Inactivity Also Leads to Patchwork of           State Data Security Laws• Dozens of states enact data breach  legi...
2011: Year of Federal Privacy Legislation?•    Building Effective Strategies To Promote Responsibility Accountability Choi...
2011: Year of Data Privacy Legislation?•   Electronic Communications Privacy Act Amendments Act of 2011 (S. 1011) Leahy   ...
2011: Year of Data Privacy                Legislation?•   Nineteen Bills introduced•   Partisan gridlock over budget•   Ze...
What’s a Marketer to Do?
2011: Year of Data Privacy              Legislation?• Continued uncertainty• But some trends are clear
Legislation to Watch: Data Privacy• Consumer Privacy Protection Act of 2011  (H.R. 1528) Stearns (R-FL) Matheson (D-UT)  –...
Legislation to Watch: Data Privacy• Commercial Privacy Bill of Rights Act of 2011 (S.  799) John Kerry (D-MA) and John McC...
Legislation to Watch: Data Breach• Personal Data Privacy and Security Act of 2011  (S.1151) Leahy (D-VT), Franken (D-Minn....
Legislation to Watch: Data Breach• Data Breach Notification Act of 2011 (S.  1408) Feinstein (D-CA)  – Narrow focus on dat...
Legislation to Watch: Do Not Track• The Do Not Track Me Online Act of 2011  (H.R. 654) Speier  – Requires FTC to create Do...
Legislation to Watch: Geolocation• Geolocation Privacy and Surveillance ("GPS") Act  (S. 1212) and (H.R.2168) Wyden (D-OR)...
Legislation to Watch in 2012• Do Not Track Kids Act of 2011 (H.R. 1895) Markey  (D-MA) Barton (R-TX)  – Expressly extends ...
Legislation to Watch: VPPA• Amendment to Video Privacy Protection Act  (HR 2471) Goodlatte  – Netflix/Facebook exemption f...
What to expect in 2012: Supercookies• Chairs of Bi-Partisan House Privacy Caucus request  FTC investigation into “supercoo...
What to expect in 2012: COPPA Rules• FTC announces proposed revisions to COPPA  Rules (9/15/2011)  – Definitions  – Notice...
What to expect in 2012: Revision to              COPPA Rules• Definitions  – Expands definition of “personal information” ...
What to expect in 2012: Revision to             COPPA Rules• Notice  – Streamlines notice content requirement (moves away ...
What to expect in 2012: Revision to             COPPA Rules• Parental Consent  – Proposes eliminating the “email plus” met...
What to expect in 2012: Revision to             COPPA Rules• Confidentiality and security of  children’s personal informat...
What to expect in 2012: Revision to             COPPA Rules• Safe harbor programs  – Additional detail required for safe h...
Common Threads• National data breach legislation likely• Privacy legislation less likely but possible  – Likely to be just...
FTC Enforcement Actions: Mobile• FTC announces first privacy enforcement  action involving mobile apps  – Broken Thumbs de...
FTC Enforcement Actions: Mobile• FTC alleged violations of COPPA Rule (16  C.F.R. Part 312) despite App Store TOS  – Sued ...
FTC Enforcement Actions: Mobile• Consent Judgment  –   $50,000 civil penalty  –   Deletion of all previously collected dat...
FTC Enforcement Actions: GoogleFTC v. Google, Inc.  – FTC charged that by auto enrolling in Google    Buzz, Google treated...
FTC Enforcement Actions: Text Messages• FTC v. Phil Flora (9/29/2011)  – Defendant sent thousands of unsolicited text    m...
Litigation DevelopmentsIMS Health v. Sorrell (6/23/2011):• Vermont law prohibited pharmacies from providing doctor  prescr...
IMS Health v. Sorrell: Deathknell for Do               Not Track?   Probably Not:   – Vermont law concerned commercial spe...
What to Expect in 2012: EU Cookie RulesEU to begin Enforcing 2009 Cookie Rules  – Require prior notice and consent  – Fran...
