Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

We know trademarks. With a team of more than 25 lawyers, including Professor J. Thomas McCarthy, world-renowned author of the well-respected McCarthy on Trademarks and Unfair Competition, we are a one-stop practice for guarding valuable business assets.

Trademark

Band 1: Intellectual Property: Trademark, Copyright & Trade Secrets, California

Firm to Watch: Intellectual Property; Trade Marks, Copyright And Design

Firm to Watch: Intellectual Property: Trademarks: Non-Contentious

Silver: Firms: Enforcement and Litigation, California 

Bronze: Firms: Prosecution and Strategy, California

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Our M&A lawyers represent Fortune 500 companies, private equity firms, investment banks, and privately-held companies in their most high-profile and complex mergers and acquisitions.

Mergers + Acquisitions

M&A Lawyers & Capabilities

Ranked for M&A: Foreign Firms in Singapore

Ranked for Global Corporate/M&A 

Ranked in the “Elite” Category of Corporate/M&A – Nationwide

Ranked for Corporate/M&A – Northern California

Ranked Band 1 for California Corporate/M&A: Deals in Asia

Ranked in the “Highly Regarded” Category of New York Corporate/M&A

Ranked in the “Elite” Category of Corporate/M&A: International

Ranked Band 1 for Corporate/M&A in Japan

Ranked for Corporate/M&A: International in Singapore

Ranked for Corporate/M&A: Hong Kong-based (International Firms)

Ranked for Corporate/M&A: Mid-Market in Germany

Awarded Deal of the Year for Imerys Joint Venture with British Lithium

Two MoFo Japan Deals Shortlisted for M&A Deal of the Year (Premium)

Two MoFo China Deals Shortlisted M&A Deal of the Year (Premium and Midsize)

Five MoFo Lawyers Named to M&A Powerlist

Named a Leading Firm for M&A

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: Statehouse v. Smartphone

Federal Court Enjoins California Teen Privacy Law . . . Again

All Your Sale Are Belong to Us - Mitigating IP and Payments Risk in In-Game Economies (Part II – User-Generated Content and In-Game Payment Models)

A New California Digital Content Law Establishes New Requirements for Advertisers and Vendors

