Maximizing & Exploiting Big Data in Digital Media....Legally

Hot Topics in Privacy and Date Security Law1
MediaPost’s Programmatic Insider Summit
MAXIMIZING & EXPLOITING BIG DATA
IN DIGITAL MEDIA....LEGALLY
February 22, 2016
Gary A. Kibel
Davis & Gilbert LLP
Partner
Digital Media, Technology & Privacy
212.468.4918
gkibel@dglaw.com
@GaryKibel_law
© 2016 Davis & Gilbert LLP

WHAT IS PROGRAMMATIC LAW?
»Contracts
+
»Self-Regulatory Principles
+
»FTC Guidance / Enforcement Actions / Initiatives
+
»Old/New Legislation
2 Maximizing & Exploiting Big Data in Digital Media....Legally

LEGAL ISSUES – DATA
3
Traditional Programmatic
IO Details
Performance Data
Site Data
User Volunteered Data
Collected Data
Bid Data (requests/responses)
Losing Bid Data
Platform Data
3rd party DMP Data
Performance Data
Site Data
Maximizing & Exploiting Big Data in Digital Media....Legally

LEGAL ISSUES – DATA
»Other data issues
- Tagging
• First party/third party tags
• Functionality
• Disclosures
- Targeting
• Individual profiles vs. segments
• Look-a-like modeling
• Deterministic and probabilistic modeling

WHAT’S NEXT FOR
PASSIVE TRACKING?
»Device fingerprinting
»Other persistent identifiers (UDID / IDFA / Android ID)
»Location-based services
»Cross-device tracking
»FTC’s concern about transparency and consumer control
»“But we are so beyond cookies at this point, and online
tracking is only becoming more invisible as technology
advances in the marketing world.” (Jessica Rich, Director,
FTC Bureau of Consumer Protection, January 2015)

LEGAL ISSUES – $$$
»Fraud / Viewability
- Intentional vs. unintentional
- 1st party vs. 3rd party monitoring
- Timing for disputes
- Payment terms
»Transparency
- Media costs
- Service fees
- Reporting
- Inventory
»Audit rights - financial; data; security

SELF REGULATORY COMPLIANCE
»Digital Advertising Alliance
- Self-Regulatory Principles for Online Behavioral
Advertising
- Self-Regulatory Principles for Multi-Site Data
- Application of Self-Regulatory Principles to the Mobile
Environment (Sept. 1, 2015)
»Network Advertising Initiative
- NAI Code of Conduct
- Guidance on the Use of Non-Cookie Technologies for
Interest-Based Advertising
»More: eDAA, Digital Advertising Alliance of Canada

CONTRACT STRUCTURE
»Platform Agreements
»IOs
»AAAA/IAB Standard Terms and Conditions
»Riders / Addenda
»Click-through terms

DEFINITIONS – WIKIPEDIA
»Big data is a blanket term for any collection of data
sets so large and complex that it becomes difficult to
process using on-hand database management tools
or traditional data processing applications
»An information broker (independent information
professional, information consultant) collects and
sells information. Uses include targeted ads, market
research, consumer scoring, patent searches, and
election campaigns. The industry has been criticized
for being unregulated and opaque

WHAT IS PERSONAL INFORMATION?
»U.S. definition – ?
- COPPA – “personal information”
- HIPAA – “protected health information”
- GLB – “nonpublic personal information”
- State security breach notification laws

WHAT IS PERSONAL INFORMATION?
»E.U. definition – Any information relating to an
identified or identifiable natural person (data
subject); an identifiable person is one who can be
identified, directly or indirectly, in particular by
reference to an identification number or to one or
more factors specific to his physical, physiological,
mental, economic, cultural or social identity
(E.U. Data Protection Directive 95/46/EC)
»Canadian definition – “personal information”
means information about an identifiable individual

EXPANDING SCOPE OF
PERSONAL INFORMATION
»FTC Consent orders – “Persistent identifiers”
»COPPA Amendments 2013 – Definition of personal
information expanded to include any “persistent
identifier that can be used to recognize a user over
time and across different websites or online services”
- Carve out for “support for internal operations”
Certain internal activities would not be considered
a collection of PI, as long as the information
collected is not used or disclosed to contact a
specific individual (e.g., site maintenance and
analysis)