Privacy Litigation: Lots of it but little to                 show for itIn re Google Buzz User Privacy Litigation, Case No...
Privacy LitigationIn re Apple iPhone litigation (9/20/2011)  – Class alleged that Apple permitted apps developers    to co...
How to Prepare for 2012Don’t Wait and See:  – Privacy by Design     • Must analyze data inflows and use at outset of proje...
How Will Privacy Regulation Impact    Your Business In 2012?        Daniel T. Rockey, Esq., CIPP        Holme, Roberts & O...
How Will Privacy Regulation Impact    Your Business In 2012?        Daniel T. Rockey, Esq., CIPP        Holme, Roberts & O...
Upcoming SlideShare
Loading in...5
×

Presentatie dma boston 2011: Welke impact heeft us privacyregulering op uw business

1,025
-1

Published on

Published in: Technology, News & Politics
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
1,025
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Presentatie dma boston 2011: Welke impact heeft us privacyregulering op uw business

  1. 1. How Will Privacy Regulation Impact Your Business In 2012? Daniel T. Rockey, Esq., CIPP Holme, Roberts & Owen LLP San Francisco
  2. 2. Legal DisclaimerThis presentation is intended for general informational purposes only and shouldnot be construed as legal advice or legal opinion on any specific facts orcircumstances, nor is it intended to address specific legal compliance issues thatmay arise in particular circumstances. Please consult counsel concerning your ownsituation and any specific legal questions you may have.The thoughts and opinions expressed in this presentation are those of the individualpresenters and do not necessarily reflect the official or unofficial thoughts oropinions of their employers.For further information regarding this presentation, please contact the presenter(s)listed in the presentation.Unless otherwise noted, all original content in this presentation is licensed under theCreative Commons Attribution-Share Alike 3.0 United States License available at:http://creativecommons.org/licenses/by-sa/3.0/us.
  3. 3. How Will Privacy Regulation Impact Your Business In 2012?I. Brief History of US Privacy LawII. A Flurry of Proposed US Privacy LegislationIII. Legislative Vacuum = More Aggressive FTCIV. New COPPA Rules: What To ExpectV. Privacy Litigation On The RiseVI. How To Prepare: Privacy By Design
  4. 4. The Right to Privacy: US• No Right of Privacy in US Constitution• Nevertheless, a right has been implied from the 4th Amendment and general protections for life, liberty, etc. (Penumbral Theory)• “The Right to Privacy,” Harvard Law Review, Brandeis (1890) – “The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others.”• Olmstead v. United States, 277 U.S. 438, 478-9 (1928) (Brandeis, dissenting) – Defined the right of privacy as the “right to be left alone.”
  5. 5. The Right to Privacy: US• Historically, right to privacy = right to be free from intrusion in one’s home – Rowan v. United States Post Office Dep’t, 397 U.S. 728 (1970) (upholding Do Not Mail because ‘‘[t]o hold less would tend to license a form of trespass and would make hardly more sense than to say that a radio or television viewer may not twist the dial to cut off an offensive... communication... entering his home.’’) – Mainstream Mktg. Servs. v. FTC, 358 F. 3d 1228, 1238 (10th Cir. 2004) (upholding Do Not Call: “the State’s interest in protecting the well-being, tranquility, and privacy of the home is certainly of the highest order in a free and civilized society.”