California’s Assembly Bill 587 Loses Key Provisions After Legal Challenge from X

LinkedIN

Earlier this year, the French consumer association UFC-Que Choisir initiated proceedings before the Paris District Court against Google Inc., Facebook Inc. and Twitter Inc., accusing these companies of using confusing and unlawful online privacy policies and terms of use agreements in the French versions of their social media platforms; in particular, the consumer association argued that these online policies and agreements provide the companies with too much leeway to collect and share user data.In a <a href="http://www.quechoisir.org/telecom-multimedia/internet/communique-donnees-personnelles-l-ufc-que-choisir-attaque-les-reseaux-sociaux-et-appelle-les-consommateurs-a-garder-la-main-sur-leurs-donnees">press release</a> published (in French) on its website, UFC-Que Choisir explains that the three Internet companies ignored <a href="http://www.quechoisir.org/telecom-multimedia/internet/communique-l-ufc-que-choisir-met-en-demeure-les-reseaux-sociaux-les-internautes-doivent-garder-la-main-sur-leurs-donnees">a letter</a> that the group had delivered to them in June 2013, containing recommendations on how to modify their online policies and agreements. The group sought to press the companies to modify their practices as part of a consumer campaign entitled “Je garde la main sur mes données” (or, in English, “I keep my hand on my data”).According to the press release, the companies’ refusal to address UFC-Que Choisir’s concerns prompted it to initiate court proceedings. The group has requested that the court suppress or modify a “myriad of contentious clauses,” and alleged that one company had included 180 such “contentious clauses” in its user agreement.The group has also invited French consumers to sign a petition calling for rapid adoption of the EU Data Protection Reform that will replace the current Directive on data protection with <a href="http://europa.eu/rapid/press-release_MEMO-14-186_en.htm">a Regulation</a> with direct effects on the 28 EU Member States. UFC-Que Choisir published two possibly NSFW videos depicting <a href="https://www.youtube.com/watch?v=KniuCvBssD4">a man</a> and <a href="https://www.youtube.com/watch?v=99Q-RIgvpBE">a woman</a> being stripped bare while posting to their Google Plus, Facebook and Twitter accounts. A message associated with each video states: “Sur les réseaux sociaux, vous êtes vite à poil” (or, in English, “On social networks, you will be quickly stripped bare”).The campaign is obviously aimed at catching the attention of the French public, and its timing is not coincidental. In April 2013, the French data protection authority (DPA) started coordinating a joint action among France, Germany, Italy, the Netherlands, Spain and the United Kingdom to investigate and launch penalty proceedings against Google’s new privacy policy. That policy, issued in March 2012, permitted the company to merge data from different Google services and to use that data across different platforms. So far, the French, <a href="http://www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2013/notas_prensa/common/diciembre/131219_NP_AEPD_POL_PRIV_GOOGLE.pdf">Spanish</a> and <a href="http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/3033237">Italian </a>DPAs have issued record fines and the Dutch DPA has condemned the policy.The DPAs observed that any processing of personal information is covered by the national laws of the country where the user resides; this assertion was contested by Google. The DPAs found that Google does not sufficiently inform its users of the conditions under which their personal information is processed, or of the purposes for the processing; as a consequence, users are not able to correctly exercise their rights of access, correction or deletion. Further, the DPAs held that Google doesn’t comply with the obligation to obtain user consent prior to the storage of cookies on their terminal devices, and that it fails to define retention periods applicable to the different data sets it processes, as required under applicable national laws.UFC-Que Choisir also alleges that the three Internet companies provide insufficient information regarding their practices to users. For example, the group argues that the contractual terms displayed on the three companies’ web pages are “inaccessible, unreadable, and full of hyperlinks—between 40 and 100 hyperlinks—sometimes sending back to pages in English.” The group argues in its press release that this allows for the “widespread collection, modification, retention and exploitation of data related to users and their contacts.” The group contrasts Twitter and Facebook policies, which are allegedly “very long and fragmented,” with the Google Plus policy and its “laconic wording.”  The group wants the companies to shorten their contractual terms and notify users when they change their conditions, in order to obtain new and valid consent. According to the group, the three companies afford a “worldwide, unlimited and unremunerated license” to share information with their commercial partners without obtaining valid consent. The group warns consumers: “In short, you are not only being targeted with advertising, but your data may also be commercially exploited without your express consent and without receiving compensation.” UFC-Que Choisir released to the press some examples of allegedly unfair clauses that are currently accessible online.Consumer associations everywhere in Europe want to gain influence over data protection issues. In November 2013, the Berlin District Court upheld similar arguments by the German Federation of Consumer Organisations (VZBV) in proceedings against Google. Germany is expected to pass a bill in the near future that will allow consumer associations to initiate summary proceedings to defend individual rights against infringement of data protection laws. So far, they can only rely on the German Unfair Competition Act where data protection breaches create an economic disadvantage.Consumer associations also think their role will be strengthened by rapid adoption of the EU reform. In its petition (in French), UFC-Que Choisir states that consumers’ control over their own personal information will be put in place as a general principle under the new Regulation. In the provision adopted on March 12, 2014, Parliament increased the fines for companies that violate privacy rules up to EUR 100 million (approximately USD 138 million) or 5 percent of their annual worldwide turnover. Further, the provision reinforces the application of national laws to activities of global companies operating from the U.S. More specifically, the bill clarifies that not only data controllers established outside the EU but also data processors established outside of the EU are subject to EU laws whenever they offer goods or services, regardless of whether payment is required.However, it is questionable whether these developments will be upheld by the Council, as many Member States have stated that they want to remove administrative burdens from companies. While Parliament has expressed the need to rapidly adopt reforms, the Council has not yet started official negotiations to reach a common position. The likelihood of having the proposed Reform adopted by the end of the year is uncertain.As for the case at hand, it may be months before the judge makes a ruling. Paradoxically, the UFC-Que Choisir publicly criticized the much-debated May 13 <a href="http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=req&docid=152065&occ=first&dir=&cid=257118">ruling of the European Court of Justice</a> stating that individuals may compel Google to remove links to contested information based on their right to be forgotten. The association said that publishers are responsible for the personal data on their web pages, and not Google. Neutrality goes along with transparency, free movement and freedom of expression on the Internet, all principles that the association says it wants to promote.

