Privacy Law in Q1 2002

Internet privacy is one of the top policy issues facing Congress, state legislatures and regulators. At the federal level, several bills are pending. Additionally, a growing number of state legislators have concluded that industry self-regulation fails to protect consumers' online privacy. The National Association of Attorneys General has issued a report on the subject that recommends new national legislation that preempts state law enforcement efforts and imposes an opt-in paradigm. Internet companies, as well as brick and mortar companies operating online, face a bewildering range of scrutiny of their online data collection and disclosure practices. This survey summarizes the major privacy issues as they stand in Q1 2002.

EXECUTIVE SUMMARY

Internet privacy is one of the top policy issues facing Congress, state legislatures and regulators. At the federal level, several bills are pending. Additionally, a growing number of state legislators have concluded that industry self-regulation fails to protect consumers' online privacy. The National Association of Attorneys General has issued a report on the subject that recommends new national legislation that preempts state law enforcement efforts and imposes an opt-in paradigm. Internet companies, as well as brick and mortar companies operating online, face a bewildering range of scrutiny of their online data collection and disclosure practices. This survey summarizes the major privacy issues as they stand in Q1 2002.

1. The Hit List: Issues That Have Resulted in Lawsuits, Investigations and/or Bad Press

• misrepresenting the purpose for collecting personally identifiable information;
• disclosing, sharing, or selling consumers' personally identifiable information to third parties in contravention of a stated privacy policy;
• misrepresenting the security of consumers' personal information;
• misrepresenting the use of consumers' personal information;
• misrepresenting the collection, use and disclosure of children's personal information;
• failing to disclose use and/or duration of cookies;
• failing to disclose use of Web bugs;
• failing to disclose information gathering through spyware, which is incorporated into consumer software to trace consumers' Internet activities without disclosures to that effect; and
• failing to comply with agreed-to third-party privacy policies.

2. Deceptive Practices

To date, regulators have primarily been concerned about deceptive privacy practices, specifically:

• failure of companies to strictly abide by their stated privacy policies, including the inadvertent failure to comply with promises regarding their collection, use and disclosure of consumers' personal information;
  • to avoid this deceptive practice, a company's Web site should be audited regularly to be sure that the Web site is doing what it says and saying what it does; and
• failure to disclose certain data collection activities to consumers, such as the use of cookies.

Both the Federal Trade Commission ("FTC") and state Attorneys General ("AGs"), individually and often collectively, have pursued actions against companies that have engaged in such deceptive practices. There have also been many law suits filed by private parties.

To avoid such allegations, privacy polices should disclose:

• what information is being collected;
• the intended use of the information;
• the third parties to whom the information will be disclosed;
• how consumers can obtain access to the information;
• how consumers can have the information removed; and
• how consumers can opt out from data collection or disclosure.

3. Children

The Children's Online Privacy Protection Act ("COPPA") and the implementing FTC trade regulation rule require that a Web site that collects information from children under thirteen must generally:

• provide parents with notice (both online and in a way reasonably calculated to reach parents) of the information it collects from children, how it uses the information, and with whom it shares the information;
• obtain verifiable parental consent for collection, use and disclosure of personally- identifiable data from minors;
• provide parents wit h reasonable means to review the collected data and to refuse to allow its further use or maintenance;
• give parents the option to allow collection and use of the child's personal information for the specific site without consenting to disclosure to third parties;
• not condition a child's participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in that activity; and
• establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from children.

4. Financial Privacy

The Gramm- Leach-Bliley Act of 1999 ("GLBA") governs the collection and dissemination by "financial institutions" of consumers' "non-public personal financial information." Under GLBA and the FTC's implementing trade regulation rule, "financial institutions" (generally, companies that issue credit) must:

• disclose, at the time of establishing a customer relationship, its privacy policies and practices with respect to information shared with both affiliates and non-affiliated third parties;
• provide consumers with a means of opting out of any disclosure of their personal information to third parties; and
• establish procedures to provide for the security and integrity of consumers' non-public personal financial information.