  6. 6. Congress Begins to Recognize Right of Privacy in Information• Fair Credit Reporting Act of 1970 (granted limited right to access, dispute and correct credit information; limits on sharing of credit info)• Electronic Communications Privacy Act of 1986 (restricts intercepts of electronic communications, stored data)• Video Privacy Protection Act of 1988 (prohibits video service providers from disclosing rental or purchase info)• Drivers Privacy Protection Act of 1994 (prohibits DMV from sharing motor vehicle data with marketers w/o consent)
  7. 7. Targeted Approach: Health and Financial Data• HIPAA (1996) (requires express consent to share health data other than for treatment, payment or healthcare operations) (ARRA & HiTech)• Gramm-Leach-Bliley (1999) (applies to financial institutions; requires notice to share w/ affiliates; for 3rd parties, must allow opt-out)• Fair and Accurate Credit Transactions Act of 2003 (added Affiliate Marketing Rule to FCRA- requires notice and opt-out to share “eligibility information,” including “personal characteristics or mode of living”)
  8. 8. Regulation of Online Data Collection• Children’s Online Privacy Protection Act of 1998 (COPPA) – Marks new era of privacy regulation – For the first time, limits collection of online data for marketing purposes – Relatively non-controversial, but creates a slippery slope
  9. 9. Following COPPA, Period of Legislative Inactivity, Emphasis On Self-Regulation• Tremendous technological growth, legislative inactivity = marketing bad apples• Direct marketing industry creates strong self- regulatory model to stave off regulation • DMA Guidelines for Ethical Business Practice • IAB: Interactive Advertising Privacy Principles • NAI: Self-Regulatory Code of Conduct and Enforcement Procedure • Third Party Certification Programs E.g.,
  10. 10. EU Adopts Comprehensive Privacy Scheme• EU jumps in head first – EU Data Protection Directive (95/46/EC) – EU Privacy Directive (2002/58/EC) • Express recognition of right of privacy in personal data • Comprehensive, rather than piecemeal approach • But extremely burdensome restrictions on business, marketing industry – EU “Cookie Rules” (2009/136/EC) • Prior consent for cookies
  11. 11. 2008 – 2010: Begins bi-partisan push toward privacy legislation• High profile privacy snafus (e.g. Facebook, Rapleaf) lead to calls for Congressional action• Handful of bills introduced, but garner little traction (Boucher/Stearns)• Self-regulatory efforts instrumental in keeping legislation at bay• But momentum builds in 2010
  12. 12. Meanwhile, Legislative Inactivity Leads to Aggressive Enforcement by FTC• High profile FTC enforcement actions – COPPA (Sony BMG; Mrs. Fields) – Data security/data disposal (CVS; TJ Maxx) – Deceptive data collection (Sears “My SHC”) – FTC Endorsement/Blogger Rules (Ann Taylor)
  13. 13. Meanwhile, Legislative Inactivity Leads to Aggressive Enforcement by FTC• FTC Saber-Rattling (Leibowitz) – 2007: "The marketplace alone may not be able to solve all problems inherent in behavioral marketing.” – 2010: "I think opt-in generally protects consumers privacy better than opt-out, under most circumstances. . . . I dont think it undermines a companys ability to get the information it needs to advertise back to consumers.” – 2010: Report on Online Behavioral Marketing • Endorsed Do-Not-Track • Opt-in for Sensitive Data • Precise geolocation data
  14. 14. Federal Inactivity Also Leads to Patchwork of State Data Security Laws• Dozens of states enact data breach legislation• California enacts OPPA, require privacy policy for any business collecting data from Californians• Mass., Minnesota, Nevada data security laws (encryption, WISP)