istock_000017310089xlarge-1024x682.jpg

French Consumer Association Takes on Internet Giants

French Consumer Association Takes on Internet Giants

Earlier this year, the French consumer association UFC-Que Choisir initiated proceedings before the Paris District Court against Google Inc., Facebook Inc. and 

The European Court of Justice (ECJ) issued a quite surprising <a href="http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=req&docid=152065&occ=first&dir=&cid=257118">decision</a> against Google which has significant implications for global companies.On May 13, 2014 the ECJ issued a ruling which did not follow the rationale or the conclusions of its Advocate General, but instead sided with the Spanish data protection authority (DPA) and found that:<ul><li>Individuals have a right to request from the search engine provider that content that was legitimately published on websites should not be searchable by name if the personal information published is inadequate, irrelevant or no longer relevant;</li><li>Google’s search function resulted in Google acting as a data controller within the meaning of the Data Protection Directive 95/46, despite the fact that Google did not control the data appearing on webpages of third party publishers;</li><li>Spanish law applied because Google Inc. processed data that was closely related to Google Spain’s selling of advertising space, even where Google Spain did not process any of the data. In doing so, it derogated from earlier decisions, arguing the services were targeted at the Spanish market, and such broad application was required for the effectiveness of the Directive.</li></ul>The ruling will have significant implications for search engines, social media operators and businesses with operations in Europe generally. While the much debated “right to be forgotten” is strengthened, the decision may open the floodgates for people living in the 28 countries in the EU to demand that Google and other search engine operators remove links from search results. The problem is that the ECJ mentions a broad range of data that may be erased. Not only should incorrect or unlawful data be erased, but also all those data which are “inadequate, irrelevant, or no longer relevant”, as well as those which are “excessive or not kept up to date” in relation to the purposes for which they were processed. It is left to the companies to decide when data falls into these categories.In that context, the ruling will likely create new costs for companies and possibly thousands of individual complaints. What is more, companies operating search engines for users in the EU will have the difficult task of assessing each complaint they process and whether the rights of the individuals prevail over the rights of the public. Internet search engines with operations in the EU will have to handle requests from individuals who want the deletion of search results that link to pages containing their personal data.That said, the scope of the ruling is limited to name searches. While search engines will have to de-activate the name search, the data can still be available in relation to other keyword searches. The ECJ did not impose new requirements relating to the content of webpages, in an effort to maintain the freedom of expression, and more particularly, press freedom. But this will still result in a great deal of information legally published to be available only to a limited audience.Below we set out the facts of the case and the most significant implications of the decision, and address its possible consequences on all companies operating search engines.FACTS OF THE CASEIn 2010, a Spanish national lodged a complaint before the Spanish DPA against the publisher of a daily newspaper with a wide audience in Spain, La Vanguardia, and against Google Spain and Google Inc. for their refusal to remove web links to the newspaper. The web pages contained the claimant’s personal details in an announcement concerning an auction of real estate connected with a procedure prompted by Social Security debts.The Spanish DPA did not require the newspaper to take down the pages, but it ordered Google Spain and Google Inc. to remove the data from their search results and to render future access to them impossible. Google appealed to the Spanish National High Court, seeking an annulment of the DPA decision.QUESTIONS REFERRED TO THE COURTThe Spanish National High Court referred the following questions to the ECJ for a preliminary ruling:<ul><li>Is Google a data controller with respect to its search engine activity?</li><li>Does the Directive apply even though Google Spain does not carry out any activity related to the search engine?</li><li>Can individuals require the erasure of their personal data by Google in a search engine, regardless of whether third- party content is legitimate?