Members of Congress Request FTC Investigation of Financial Data Company’s Collection and Privacy Practices

Last week, Democratic Senators Ron Wyden and Sherrod Brown and Congresswoman Anna Eshoo sent a letter to FTC Chairman Joseph J. Simons urging the agency to investigate whether analytics firm Envestnet, Inc. (which operates Yodlee) was violating the FTC Act.

According to the letter, Yodlee is the largest consumer financial data aggregator in the United States. It aggregates financial information from banks, credit card companies and other financial services providers with consumer consent, and maintains a database of credit and debit card transactions of tens of millions of consumers. The letter asserts that Yodlee is used by over 1,200 companies to offer online personal finance tools to consumers. Yodlee offers its software and platform to fintech providers, banks, financial apps, consumers and others to help process financial data from various sources.

The crux of the letter claims that Envestnet sells access to such consumer data without meaningful notice to consumers of such sale. The members of Congress reject Envestment’s position that consumer privacy is protected because the data it sells is anonymized, and claim that Envestnet does not inform consumers that their personal financial data is being sold, but rather relies on its partners to make such disclosures in privacy policies or terms of service. The letter asserts that this is not sufficient, as Envestnet does not appear to take any steps to ensure that its partners give such notice, and even if they did, such practices place the burden on consumers to find such a notice “buried in small print” and then search for a way to opt out of such data sharing. Continue Reading

Tags: anonymized data, consumer consent, consumer financial data, financial data analytics, Letter to FTC

Repeal of CDA Section 230?

By Jeffrey Neuburger on January 17, 2020 Posted in Internet, Online Content

In an interview with the editorial board of the New York Times, published today, former Vice President Joe Biden advocated for repeal of Section 230 of the Communications Decency Act (CDA). As readers of this blog may know, the CDA offers service providers protections that underpin the hosting of much of the user-generated content (both good and bad) on the web and social media.

The CDA expressly treats online providers that host or “publish” third party content differently than their offline counterparts, and frees online providers from certain obligations associated with moderating the flood of user-generated content that is uploaded to their servers. The immunities under CDA Section 230 have facilitated the growth of e-commerce and social media, but at the same time has also allowed for the proliferation of fake content and hateful speech. In recent years, the CDA has reached a crossroads of sorts, with the passage of FOSTA in 2018 and with more and more federal legislators on both sides of the aisle calling for “Silicon Valley” to be reined in and Section 230 to be curtailed or amended. One wonders, however, how curtailing the CDA would affect the vibrancy of the internet. If the present or future Congress reaches some consensus and tinkers with CDA Section 230, would that intentionally (or unintentionally) change the online “rules” that many entities have come to rely on since the CDA was passed over 20 years ago?

Tags: CDA amendment, CDA immunity, CDA Section 230

In Outlining Its 2020 Examination Priorities, SEC Expresses Interest in Alternative Data and Cybersecurity Risks

By Jeffrey Neuburger on January 15, 2020 Posted in Blockchain, Data Security, Digital Currency, Regulatory, Screen Scraping

On January 7, 2019, the Securities and Exchange Commission’s Office of Compliance Inspections and Examinations (OCIE) announced its 2020 examination priorities. In doing so, OCIE identified certain areas of technology-related concern, and in particular, on the issue of alternative data and cybersecurity. [For a more detailed review of OCIE’s exam priorities, see the Client Alert posted on our firm’s website].

Alternative Data: For the first time, OCIE has publicly listed alternative data as an examination priority, stating that “examinations will focus on firms’ use of these data sets and technologies to interact with and provide services to investors, firms, and other service providers and assess the effectiveness of related compliance and control functions.”

Buy-side funds using alternative data should expect a heightened level of scrutiny from OCIE on this issue. Such entities should be ready to explain, among other things, its due diligence procedures for evaluating and vetting alternative data vendors and their techniques and contractual approaches used with such vendors, as well as protections against receipt of personally identifiable information (PII) and other potential MNPI considerations.

Cybersecurity: Following the SEC’s 2018 updated guidance on public company cybersecurity disclosures, information security remains a prominent focus of OCIE across its entire examination program. Specifically, OCIE stated that examinations will center on things such as “proper configuration of network storage devices, information security governance generally, and retail trading information security.” Moreover, OCIE announced that it would focus on vendor oversight practices, including cloud storage relationships, including “the controls surrounding online access and mobile application access to customer brokerage account information.” Lastly, the OCIE referenced that one of its priorities would be to examine the safeguards surrounding data disposal, specifically, the risks of retired hardware containing client information.