  15. 15. 2011: Year of Federal Privacy Legislation?• Building Effective Strategies To Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards Act (“BEST PRACTICES” Act) (H.R. 611) Rush (D-IL) (2/10/2011)• The Do Not Track Me Online Act of 2011 (H.R. 654) Speier (D-CA) (2/11/2011)• The Financial Information Privacy Act of 2011 (H.R. 653) Speier (D-CA) (2/11/2011)• Commercial Privacy Bill of Rights Act of 2011 (S. 799) John Kerry (D-MA) and John McCain (R-AZ) (4/12/2011)• Consumer Privacy Protection Act of 2011 (H.R. 1528) Stearns (R-FL) Matheson (D-UT) (4/13/2011)• Data Accountability and Trust Act (H.R. 1701) Bobby L. Rush (D-IL) (5/4/2011)• Do-Not-Track Online Act of 2011 (S. 913) Rockefeller (D-WV) (5/9/2011)• Data Accountability and Trust Act of 2011 (H.R. 1841) Stearns (R-FL) and (5/11/2011)• Do Not Track Kids Act of 2011 (H.R. 1895) Markey (D-MA) Barton (R-TX) (5/13/2011)
  16. 16. 2011: Year of Data Privacy Legislation?• Electronic Communications Privacy Act Amendments Act of 2011 (S. 1011) Leahy (D-VT) (5/17/2011)• Personal Data Privacy and Security Act of 2011 (S.1151) Leahy (D-VT), Franken (D-Minn.) and Schumer (D-N.Y.) (5/17/2011)• Geolocation Privacy and Surveillance ("GPS") Act (S. 1212) and (H.R.2168) Wyden (D-OR) and Chaffetz (R-Utah) (6/15/2011)• Data Security and Breach Notification Act (S. 1207) Pryor (D-AR) and Rockefeller (D-WV) (6/15/2011)• Location Privacy Protection Act of 2011 (S. 1223) Franken (D-MN) and Blumenthal (D-CT) (6/16/2011)• Secure and Fortify (SAFE) Data Act (H.R. 2577) Bono Mack (R-CA) (7/8/2011)• Proposed amendment to Video Privacy Protection A ct (HR 2471) Goodlatte (7/8/2011)• Data Breach Notification Act of 2011 (S. 1408) Feinstein (D-CA) (7/22/2011)• Protecting Children From Internet Pornographers Act of 2011 (H.R. 1981) Smith (R-TX) (5/25/2011)• Personal Data Protection and Breach Accountability Act of 2011 (S.1535) Blumenthal (D-CT) (9/8/2011)
  17. 17. 2011: Year of Data Privacy Legislation?• Nineteen Bills introduced• Partisan gridlock over budget• Zero bills enacted into law• What does this mean for marketers?
  18. 18. What’s a Marketer to Do?
  19. 19. 2011: Year of Data Privacy Legislation?• Continued uncertainty• But some trends are clear
  20. 20. Legislation to Watch: Data Privacy• Consumer Privacy Protection Act of 2011 (H.R. 1528) Stearns (R-FL) Matheson (D-UT) – PII includes IP address plus traditional PII – Prior notice/opt-out required for use “unrelated to a transaction” or upon material change to policy – Allows FTC approved safe harbors – No private right of action/no state AG – Preempts state law
  21. 21. Legislation to Watch: Data Privacy• Commercial Privacy Bill of Rights Act of 2011 (S. 799) John Kerry (D-MA) and John McCain (R-AZ) – PII includes unique identifiers, biometric and precise geolocation – Notice and Opt-out/Opt-in for sensitive data/third party transfer if material change – 1st party marketing/site optimization not unauthorized use – FTC security rules – No private right of action – Federal preemption of state laws – Safe harbors
  22. 22. Legislation to Watch: Data Breach• Personal Data Privacy and Security Act of 2011 (S.1151) Leahy (D-VT), Franken (D-Minn.) and Schumer (D-N.Y.) – Data security/accuracy requirements for data brokers (PII on 10,000 persons, excludes FCRA/HIPAA/GLB regulated entities) – Breach notification w/ FTC safe harbor exemption – Preempts state law – No Private Right of Action – Scraping safe harbor (amends CFAA)
  23. 23. Legislation to Watch: Data Breach• Data Breach Notification Act of 2011 (S. 1408) Feinstein (D-CA) – Narrow focus on data breach notification – Safe harbor exemption from notification requirement if company conducts risk assessment and is able to demonstrate to the Federal Trade Commission that there is no significant risk of harm to individuals affected by a security breach – No private right of action