5. Online Profiling

The following principles, proposed by the Network Advertising Initiative ("NAI") and endorsed by the FTC, apply to the merging of consumers' personal information with cookies or other data that provide information on consumers' online habits:

• material changes in information practices cannot be applied to information collected prior to the changes in the absence of affirmative consent, or "opt in," by the consumer;
• non-personally identifiable data previously collected from consumers cannot be linked to personally identifiable information ("PII") without affirmative consent, or "opt in," by the consumer;
• to prospectively use PII for profiling, and even the merging of personally identifiable online and offline data, must provide "robust" notice and the choice to "opt out," which must appear at the time and place of information collection and before the entering of data;
• to prospectively use non-PII for profiling, must provide clear and conspicuous notice and the choice to "opt out," which must be included in the publisher's privacy policy with a link to the network advertiser or an NAI opt out Web page; and
• on any Web sites where multiple network advertising companies collect information (generally non-PII) consumers must be able to "opt out" of profiling by any or all of the advertisers on a single page that is accessible from the host Web site's privacy policy.

6. Employee Privacy Rights

Employers must be aware of restrictions on monitoring employee e- mail and Internet use, and the provisions of the Electronic Communications Privacy Act ("ECPA"), which prohibit unauthorized use, disclosure or interception of electronic communications. Generally, an employer may intercept electronic communications if:

• it has notified employees in advance;
• it is incident to rendition of the communications service; or
• it is necessary to protect the company; and
• it is done via the communications network used in the ordinary course of business.

Employers are advised to reduce their risk of liability for monitoring employee e- mail usage by requiring all employees to acknowledge and sign an e-mail and Internet use policy. Employers can also reduce their risk of liability for defa mation, transmission of obscene materials, sexual harassment, and discrimination committed by employees on workplace computers by requiring compliance with such a policy.

In addition, employers should be mindful of a recent California statute, which requires businesses to ensure the privacy of a customer's personal information contained in records by destroying or arranging for the destruction of the records by shredding, erasing or otherwise modifying the customer record to make information contained therein unreadable or undecipherable through any means. See CA CIVIL CODE §§ 198.80-198.82. Failure to comply with this statute could make an employer liable for damages, injunctive relief or other remedies. Id. This statute will likely apply to employers that monitor their employees e- mail usage because they inevitably become privy to and collectors of their employees personal information contained in electronic communications.

7. Medical Privacy

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and HHS's implementing trade regulation rule ("HIPAA Rule") generally:

• prohibit covered entities (defined as health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction regulated by the HIPPA) from disclosing protected health information to third parties without the patient's prior consent;
• limit use or disclosure of protected health information (which may include electronic records, paper records, and oral communications) to the "minimum necessary" to accomplish the intended purpose of the use, disclosure, or request; and
• increase patients' control over their medical information, including requiring patients' consent for most disclosures and providing patients' the right to inspect and copy information in their medical records.

HIPAA and the HIPAA Rule may also affect employers - not just health care providers - because employers often offer health benefits to employees, and data related to such benefits is included under the law.

8. Special Rules for Telecommunications Carriers

Section 222 of the Telecommunications Act of 1934, codified at 47 U.S.C. § 222, provides protection for certain personal information collected by telecommunications carriers about their customers. Specifically, carriers must obtain their subscribers' "approval" before using or disclosing "customer proprietary network information" ("CPNI") for any reason other than providing or billing for the type of telecommunications service from which the CPNI was derived.

CPNI is defined as "information that relates to the quantity, type, destination and amount of use of a telecommunications service" that carriers receive as a result of their relationship with subscribers. Thus, for example, CPNI includes the telephone numbers called by subscribers and the length of such calls. CPNI excludes subscribers' name, address and telephone number; aggregate, non-personally- identifiable information; and data from other sources such as non- telecommunications services and data purchased from third parties.

In its implementing rules, the FCC took the position that "approval" means affirmative, opt-in consent following consumers' receipt of notice of their rights to CPNI data. In 1999, however, the Tenth Circuit Court of Appeals vacated the FCC's rules, holding that the requirement of an affirmative, opt-in consent violated the First Amendment to the United States Constitution by restricting protected commercial speech.