»In re: Hulu Privacy Litigation, Case No: 11-03764 (N.D. Cal. 2012)
- Video Privacy Protection Act (VPPA)
• “Personally identifiable information” includes information which
identifies a person as having requested or obtained specific video
materials or services from a video tape service provider
• A video tape service provider who knowingly discloses, to any
person, personally identifiable information concerning any
consumer of such provider shall be liable to the aggrieved person
- Data transmitted by clicking the Facebook ‘LIKE’ button could be
deemed to be “Personally Identifiable Information,” which means
such information identifies a person as having requested or obtained
specific video materials from a Video Tape Service Provider.
14
EXPANDING SCOPE OF PERSONAL INFORMATION

DATA MATCHING
»Exploiting CRM databases
»PII vs. Non-PII
»Matching (i.e., Facebook Custom Audience)
- Privacy Policy conflicts

REPORTS, REPORTS
AND
MORE REPORTS …

FTC CHAIRWOMAN EDITH RAMIREZ
»August 2013 – “To me, the FTC is like the lifeguard
on a beach. Like a vigilant lifeguard, the FTC’s job is
not to spoil anyone’s fun but to make sure that no one
gets hurt. With big data, the FTC’s job is to get out of
the way of innovation while making sure that
consumer privacy is respected”
»June 2015 – “[D]espite the potential for big data’s
positive impact on the lives of consumers, there is a
real risk of lack of transparency and loss of consumer
control … Consumers would likely be surprised to
know the myriad of ways in which data is collected
about them.”

FTC STATEMENT TO CONGRESS
(DECEMBER 2013)
18
»FTC Prepared Statement – “What information do
data brokers have on consumers, and how do
they use it”
- Lack of transparency
- No reasonable access to / control of data

»New breach notification law
»Consumer Bill of Rights
»Amend ECPA
»Discriminatory outcomes of big data analytics – ‘digital
redlining’
»“The big data revolution presents incredible opportunities
in virtually every sector of the economy and every corner
of society”

FTC – DATA BROKERS:
A CALL FOR TRANSPARENCY AND
ACCOUNTABILITY (MAY 2014)
»Data Brokers = Companies that collect consumers’
personal information and resell or share that information
with others
»They operate with a “fundamental lack of transparency”
»Consumers are “largely unaware that data brokers are
collecting and using this information”
»It is “virtually impossible” for a consumer to determine how
a data broker obtained his or her data
»Consumer choices/control are “invisible” and “incomplete”
»Call for legislation
»Access; opt-outs; disclosures of sources

FTC – BIG DATA:
A TOOL FOR INCLUSION
OR EXCLUSION? (JANUARY 2016)
»No single law applies.
- FTC Act
- Fair Credit Reporting Act (FCRA)
- Equal opportunity laws
»Commissioner Ohlhausen – “If we give undue credence
to hypothetical harms, we risk distracting ourselves
from genuine harms and discouraging the development
of the very tools that promise new benefits to low
income, disadvantaged, and vulnerable individuals.”

FEDERAL TRADE
COMMISSION INITIATIVES
AND
ENFORCEMENT ACTS

FEDERAL TRADE COMMISSION ACT §5
»“Unfair methods of competition in or affecting
commerce, and unfair or deceptive acts or practices
in or affecting commerce, are hereby declared
unlawful”
- Deception = Misrepresentations or omissions
likely to mislead consumers acting reasonably
under the circumstances
- Unfairness = Causes or is likely to cause
substantial consumer injury, not reasonably
avoided by the consumer, and not outweighed by
countervailing benefits to consumers or competition

FTC – IN THE MATTER OF
SCANSCOUT, INC. (DECEMBER 2011)
»Video ad network
»ScanScout privacy policy – “You can opt out of
receiving a cookie by changing your browser
settings to prevent the receipt of cookies.”
»However, changing browser settings did not
remove or block the Flash cookies used by
ScanScout
»Deception claim

FTC – IN THE MATTER OF EPIC
MARKETPLACE, INC., AND EPIC MEDIA
GROUP, LLC (DECEMBER 2012)
»Ad network
»Epic employed “history-sniffing” technology to collect
data about sites outside its network that consumers
had visited. Epic’s privacy policy claimed it would only
collect information about consumers’ visits to sites in
its network
»FTC – “Consumers searching the Internet shouldn’t
have to worry about whether someone is going to go
sniffing through the sensitive, personal details of their
browsing history without their knowledge. This type of
unscrupulous behavior undermines consumers’
confidence, and we won’t tolerate it.”