  24. 24. Legislation to Watch: Do Not Track• The Do Not Track Me Online Act of 2011 (H.R. 654) Speier – Requires FTC to create Do Not Track rules – Includes IP address and persistent identifiers – Doesn’t preempt tougher state laws• Do-Not-Track Online Act of 2011 (S. 913) Rockefeller – Requires FTC to create Do Not Track – Leaves to FTC to determine covered info – No state law preemption
  25. 25. Legislation to Watch: Geolocation• Geolocation Privacy and Surveillance ("GPS") Act (S. 1212) and (H.R.2168) Wyden (D-OR) and Chaffetz (R-Utah) – Prohibits interception of geolocation info without prior consent (parental exception) – Creates private right of action for damages/profits• Location Privacy Protection Act of 2011 (S. 1223) Franken (D-MN) and Blumenthal (D-CT) – Prohibits collection of geolocation info w/o express affirmative consent – Private right of action for damages/punitives
  26. 26. Legislation to Watch in 2012• Do Not Track Kids Act of 2011 (H.R. 1895) Markey (D-MA) Barton (R-TX) – Expressly extends COPPA to mobile applications – Prohibits site, mobile app from “using, disclosing or compiling” data on children or minors (13 to 17 yrs) for targeted marketing purposes or geolocation w/o express affirmative consent – No collection of any data from minors without adopting Digital Marketing Bill of Rights for Teens • Fair Information Practices Principles established by this Act; • “balances the ability of minors to participate in the digital media culture with the governmental and industry obligation to ensure that such operators do not subject minors to unfair and deceptive surveillance, data collection, or behavioral profiling.”
  27. 27. Legislation to Watch: VPPA• Amendment to Video Privacy Protection Act (HR 2471) Goodlatte – Netflix/Facebook exemption from VPPA – Authorizes one-time durable consent to share data re videos
  28. 28. What to expect in 2012: Supercookies• Chairs of Bi-Partisan House Privacy Caucus request FTC investigation into “supercookies” (9/27/2011) – Barton (R-TX) and Markey (D-Mass) call for investigation, say violates § 5 of FTC Act – Barton: “I think supercookies should be outlawed because their existence eats away at consumer choice and privacy.”
  29. 29. What to expect in 2012: COPPA Rules• FTC announces proposed revisions to COPPA Rules (9/15/2011) – Definitions – Notice – Parental consent – Confidentiality and Security of Children’s Personal Information – Safe Harbor Programs• Data minimization requirement
  30. 30. What to expect in 2012: Revision to COPPA Rules• Definitions – Expands definition of “personal information” to include: • IP addresses • customer numbers held in cookies, and • geolocation information.
  31. 31. What to expect in 2012: Revision to COPPA Rules• Notice – Streamlines notice content requirement (moves away from more disclosure is better mantra) • 3 defined categories of information – Requires all operators of an online service or website to provide contact information • Ad networks • Analytics providers • Other content providers
  32. 32. What to expect in 2012: Revision to COPPA Rules• Parental Consent – Proposes eliminating the “email plus” method of obtaining parental consent. – Website operators could seek FTC approval of alternate consent mechanisms. – Goal: allow for new forms of consent as the technology evolves, and encourage innovation in obtaining verifiable consent (e.g. text message; scanned parental signature, credit card)
  33. 33. What to expect in 2012: Revision to COPPA Rules• Confidentiality and security of children’s personal information – Must ensure that service providers/third parties have reasonable procedures to maintain the confidentiality, security and integrity of such personal information.