</li></ul>The ECJ is the highest court which decides on the interpretation and application of EU law. Decisions of the ECJ are legally binding on the courts in all EU countries which apply EU law. When a case is referred for a preliminary ruling, the answers of the ECJ must be applied by national courts, which then issue their own ruling on the specific facts of a case. There is no appeal following a preliminary ruling.In this specific case, the case will go back to the Spanish National High Court, which will have to decide on the specific facts while taking into account the principles highlighted by the ECJ.OPINION OF THE ADVOCATE GENERALOn June 25, 2013 the Advocate General at the ECJ Niilo Jääskinen issued an Opinion recommending that Google should not be required to remove links to legitimate third-party content based on data protection principles. In his Opinion, Jääskinen emphasized the importance of freedom of speech and the reservation of historic newspaper reports.The Advocate General agreed that sales offices in EU countries suffice to trigger the application of that country’s data protection law. In his view, the processing of personal data takes place within the context of an ‘establishment’ if that establishment is linked to a service selling targeted advertising in the Member State, even if the technical data processing operations are situated in third countries.However, the Advocate General stated that Google cannot be considered the data controller of data available on third party websites as it does not control the content of these sites. Also, he made it clear that in his opinion, there was no such thing as a general “right to be forgotten” under the current Data Protection Directive.The ECJ ultimately took a very different view. It is an uncommon occurrence that the ECJ disagrees with the opinion of an Advocate General as it has done here.GOOGLE IS A DATA CONTROLLERIn its decision, the ECJ explained that Google’s search engine activity consists of retrieving, recording and organizing personal data which it stores on its servers and, as the case may be, discloses the data to its users in the form of lists of results. In the ECJ’s view, this indexing activity is a processing of personal data, regardless of the fact that the search engine does not distinguish between personal data and other types of data.The ECJ further regarded Google as a data controller in relation to the processing of the data by the search engine. According to the ECJ, Google determines the purposes and means of data processing and its activity is “liable to significantly affect” individuals’ fundamental rights to privacy. The ECJ highlighted that the definition of a data controller in the Directive is broad.The ruling is a surprising result as this means that Google is the data controller of search results even though it cannot control the webpages from which the data are pulled. In fact, third party publishers are the data controllers when it comes to the content of the webpages. This fact however, was not relevant to the ECJ and finding may have broader implications regarding the definition of a data controller in other contexts.APPLICATION OF EU DATA PROTECTION LAW WHERE PROCESSING RELATES TO ACTIVITIES OF LOCAL SALES AGENTSThe ECJ held that the Google’s search engine is subject to EU data protection laws even if Google Spain does not carry out any activity directly linked to the indexing or storing data.In fact, the ECJ said that a broad interpretation of the territorial scope of EU laws was required to ensure the effectiveness of Art. 4.1 (a) of the Directive which states that local EU data protection law applies where “the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable.”The ECJ determined Google Spain constitutes a stable establishment of Google Inc. within the meaning of the Directive, and Google Inc.’s processing is closely related to Google Spain’s activity because it is intended to promote and sell advertising space in Spain in order to make the service offered by the engine more profitable. In doing so, the Court considered whether Spanish users were targeted for marketing and for advertising, a consideration provided in the draft EU Regulation and discussed in literature, but not currently provided in the Directive. Thus, this finding is new and quite unexpected.The ECJ ruling follows the same line as its General Advocate and a common position in the Member States with respect to the meaning of an “establishment”. It held the “establishment” in not just in terms of control over personal data, but also in the economic function of the EU subsidiaries of the foreign companies. The interpretation of the “establishment” has been continuously broadened by the EU DPAs. This may, in the end, be the finding that has the broadest implications for companies. Essentially if an EU subsidiary is intertwined with the goals and purposes of a foreign parent company and if the service is aimed at the local EU Member State market, EU law may be found to apply to the non-EU entity.RECOGNITION OF THE MUCH DEBATED “RIGHT TO BE FORGOTTEN”According to the ECJ opinion, a website operator should remove links to web pages that are published by third parties each time the inclusion of the link is or has become incompatible with the Directive. Opposing the Advocate General’s reasoning, the ECJ stated that a link is incompatible with the Directive not only when the data are false or unlawful (which is the current position in many Member States), but also when the data are inadequate, irrelevant, or no longer relevant, or where the data are excessive or not kept up to date in relation to the purposes for which they were processed. This is a significant expansion of the definition of the correction rights as currently implemented and interpreted in many Member States.The ECJ did make an exception for individuals who are public figures or where the public interest in the information would outweigh the privacy rights of the individuals.In the specific case at hand, the ECJ found that the web pages contained true information that had been lawfully published, but they stated, “having regard to the sensitivity of the information contained on the webpage, and to the fact that its initial publication had taken place 16 years earlier, the data subject establishes a right that that information should no longer be linked to his name.” Thus, the ECJ found that even where the data are lawfully published and the underlying website will not be altered, the individual still has the right to request that the “aggregator” of such information remove the data.  