The FCC has not yet acted on remand, but it has stated publicly that it will continue to enforce the remainder of Section 222, such as the requirement that telecommunications carriers at least provide consumers with notice and a means of opting out of the use or disclosure of their CPNI information.

9. International Privacy Initiatives

In the international arena, the European Union ("EU"), the Organization for Economic Cooperation and Development ("OECD"), Canada, Hong Kong and New Zealand, among others, have taken steps to restrict data collection and, particularly, transborder flow of personal data. The EU Directive particularly affects United States ("U.S.") companies because the EU has determined that U.S. privacy protections did not provide an adequate level of protection, and therefore member states must prohibit transfe r of data to U.S.-based companies. In order to allow U.S.-based companies to avoid regulation, companies may self-certify under the Safe Harbor agreement negotiated by the U.S. Department of Commerce ("DOC") or make use of EU-approved contract clauses. The other international initiatives also focus on security, and the familiar requirements of notice to consumers, choice provisions, and access. Additionally, Canada's new laws impose limitations on use ("that which is reasonably necessary"), accuracy, and retention of data.

I. U.S. PRIVACY LAW

A. Deception

Internet companies generally engage in deception by either: (1) failing to abide by their stated privacy policies; or (2) failing to disclose certain data collection that occurs at their Web sites. At both the federal and state levels, regulators are increasingly bringing actions for deceptive misuse of consumer information.

1. Misrepresentation of Privacy Promises

2. Failure to Disclose

Internet companies have been accused of engaging in deceptive practices by failing to disclose that they are sharing consumers' personal information with third parties, or by planting cookies, Web bugs, and spyware to track consumers' Internet activities.

B. Children

1. Children's Online Privacy Protection Act ("COPPA"): Regulation of Collection and Use of Personally-Identifiable Information

In April, 2000, the FTC issued it final Children's Online Privacy Protection Rule (the "COPPA Rule") for implementing The Children's Online Privacy Protection Act ("COPPA"). COPPA establishes legal requirements for collecting information from children, including the need for disclosure and consent.

Rule: http://www.ftc.gov/os/1999/9910/64fr59888.pdf

Business Guides: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions

2. FTC v. Liberty Financial: Misrepresentation Regarding Treatment of Children's Personal Information.

Before the COPPA Rule was implemented, the FTC addressed children's privacy in a lawsuit against Liberty Financial Companies, Inc., the operator of the Young Investor Web site. The FTC alleged that the Web site falsely represented that personal information collected from children in a survey would be maintained anonymously. The FTC alleged that Liberty Financial did not maintain the information it collected via the survey anonymously and that it maintained information about the child and the family's finances in an identifiable manner.

3. FTC v. Toysmart.com: Misrepresentation Regarding Treatment of Children's Personal Information.

Following enactment of the COPPA Rule, the FTC settled a case against Toysmart.com. Toysmart.com was an online toy retailer that collected family profiles, including the names and birth dates of children, which triggered application of COPPA. Toysmart.com promised in its privacy statement to never share information collected from consumers with a third party. However, the company subsequently filed a motion in bankruptcy court seeking to sell its assets, including its database of personal information.

The FTC charged that selling the database would constitute a violation of COPPA because Toysmart.com collected names, e- mail addresses, and ages of children under thirteen without notifying parents or obtaining parental consent. The FTC demanded that Toysmart.com be prohibited from selling the database as a stand-alone asset, but agreed to allow its sale within one year to a "qualified buyer" that agrees to the terms of the original privacy policy.

4. Monarch Services, Inc., Girls' Life, Inc., Bigmailbox.com, and Looksmart Ltd.: Alleged Collection of Children's Information Without Parental Consent

In April 2001, the FTC announced settlements with three Web site operators charged with violations of COPPA. The FTC charged Monarch Services, Inc. and Girls' Life, Inc.,[2] operators of www.girlslife.com; Bigmailbox.com,[3] operator of www.bigmailbox.com; and Looksmart Ltd.,[4] operator of www.insidetheweb.com, with collecting personally identifiable data from children under the age of 13 without parental consent. As part of the settle ments, the companies were required to pay a total of $100,000 in civil penalties, comply with COPPA in connection with any future online collection of personally identifiable data from children under the age of 13, and delete all personally identifiable data collected online from children since the effective date of the COPPA Rule.