Expect a heightened level of scrutiny from OCIE on all of the foregoing. Entities should review their cybersecurity practices, including their agreements with third party vendors and service providers, in anticipation of the questions OCIE is likely to ask.

Blockchain and Digital Currency: OCIE stated that the rapid growth of digital assets present various risks, and that it would continue to “examine SEC-registered market participants” engaged in certain cryptocurrency activities and transfer agents developing blockchain technology, among other things. For a more thorough discussion of the blockchain and digital currency-related issues outlined by OCIE, please see the post on our Blockchain and the Law blog.

Tags: 2020 examination priorities, alternative data, alternative data vendors, information security, OCIE, SEC, web scraping

White House Releases Proposed Guidance for the Regulation of AI

By Jeffrey Neuburger on January 8, 2020 Posted in Regulatory, Technology

On January 7, 2019, the federal Office of Management and Budget (OMB) released a draft of a memorandum setting forth guidance to assist federal agencies in developing regulatory and non-regulatory approaches regarding artificial intelligence (AI). This draft guidance will be available for public comment for sixty days, after which it will be finalized and issued to federal agencies.

According to the draft, the guidance was developed with the intent to reduce barriers to innovation while also balancing privacy and security concerns and respect for IP. The proposed guidance features ten principles to guide regulatory approaches to AI applications. In addition, in what may be a boon for those in the private sector developing AI infrastructure, the OMB reinforces the objective of making federal data and models generally available to the private sector for non-federal use in developing AI systems.

Initial responses to the proposed guidance has been mixed, and it remains to be seen how the principles in the guidance (when finalized) will be put in practice. Notably, however, those who intend to invest significant resources in AI-based infrastructure should be aware of what may prove to be the emerging blueprint for AI regulation in the near future. Continue Reading

Tags: AI, AI regulation, AI regulation principles, artificial intelligence, White House draft AI guidance

Reflections on 2019 in Technology Law, and a Peek into 2020

By Jeffrey Neuburger on December 23, 2019 Posted in Biometrics, Blockchain, Privacy, Quantum Computing, Screen Scraping, Social Media, Technology

It is that time of year when we look back to see what tech-law issues took up most of our time this year and look ahead to see what the emerging issues are for 2020.

Data: The Issues of the Year

Data presented a wide variety of challenging legal issues in 2019. Data is solidly entrenched as a key asset in our economy, and as a result, the issues around it demanded a significant level of attention.

Clearly, privacy and data security-related data issues were dominant in 2019. The GDPR, CCPA and other privacy regulations garnered much consideration and resources, and with GDPR enforcement ongoing and CCPA enforcement right around the corner, the coming year will be an important one to watch. As data generation and collection technologies continued to evolve, privacy issues evolved as well. In 2019, we saw many novel issues involving mobile, biometric and connected cars. Facial recognition technology generated a fair amount of litigation, and presented concerns regarding the possibility of intrusive governmental surveillance (prompting some municipalities, such as San Francisco, to ban its use by government agencies).
Because data has proven to be so valuable, innovators continue to develop new and sometimes controversial technological approaches to collecting data. The legal issues abound. For example, in the past year, we have been advising on the implications of an ongoing dispute between the City Attorney of Los Angeles and an app operator over geolocation data collection, as well as a settlement between the FTC and a personal email management service over access to “e-receipt” data. We have entertained multiple questions from clients about the unsettled legal terrain surrounding web scraping and have been closely following developments in this area, including the blockbuster hiQ Ninth Circuit ruling from earlier this year. As usual, the pace of technological innovation has outpaced the ability for the law to keep up.
Data security is now regularly a boardroom and courtroom issue, with data breaches, phishing, ransomware attacks and identity theft (and cyberinsurance) the norm. Meanwhile, consumers are experiencing deeper and deeper “breach fatigue” with every breach notice they receive. While the U.S. government has not yet been able to put into place general national data security legislation, states and certain regulators are acting to compel data collectors to take reasonable measures to protect consumer information (e.g., New York’s newly-enacted SHIELD Act) and IoT device manufacturers to equip connected devices with certain security features appropriate to the nature and function of the devices secure (e.g., California’s IoT security law, which becomes effective January 1, 2020). Class actions over data breaches and security lapses are filed regularly, with mixed results.
Many organizations have focused on the opportunistic issues associated with new and emerging sources of data. They seek to use “big data” – either sourced externally or generated internally – to advance their operations. They are focused on understanding the sources of the data and their lawful rights to use such data. They are examining new revenue opportunities offered by the data, including the expansion of existing lines, the identification of customer trends or the creation of new businesses (including licensing anonymized data to others).
Moreover, data was a key asset in many corporate transactions in 2019. Across the board in M&A, private equity, capital markets, finance and some real estate transactions, data was the subject of key deal points, sometimes intensive diligence, and often difficult negotiations. Consumer data has even become a national security issue, as the Committee on Foreign Investment in the United States (CFIUS), expanded under a 2018 law, began to scrutinize more and more technology deals involving foreign investment, including those involving sensitive personal data.
For more information about developments over the past year on data-related issues, and to keep abreast on new developments in the future, you may want to subscribe to Proskauer’s privacy blog, privacylaw.proskauer.com. You may also want to review our Practical Law article “Trends in Privacy and Data Security:2018” and get a hold of our update that will publish in winter 2020.