The ECJ, however, did not impose specific requirement as to how much time must pass for a request to be considered valid, leaving that question to search engine operators, data protection authorities and national courts to answer on a case-by-case basis.As a result, while the information was legitimately published, and may remain available off-line and on the Internet, the information should no longer be searchable via the name of the individual. That said, it would still be permissible for the search engine platform to allow the information to be searchable by date, location, or any other keyword.A NEW SOURCE OF CONTENTIONS BEFORE THE DPAsThe ECJ justified the new constraint it imposes on technology companies by the “seriousness of the interference in the private life of the individuals” that may be caused by a name search. In fact, any Internet user, when he or she searches an individual’s name, may obtain a structured overview of the information relating to that individual, the ECJ said. This information potentially concerns a vast number of aspects of an individual’s private life which, without the search engine, could not have been interconnected.What this likely means in practice is that an individual may make a request to a company to have the links based on name be removed. If the company does not agree, then the individual will have the right to go to the Data Protection Authority or the local courts to try to force the company to remove the links. This will thus create quite a bit of additional work for the DPAs and the courts.A DIFFICULT BALANCE TO STRIKE BETWEEN THE INTERESTS OF THE INDIVIDUALS AND THOSE OF THE INTERNET COMMUNITYThe ECJ ruling creates a new requirement that search engine operators and other aggregators of information must seek a fair balance between the interests of the individuals and those of the public. The ECJ stated that the following factors need to be taken into account by the search engine provider in deciding whether to make information available via name search.The balance will depend on (i) the nature of the information, (ii) the sensitivity of the information for the individual’s private life and (iii) the interests of the general public in having that information. Such interest may vary according to the role played by each individual in public life. Again, it is for the companies to assess in which case such role may justify the indexation of the data. This will likely be a costly and uncomfortable position for many companies.PRESS FREEDOM AND FREE SPEECH PRESERVED BUT POTENTIALLY LIMITEDThe ECJ affirmed that publishers of websites are still allowed to publish contested personal data for journalistic purposes. These rights do not, however, extend to search engines. Therefore, while an individual may require the erasure of his or her data by a search engine’s operator, the content of the webpage would be left unchanged.However, it is likely that the decision will affect the activity of journalists and more generally, freedom of expression. The removal of contested links will lower the number of times a webpage is visited, thus adversely affecting freedom of expression. The ECJ did not uphold the Advocate General’s opinion that the erasure of legitimate and legal information would amount to a form of “censorship” by a private party.CURRENT STATE OF PLAY AT EU LEVELThe introduction of a right to be forgotten has been proposed by the EU commission in the proposed General Data Protection Regulation. In a first reading of March 2014, the Parliament adopted a new article 6, which set out that any data which is inaccurate, incomplete or no longer up to date should not be disclosed. The proposed Regulation also sets out that the right to erase incorrect data extends to third parties. However, the Parliament did not retain the Rapporteur’s proposition for a reference to clear time limits. For the proposed Regulation to become law, the Council must agree on a common position with the Parliament. It is not certain that these developments will be upheld by the Council which has stated that it wants to remove administrative burdens from companies. While Parliament has expressed the need to adopt a reform by the end of the year, the Council has not yet formed official positions or started official negotiations to reach a common position. In view of the coming European elections and the appointment of a new Commission, solid legislative work may not restart until next year.In this context, it is still unclear whether the ECJ’s ruling at hand will be integrated in the new Regulation. What is sure is that the decision will be debated at the EU level, whereas it already has implications in the jurisdictions of the 28 Member States.IMPLICATIONSIn addition to putting data protection authorities in a rather uncomfortable position of deciding on the question of what legitimate content should be easily searchable and accessible, this decision will have wide-ranging ramifications for organizations, not just for search engine providers.First, there is a very broad interpretation of the jurisdictional reach of EU Member State law to cover organizations outside the EU whenever users in the EU are targeted.Second, search engine providers, social media and other content providers may have obligations to comply with the data protection laws even where they are not involved in making decisions about the online content provided.Third, the way in which organizations search for data will likely change due to the fact that certain information will now no longer be available by name.