  34. 34. What to expect in 2012: Revision to COPPA Rules• Safe harbor programs – Additional detail required for safe harbors – Would require approved safe harbor programs to report on oversight of operators – Annual audits of members
  35. 35. Common Threads• National data breach legislation likely• Privacy legislation less likely but possible – Likely to be just-in-time notice and opt-out – Opt-in/express affirmative consent for sensitive data – Likely self-regulatory safe harbors – May prohibit supercookies (flash cookies, HTML5) – Likely to adopt simplified disclosure regime – Unlikely to adopt Do Not Track
  36. 36. FTC Enforcement Actions: Mobile• FTC announces first privacy enforcement action involving mobile apps – Broken Thumbs developed iPhone apps targeted to “younger girls,” “nostalgic adults” (Emily’s Girls World, Emily’s Dress Up) – Apps encouraged girls to email “Emily” their comments, submit “shout outs” to friends and family, ask Emil’s advice, and share “embarrassing” “blush” stories – Allowed children to publicly post information on message boards – BT also collected thousands of email addresses from children
  37. 37. FTC Enforcement Actions: Mobile• FTC alleged violations of COPPA Rule (16 C.F.R. Part 312) despite App Store TOS – Sued both BT and President/56% owner – Failed to provide notice in app as to what info they collect, how they use it, disclosure practices – Failed to provide required “direct notice” to parents – Failed to obtain “verifiable parental consent” before collecting persona information from children
  38. 38. FTC Enforcement Actions: Mobile• Consent Judgment – $50,000 civil penalty – Deletion of all previously collected data – Injunction against further violations – Compliance reporting, record-keeping requirements
  39. 39. FTC Enforcement Actions: GoogleFTC v. Google, Inc. – FTC charged that by auto enrolling in Google Buzz, Google treated data inconsistently with prior promises, privacy policy – Also, failed to comply with EU safe harbor – Consent judgment: • Compliance program • Self-audits and reporting (20 years)
  40. 40. FTC Enforcement Actions: Text Messages• FTC v. Phil Flora (9/29/2011) – Defendant sent thousands of unsolicited text messages – FTC did not bring under TCPA (not using “automatic telephone dialing system?) – Instead, alleged that SMS messages are subject to CAN-SPAM – Consent judgment
  41. 41. Litigation DevelopmentsIMS Health v. Sorrell (6/23/2011):• Vermont law prohibited pharmacies from providing doctor prescribing data to pharmceutical companies for detailing• SCT held law unconstitutional• Law was a content-based and speaker-based restraint on free speech, requiring “heightened” constitutional scrutiny
  42. 42. IMS Health v. Sorrell: Deathknell for Do Not Track? Probably Not: – Vermont law concerned commercial speech (not patient privacy) – Permitted data sharing for purposes other than marketing (sought to limit disfavored opinions) – Speculative benefit• Do Not Track seeks to regulate personal privacy• Arguably content/opinion neutral• Precedent: COPPA, HIPAA, FCRA
  43. 43. What to Expect in 2012: EU Cookie RulesEU to begin Enforcing 2009 Cookie Rules – Require prior notice and consent – France: browser settings not enough. Consent without reference to specific use ineffective• Browser finger printing?
  44. 44. Privacy Litigation: Lots of it but little to show for itIn re Google Buzz User Privacy Litigation, Case No. 5:10-CV-00672-JW (N.D. Cal.) (Sept. 03, 2010) – Google sets aside $8.5 million for privacy organizations – Google makes changes "to the Google Buzz user interface that clarify Google Buzzs operation and users options regarding Google Buzz" – Google agrees to disseminate "wider public education about the privacy aspects of Google Buzz."
  45. 45. Privacy LitigationIn re Apple iPhone litigation (9/20/2011) – Class alleged that Apple permitted apps developers to collect/disseiminate for marketing purposes data from users without notice/consent – Judge Koh held that class had not alleged injury- in-fact; i.e. actual damages (Article III standing)
  46. 46. How to Prepare for 2012Don’t Wait and See: – Privacy by Design • Must analyze data inflows and use at outset of project • Secure personal data (encryption for mobile devices and in transmission – Say what you do and do what you say – Participate in safe harbor – Stay tuned
  47. 47. How Will Privacy Regulation Impact Your Business In 2012? Daniel T. Rockey, Esq., CIPP Holme, Roberts & Owen LLP San Francisco
  48. 48. How Will Privacy Regulation Impact Your Business In 2012? Daniel T. Rockey, Esq., CIPP Holme, Roberts & Owen LLP San Francisco

×