I am not going out on a limb in saying that 2020 and beyond promise many interesting developments in “big data,” privacy and data security. Continue Reading

Tags: 2019 REVIEW, AI, artificial intelligence, blockchain, data collection, data privacy, edge computing, IoT, licensing big data, new technologies, quantum computing, social media platforms, technology law trends

Online Willful Infringement Standard Clarified: Zazzle Jury Award Reinstated

By Jeffrey Neuburger on December 10, 2019 Posted in Copyright, Internet, Online Commerce

Recently, the Ninth Circuit reinstated a $460,000 jury verdict against print-on-demand site Zazzle, Inc. (“Zazzle”) for willful copyright infringement, putting a final stamp (perhaps) on a long-running dispute that explored important DMCA safe harbor issues for online print-on-demand services. (Greg Young Publishing, Inc. v. Zazzle, Inc., No. 18-55522 (9^th Cir. Nov. 20, 2019) (unpublished). The appeals court found that Zazzle’s anti-infringement oversight mechanisms were insufficient during the period of infringement when a number of the plaintiff’s Greg Young Publishing, Inc.’s (“GYPI”) visual art works were uploaded by users onto Zazzle’s site without authorization. Continue Reading

Tags: DMCA safe harbor, print-on-demand services, willful copyright infringement

Retailer Reminder: FTC Releases Guidance for Social Media Influencers

By Jeffrey Neuburger on December 4, 2019 Posted in Internet, Online Content, Regulatory, Social Media

With the online shopping season in full swing, the FTC decided that online retailers might benefit from a reminder as to the dos and don’ts for social media influencers. Thus, the FTC released a new guide, “Disclosures 101 for Social Media Influencers,” that reiterates its position about the responsibility of “influencers” to disclose “material” connections with brands when endorsing products in online posts. Beyond this new guide, which is written in an easy-to-read brochure format (with headings such a “How to Disclose” and “When to Disclose”), the FTC released related videos to convey the message that influencers should “stay on the right side of the law” and disclose when appropriate the relationship with a brand he or she is endorsing. This latest reminder to influencers comes on the heels of the FTC sending 90 letters to influencers in April 2017 notifying them of their responsibilities under the FTC”s Endorsement Guides, and the prior publishing of an Endorsement Guides FAQ. With the release of fresh guidance, now is a good time for brands with relationships with influencers to ensure endorsements are not deceptive and remain on the right side of the law. Indeed, advertisers should have reasonable programs in place to train and monitor members of their influencer network and influencers themselves should remain aware of requirements under the Endorsement Guides. Continue Reading

Tags: disclosures, Endorsement Guides, FTC brochure, social media influencers

DOJ Seeking to End Movie Studio and Theater Antitrust Decrees amidst Streaming Competition – A New Opportunity in Theatrical Distribution?

By Kevin Milewski on November 25, 2019 Posted in Licensing, Television, Video

For the film and media distribution industries, this year has been action-packed. Production budgets are skyrocketing and new digital services have been announced or are launching with each passing month. The streaming wars are upon us. Moreover, the FCC recently voted to treat streaming services as “effective competition” to traditional cable providers (or MVPDs), thereby triggering basic cable rate de-regulation in parts of Hawaii and Massachusetts.