European Court of Justice Strengthens Right to Be Forgotten

The European Court of Justice (ECJ) issued a quite surprising decision against Google which has significant implications for global companies. On May 13, 2014 t

European Court of Justice Strengthens Right to Be Forgotten

In a much anticipated decision in the class action In re Hulu Privacy Litigation, U.S. Magistrate Judge Laurel Beeler of the U.S. District Court for the Northern District of California has shed new light on the meaning of “personally identifiable information” (PII) under the Video Privacy Protection Act (VPPA). This has important implications for companies that host videos on their websites and integrate their services with social media companies or web analytics service providers.The court held on summary judgment that the transmission to a third party of unique user IDs, in and of themselves, along with video viewing history, does not constitute disclosure of PII under the VPPA.In reaching its conclusion, the court distinguished between anonymous IDs that Hulu, LLC provided to the audience metrics company comScore, Inc. (which the court held were not PII) and a social networking service’s user IDs that Hulu provided to the social networking service (as to which the court held there were material issues of fact with respect to whether they could permit the identification of specific persons and thus be PII).The court granted Hulu’s motion for summary judgment with respect to the comScore disclosures but not with respect to the social networking service disclosures.KEY POINTSThe court’s decision shows that, when determining whether unique IDs associated with consumers’ online video viewing history are PII regulated by the VPPA, context matters.In particular, companies that transmit such information should be aware of several key points:<ul><li>First, the decision declined to impose VPPA liability for the disclosure of unique user IDs associated with video viewing history, where such IDs did not identify specific persons and where the record revealed only a hypothetical ability to correlate unique user IDs to specific persons but no evidence that it actually happened.</li><li>Second, the decision makes clear that companies should be mindful of the context in which they share unique user IDs with third parties, particularly with respect to whether the IDs permit the recipient or another party to identify specific persons, either directly or through information to which they already have access.</li><li>Third, the decision highlights the potential danger for companies that integrate social media plug-ins or other functionality on web pages where consumers watch videos. Companies providing online video services should consider taking steps to ensure that: (1) cookies and other data transmitted to another entity, such as a user ID that is matched with the video provider’s user ID for the same person, do not permit identification of specific individuals; and (2) video viewing history is not shared unintentionally, such as through a referrer URL that is transmitted during a standard browser request.</li><li>Finally, the decision highlights other important questions of fact that may exist when evaluating VPPA exposure, including whether the disclosing party had knowledge of the disclosure and whether the consumer consented to it.</li></ul>BACKGROUNDWith limited exceptions, the VPPA imposes liability—including liquidated damages of up to $2,500 per incident—on a video tape service provider that knowingly discloses, to any person, PII concerning any consumer of the video tape service provider. Liability extends to companies that provide online video services, such as Hulu, and the definition of PII includes “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”In this case, the plaintiffs alleged that Hulu wrongfully disclosed its users’ video viewing history to comScore and a social networking service. comScore had provided Hulu with audience metric data about Hulu’s users, and the social networking service had provided social networking features through placement of its “Like” button on Hulu’s video watch pages. Each company received different data from Hulu during the delivery of its services. Among other data, comScore received unique numerical Hulu User IDs and comScore User IDs, while the social networking service had access to its own first-party cookies containing its own unique user IDs. Each company also received the title of the video watched, either as a parameter in a set of data transmitted or in the referrer URL of the page on which the user viewed the video.ASSESSING THE LINK BETWEEN USER IDS AND SPECIFIC PERSONSIn its decision, the court addressed three different disclosures by Hulu:<ul><li>the disclosure to comScore of watch pages and Hulu User IDs;</li><li>the disclosure to comScore of the comScore User ID cookies; and</li><li>the disclosure to the social networking service of watch pages and the social networking service’s cookies.