Photo of Jeffrey Neuburger

Jeffrey Neuburger

Subscribe to Jeffrey Neuburger's Posts

Jeffrey Neuburger is co-head of Proskauer’s Technology, Media & Telecommunications Group, head of the Firm’s Blockchain Group and a member of the Firm’s Privacy & Cybersecurity Group.

Jeff’s practice focuses on technology, media and intellectual property-related transactions, counseling and dispute resolution. That expertise, combined with his professional experience at General Electric and academic experience in computer science, makes him a leader in the field.

As one of the architects of the technology law discipline, Jeff continues to lead on a range of business-critical transactions involving the use of emerging technology and distribution methods. For example, Jeff has become one of the foremost private practice lawyers in the country for the implementation of blockchain-based technology solutions, helping clients in a wide variety of industries capture the business opportunities presented by the rapid evolution of blockchain. He is a member of the New York State Bar Association’s Task Force on Emerging Digital Finance and Currency.

 

Jeff counsels on a variety of e-commerce, social media and advertising matters; represents many organizations in large infrastructure-related projects, such as outsourcing, technology acquisitions, cloud computing initiatives and related services agreements; advises on the implementation of biometric technology; and represents clients on a wide range of data aggregation, privacy and data security matters. In addition, Jeff assists clients on a wide range of issues related to intellectual property and publishing matters in the context of both technology-based applications and traditional media.

Contact:Read more about Jeffrey Neuburger

In a blog post last month, Google announced that it would extend certain commitments it made to the FTC in 2012 that were set to expire relating to, among other things,  the scraping of third-party content for use on certain Google “vertical search” properties such as Google Shopping.  The announcement came days before the commitments were set to expire on December 27th and months after Yelp had claimed that Google was not living up to its promises by allegedly scraping Yelp local business photos for use in certain Google results (e.g., local business listings).

We have been closely following the legal and legislative developments relating to biometric privacy, and in particular, the flow of litigation under the Illinois biometrics privacy law.   It was interesting to see how the Illinois law (as well as a similar Texas law) influenced Google’s  offering of a new facial recognition feature on the Google Arts & Culture app. (It is also interesting to note that the media coverage of the app has made the Illinois and Texas laws subjects of mainstream discourse.)

The Google Arts & Culture app, which was originally released a couple years ago, offers users virtual tours of museums and a searchable database of other art-related content.  What recently made it one of the hottest free apps is a new entertaining tool that compares a selfie to a database of great works of art and presents the results that most closely match the user’s face.  [Note: My classical art doppelgänger is “Portrait of a Gentleman in Red” by Rosalba Carriera. What’s yours?].  However, out of an apparent abundance of caution, Google has disabled this art-twinning function in Illinois and Texas, presumably because those states have biometric privacy laws that regulate the collection and use of biometric identifiers like facial templates; while the Texas statute can only be enforced by the state attorney general, Illinois’s Biometric Information Privacy Act (BIPA) contains a private right of action and remedies that include statutory damages. Interestingly, Washington users are able to access this tool, despite Washington having enacted its own biometric privacy law last year.  Perhaps that is because, as described in the referenced blog post, compliance under the Washington statute is less demanding than under the Illinois or Texas statutes.

As 2017 drew to an end, we noted the continuing flood of Illinois biometric privacy suits filed over the past year.  There are literally dozens of cases pending, most in Illinois state courts, alleging violation of Illinois’s Biometric Information Privacy Act (BIPA), which regulates the collection, retention, and disclosure of personal biometric identifiers and biometric information.  The suits initially targeted the use of biometrics on social media platforms, but, perhaps reflecting the increased use of biometrics in the workplace, have increasingly been asserted against businesses that collect biometric data to authenticate customers or employees.

While federal courts have weighed in on whether litigants have standing for asserting procedural violations of BIPA, it was not clear if mere procedural violations of BIPA’s consent and data retention requirements, without any showing of actual harm or data misuse, were actionable under the statute (i.e., whether persons pleading procedural violations are “aggrieved” under the statute, as BIPA expressly provides that “any person aggrieved by a violation” of the BIPA may pursue money damages and injunctive relief against the offending party).

As the year came to a close, an Illinois appellate court may have cooled the New Year’s Eve celebrations of BIPA class action lawyers a bit, as the court issued a decision which could provide defendants with a shield against BIPA suits.  The court ruled that if a party alleges only a technical violation of BIPA without alleging any injury or adverse effect, then such a party is not “aggrieved” under the Act and may not seek remedies (i.e., monetary damages or injunctive relief).  (Rosenbach v. Six Flags Entertainment Corp., No. 2-17-0317, 2017 IL App (2d) 170317 (Ill. App. Dec. 21, 2017)).

As we approach the end of 2017, it is a time to reflect on the dizzying pace of technology evolution this year, and the amazing array of legal issues it presented. Similarly, it is a time to look forward and anticipate what technology-related issues we will be thinking about in the coming year.

For 2017, the list is long and varied.