FTC V. GMR TRANSCRIPTION
SERVICES (JANUARY 2014)
»50th data security consent order
»Independent medical transcription contractors
»Independent contractors transmitted medical files
in clear readable text
»“The lawsuit also alleges that GMR didn’t monitor
what [its subcontractor] was doing to protect the
highly sensitive information in its possession.
Taken together, the FTC says that GMR’s course
of conduct violated Section 5”
»Vendor liability

FTC – IN THE MATTER OF NOMI
TECHNOLOGIES, INC. (APRIL 2015)
»In-store beacon technology
»Nomi Privacy Policy – “Nomi pledges to ... Always
allow consumers to opt out of Nomi’s service on its
website as well as at any retailer using Nomi’s
technology.”
»FTC – “It’s vital that companies keep their privacy
promises to consumers when working with
emerging technologies, just as it is in any other
context. If you tell a consumer that they will have
choices about their privacy, you should make sure
all of those choices are actually available to them”

PRIVACY POLICIES – FTC MERGER
REVIEW (MARCH 25, 2015)
» FTC Merger Review – “The Commission recognizes that to
innovate and keep pace in today’s economy, businesses may
acquire other companies or sell business units. However,
companies must still live up to their privacy promises. One
company’s purchase of another doesn’t nullify the
privacy promises made when the data was first
collected. When a purchase or acquisition does occur,
companies have two choices. They can simply abide by their
promises – that is, handle the data as promised when they
collected it from consumers. Or, if they want to materially
change how they collect, use, or share consumers data, they
must get permission from the consumers to whom they made
the original promise. ” (FTC – March 25, 2015)

CalOPPA – CALIFORNIA AB 370
(SEPTEMBER 2013)
»Amendment to California Online Privacy
Protection Act (CalOPPA)
»Three new privacy policy disclosure requirements
(Seven total)
»Disclose how a publisher responds to a “DNT”
signal or similar mechanism if that publisher
engages in online behavioral advertising
»Cure period
»Effective January 1, 2014

CALIFORNIA SB 1348 (FEBRUARY 2014)
»Introduced February 21, 2014
»Requires online data brokers to notify consumers
when the broker transfers their personal information
to a third party and to provide a description of the
content of the information and the identity of the
purchaser
»Died in committee

ILLINOIS (IL S.B. 1833)
»A bill to amend the Personal Information Protection
Act
»Adding under the definition of “Personal
Information” categories for “consumer marketing
information,” meaning information related to a
consumer’s online browsing, purchase or search
history, geolocation information, and more.
»Passed both houses – May 31, 2015
- (vetoed by Governor – August, 2015)

LEGISLATIVE – “DO NOT
TRACK ONLINE ACT OF 2015”
33
»Proposed by Senators Markey & Blumenthal
»Allow individuals to simply and easily indicate
preference not to have online activities tracked or
personal information collected by online providers
(limited exceptions)
»Allow FTC to pursue civil penalties if consumer
requests not honored

LEGISLATIVE – “APPS Act”
34
»H.R. 4715, the Application Privacy, Protection and
Security, or APPS, Act
»Consent based data collection
»Rep. Hank Johnson (D-GA): “Privacy is an issue that
should unite us, not drive us apart…We have fully
entered the era of big data, and consumers access
the Internet through mobile devices now more than
ever. It’s past time for our laws to reflect this reality
through common-sense rules for data collection,
transparency and use.”

35 From Arenas to Zooey: Recent Attempts to Expand Right
of Publicity Claims
35 The Basics of Advertising & Marketing Law35
QUESTIONS?
Gary A. Kibel
Davis & Gilbert LLP
Partner
Digital Media, Technology & Privacy
212.468.4918
gkibel@dglaw.com
@GaryKibel_law

Maximizing & Exploiting Big Data in Digital Media....Legally

More Related Content

What's hot

Similar to Maximizing & Exploiting Big Data in Digital Media....Legally

More from MediaPost

Recently uploaded

Maximizing & Exploiting Big Data in Digital Media....Legally