</li></ul>The key issue for the court was whether the disclosures of the video titles were tied to specific identified persons, such that they constituted prohibited disclosures of PII under the VPPA. The court stated that “the statute, the legislative history, and the case law do not require a name, [but] instead require the identification of a specific person tied to a specific transaction . . . .” Providing further explanation, the court stated that “a unique anonymized ID alone is not PII but context could render it not anonymous and the equivalent of the identification of a specific person.” In other words, context matters insofar as the circumstances link the unique user IDs to specific persons.In applying this reasoning, the court held that Hulu’s disclosure to comScore of watch pages and Hulu User IDs did not constitute disclosure of PII: despite the fact that comScore could have used the Hulu User IDs to access Hulu users’ profile pages and obtain their names, there was no evidence that it did so, and there was thus no disclosure of PII for purposes of the VPPA.The court next addressed Hulu’s disclosure to comScore of the comScore User ID cookies. The court explained that, although the comScore User IDs permitted comScore to conduct “substantial tracking that reveals a lot of information about a person,” the disclosure did not violate the VPPA because the tracking did not reveal “an identified person and his video watching.”On the other hand, the court suggested that disclosure of the social networking service’s own, first-party user IDs to the social networking service itself, together with video viewing history, may constitute disclosure of PII under the VPPA. The court noted that “[t]he Facebook User ID is more than a unique, anonymous identifier. It personally identifies a Facebook user. That it is a string of numbers and letters does not alter the conclusion.” In addition, the court emphasized that “a Facebook user—even one using a nickname—generally is an identified person on a social network platform” and that “[the Facebook User ID] identifies the Hulu user’s actual identity on Facebook.” Therefore, the court denied Hulu’s motion for summary judgment with respect to its disclosures to the social networking service.The decision with respect to the social networking service highlights the risk posed by integrations with social media companies on websites that host video services. Such integrations may cause a cookie or other data to be sent from a user’s browser without any affirmative action by the user, which could permit the social media company to identify a specific person and his or her video watch history—and thus trigger VPPA liability, although the court declined to make a decision on this aspect at this stage of the proceedings.In practical terms, this risk means that companies providing online video services should take steps to ensure that: (1) cookies and other data transmitted to another entity, such as a user ID that is matched with the video provider’s user ID for the same person, do not permit identification of specific individuals; and (2) video viewing history is not shared unintentionally, such as through a referrer URL that is transmitted during a standard browser request.OTHER POTENTIAL LIMITATIONS UNDER THE VPPA: “KNOWING” DISCLOSURE AND USER CONSENTThe court ruled that material issues of fact remained regarding whether Hulu disclosed the social networking service’s user IDs knowingly and without user consent. The court stated that “[o]ther cases involving violations of privacy statutes show that in the context of a disclosure of private information, ‘knowingly’ means consciousness of transmitting the private information. It does not mean merely transmitting the code.” Thus, the court stated that “if [Hulu] knew what [the social networking service’s cookies] contained and knew that it was transmitting PII . . . then Hulu is liable under the VPPA.” The court did not, however, grant summary judgment to Hulu based simply on the fact that Hulu’s servers could not read the social networking service’s cookies. Rather, the court held that other evidence may show that Hulu knew that the social networking service was receiving its own first-party user IDs within its cookies and was reading them together with video viewing history.Finally, the court also denied Hulu’s motion for summary judgment with respect to whether consumers had given consent to any disclosures through their acceptance of the social networking service’s privacy policy or whether such “consent,” if found, was sufficient under the VPPA.CONCLUSIONIn light of the court’s decision, companies that—without affected individuals’ VPPA-compliant consent—disclose any type of identifier, together with video viewing history, to any other person or company should pay very close attention to exactly what information they transmit and whether it could be used by the recipient to identify specific individuals.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

Julie O'Neill

If You Host Videos on Your Website, Read This Blog Post Regarding the Video Privacy Protection Act