This year, the true potential of blockchain was recognized by many in the commercial sector. While recent blockchain-related headlines have focused on the rise (and regulation) of cryptocurrencies, a great deal of the blockchain action has been in back office applications in financial services, supply chain and other areas.  Industry wide consortia have been formed, trials and proof of concepts have been run, and, as evidenced by the recent announcement by the Australian Stock Exchange to replace its clearing and settlement system with a blockchain based system, we are moving into full production implementations of blockchain systems.

Cybersecurity garnered major attention in 2017. Unfortunately, data breaches continued to be a constant headline item, as were related class action litigation. As a result, cybersecurity was a “top of the agenda” item for state and federal agencies, state legislatures, regulators, corporate boards, GCs and plaintiffs’ lawyers.

As a related matter, privacy issues were also front and center this year. In particular,  we saw increased activity in some of the cutting edge areas of privacy law, including biometrics-related litigation (particularly under the Illinois Biometric Information Privacy Act (known as BIPA)), video streaming privacy (particularly under the Video Privacy Protection Act, or the VPPA)) and mobile-related privacy issues.

There are many other issues that occupied our minds this year, including artificial intelligence, virtual and augmented reality, online copyright liability (including application of the DMCA in online contexts), and publisher/distributor liability for third party content online (under Section 230 of the Communications Decency Act).  Additionally, parties involved in agreements of all types have been increasingly focused on technology-related legal risk, and were more intent on addressing and shifting technology-related risks with very specific contractual provisions.

In a brief, unpublished opinion, the Sixth Circuit affirmed the dismissal of right of publicity and privacy claims against a host of self-publishing platforms and service providers for distributing an erotic (and purported “less than tasteful”) book whose cover contained an unauthorized copy of the plaintiffs’ engagement photo because the plaintiffs failed to plead more than an “incidental” use of the photo by the service providers. (Roe v. Amazon.com, No. 16-3987 (6th Cir. Nov. 21, 2017) (unpublished)).

This dispute initially raised our interest because it raised the larger issues of how to define a “publisher” and “distributor” in the modern e-commerce environment and to what extent an ebook platform or print-on-demand service could be protected for distributing third-party content by the immunity provided by Section 230 of the Communications Decency Act (“CDA Section 230”).  While we anticipated that such issues would get a full examination on appeal, the Sixth Circuit sidestepped these novel issues and decided the case on the merits of the privacy claims. 

After noting the flood of Illinois biometric privacy suits in September, it appears that the flow of such suits remains robust.  Dozens of suits have been filed in Illinois state court against Illinois-based employers and other businesses alleging violation of Illinois’s Biometric Information Privacy Act (BIPA), which generally regulates the collection, retention, and disclosure of personal biometric identifiers and biometric information, and encourage businesses that collect such personal data to employ reasonable safeguards.

In recent years, biometric privacy suits initially involved social media services and video game makers, but have increasingly been asserted against businesses that collect biometric data to authenticate customers or employees, especially Illinois-based employers that use biometric timekeeping devices to verify employees when clocking in and out.  

In a decision that clarified aspects of the video privacy landscape, the Ninth Circuit affirmed the dismissal of an action alleging a violation of the Video Privacy Protection Act (VPPA) based on an assertion that ESPN’s WatchESPN Roku channel had shared a user’s Roku device number and video viewing history with a third-party analytics company for targeted advertising purposes.  (Eichenberger v. ESPN, Inc., No. 15-35449 (9th Cir. Nov. 29, 2017)).  The appeals court found that such a disclosure of a device identifier did not constitute “personally identifiable information” (PII) under the VPPA.  In doing so, the court declined to take a broad interpretation of the 1980s era statute originally aimed at video stores, but which in recent years has been applied to online video streaming services and mobile and video streaming apps.

With the flood of Illinois biometric privacy suits lodged against employers in recent months, and multiple biometric privacy suits against social media and other mobile platforms currently pending over the use of photo tagging functions, 2017 has been a busy year in this area.  In a notable circuit court level…

UPDATE: In June 2021, the Ninth Circuit affirmed the dismissal of claims in the Gonzalez case, mostly on § 230 grounds. Subsequently, on October 3, 2022, the Supreme Court granted certiorari in Gonzalez (see our follow-up post).

UPDATE:  In a subsequent opinion, the court dismissed the plaintiffs’ third amended complaint. (See Gonzalez v. Google, Inc., 335 F.Supp.3d 1156 (N.D. Cal. 2018)).

Following the reasoning of several past decisions, a California district court dismissed claims against Google under the Anti-Terrorism Act (ATA), 18 U.S.C. § 2333, for allegedly providing “material support” to ISIS by allowing terrorists to use YouTube  (temporarily, before known accounts are terminated) as a tool to facilitate recruitment and commit terrorism.  (Gonzalez v. Google, Inc., 2017 WL 4773366 (N.D. Cal. Oct. 23, 2017)). The court rejected the plaintiffs’ arguments that Google provided the terrorists with material support by allowing them to sign up for accounts (or regenerate shuttered accounts) and then allegedly serve targeted ads alongside such posted videos.  It ruled that even careful pleadings cannot change the fact that, in substance, plaintiffs’ attempt to hold Google liable as a publisher of the terrorist’s detestable content was barred by Section 230 of the Communications Decency Act (“CDA Section 230” or “CDA”).