The distribution landscape took yet another unexpected legal twist this week. On November 18, Assistant Attorney General Makan Delrahim announced that the Antitrust Division of the Department of Justice would ask a federal court to terminate the “Paramount Consent Decrees” (the “Decrees”), which have prohibited movie studios from engaging in certain distribution practices with movie theaters since the 1940s. The DOJ filed a motion to terminate the Decrees in federal court in the Southern District of New York on November 22, 2019. Notably, the DOJ cites streaming services and new technology as a few of the many reasons that the Decrees may no longer be necessary in what the DOJ official sees as today’s highly competitive, consumer-driven content market. Given the volatility of the content licensing space, film licensors and licensees will have to carefully consider how the DOJ’s actions will affect their content rights and options going forward. Continue Reading

Tags: antitrust, content licensing, movie distribution, Paramount Consent Decrees, streaming services, theaters

Circuit Court Denies LinkedIn’s Petition for En Banc Review of hiQ Scraping Decision

By Jeffrey Neuburger on November 11, 2019 Posted in Computer Fraud and Abuse Act, Internet, Online Content, Screen Scraping, Social Media

Last month, LinkedIn Corp. (“LinkedIn”) filed a petition for rehearing en banc of the Ninth Circuit’s blockbuster decision in hiQ Labs, Inc. v. LinkedIn Corp., No. 17-16783 (9^th Cir. Sept. 9, 2019). The crucial question before the original panel concerned the scope of Computer Fraud and Abuse Act (CFAA) liability to unwanted web scraping of publicly available social media profile data and whether once hiQ Labs, Inc. (“hiQ”), a data analytics firm, received LinkedIn’s cease-and-desist letter demanding it stop scraping public profiles, any further scraping of such data was “without authorization” within the meaning of the CFAA. The appeals court affirmed the lower court’s order granting a preliminary injunction barring LinkedIn from blocking hiQ from accessing and scraping publicly available LinkedIn member profiles to create competing business analytic products.

On November 8, 2019, the Ninth Circuit denied Linkedin’s petition for rehearing en banc.

Thus, for now, the Ninth Circuit’s decision interpreting the scope of CFAA liability in the context of scraping public websites will stand (barring Supreme Court review). This development is certainly favorable to entities engaged in such data scraping. However, as we’ve stated in a prior post on the appeals court opinion, while the Ninth Circuit’s decision suggests that the CFAA is not an available remedy to protect against unwanted scraping of public website data that is “presumptively open to all,” entities engaged in scraping should remain careful. Moreover, this dispute is not over (as the litigation is only in the preliminary stages), and the case has been remanded to the lower court for further proceedings. We will watch carefully how LinkedIn proceeds from here, and whether it presses its remaining state law claims (e.g., breach of contract, trespass) or else reaches a settlement with hiQ.

Tags: CFAA, data scraping, en banc review, hiQ case, publicly available website data, social media data, unauthrorized access

Warrantless Retrieval of Electronic Automobile Data Held to Be Unreasonable Search – Ruling Points to Private Nature of Digital Data Collected in Today’s World

By Jeffrey Neuburger on October 21, 2019 Posted in Autonomous Cars, Privacy, Technology

The Georgia Supreme Court ruled that the retrieval of electronic automobile data from an electronic data recording device (e.g., airbag control modules) without a warrant at the scene of a fatal collision was a search and seizure that implicates the Fourth Amendment, regardless of any reasonable expectations of privacy. (Mobley v. State, No. S18G1546 (Ga. Oct. 21, 2019)). The Court went on to hold that such retrieval of data was an unreasonable search and seizure forbidden by the Fourth Amendment, and that because the State failed to identify any recognized exception to the warrant requirement applicable to the facts, the trial court should have granted the motion to suppress. As such, the judgment of the Court of Appeals affirming the conviction of the defendant for vehicular homicide was reversed.

As described in an earlier post, the defendant was convicted of vehicular homicide based on evidence retrieved from his vehicle’s electronic data that showed that he was travelling at a high rate of speed prior to the accident. The defendant appealed the decision of the trial court (which was affirmed by the appellate court) that denied his motion to suppress evidence of the data that law enforcement officers retrieved without a warrant from an electronic data recording device on his vehicle (note: a search warrant was obtained for the physical device the next day).

Putting aside the state criminal procedural issues and the sufficiency of the evidence against the particular defendant in this case, the decision is an important follow-up to the Supreme Court’s guidance in the area of digital privacy that it set out in recent years in the Riley and Carpenter decisions. With cars becoming more like computers and sensors on four wheels, automated automobile data may potentially be viewed as sensitive as certain types of private data collected by mobile devices. With the advent of autonomous cars, the Mobley court recognized how one’s private sphere can extend beyond the home and, depending on the factual circumstances and the nature of the search, may include automated data collected by one’s devices (both small, like a mobile phone, and large, as an automobile). With new technologies like digital personal assistants and the coming of 5G and the supposed Internet of Things (IoT) revolution of connectedness, we imagine these issues will coming up more and more in the coming years.

Tags: autonomous cars, digital data, expectation of privacy, Fourth Amendment, vehicle data