5. Lisa Frank, Inc.: Alleged Failure to Provide Parental Notice and Obtain Consent for the Collection of Information from Children

In October 2001, the FTC announced a settlement with Lisa Frank, Inc., maker of popular girls' toys and school supplies that the company advertised and sold at the Web site www.lisafrank.com. In its complaint, the FTC alleged that the company failed: (1) to provide notice to parents that it wished to collect information form their children; (2) to obtain parental consent for the collection of their children's information; and (3) to accurately disclose in its privacy policy the company's informati on collection, use and disclosure practices. As part of the settlement, Lisa Frank, Inc. is required to pay a civil penalty of $30,000 and is prohibited from violating the provisions of COPPA.

6. Children's Internet Protection Act: Regulation of Children's Internet Access in Public Schools

In December 2000, Congress passed the Children's Interne t Protection Act. The Children's Internet Protection Act requires public schools to use filtering technology to block a minor's ability to obtain Internet access to images and pictures that are obscene, harmful to minors, or which constitute child pornogr aphy. Public schools that do not use filtering services will not qualify for federal money for Internet endeavors.

[1] The FTC's "sliding scale" approach, which enables operators who only use collected information from children for internal purposes, is set to expire on April 21, 2002. The FTC, however, has proposed to extend the time-frame for the "sliding scale." For more information on the FTC's proposal, please visit http://www.privacylawplaybook.com/documents/PRIV_COPPA_Article.htm.

[2] United States v. Monarch Services, Inc. and Girls' Life Inc., Civil Action No. AMD 01 DV 1165 (D. Md. Apr. 2001).

[3] United States v. Bigmailbox.com and Nolan Quan, Civil Action No. 01-605-A (E.D. Va. Apr. 2001).

[4] United States v. looksmart, Ltd., Civil Action No. 01-606-A (E.D. Va. Apr. 2001).

C. Financial Privacy

1. Fair Credit Reporting Act: Regulation of Consumers' Credit Information.

The Fair Credit Reporting Act ("FCRA") governs the use of consumer reports, which are defined as:

These "permissible purposes," as set forth in Section 1681b of the FCRA, allow a consumer reporting agency to furnish a consumer report:

• In response to the order of a court having jurisdiction to issue such an order, or a subpoena issued in connection with proceedings before a Federal grand jury.
• In accordance with the written instruction of the consumer to whom it relates.
• To a person which it has reason to believe
  • intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; or
  • intends to use the information for employment purposes; or
  • intends to use the information in connection with the underwriting of insurance involving the consumer; or
  • intends to use the information in connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status; or
  • intends to use the information, as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; or
  • otherwise has a legitimate business need for the information
    • in connection with a business transaction that is initiated by the consumer; or
    • to review an account to determine whether the consumer continues to meet the terms of the account.
• for certain specified uses in connection with the payment of child support.

It should also be noted that the D.C. Circuit's decision in Trans Union v. FTC, 245 F.3d 809 (D.C. Cir. 2001), may result in a more expan sive interpretation of the FCRA by the FTC and the courts, as the court reaffirmed its statement in an earlier opinion that the terms "general characteristics" and "mode of living" could be interpreted to include almost anything about consumers.

2. FTC Gramm-Leach-Bliley Act Regulations: Regulation of Disclosure of Financial Information.

The Gramm- Leach Bliley Act ("GLBA") imposes three general privacy obligations: (1) providing a notice of a financial institution's non-public personal information handling practices; (2) providing individuals with the right to opt-out before information can be shared with non- affiliated third parties for a non-exempted purpose; and (3) instituting data security and integrity mechanisms to protect non-public personal information. The GLBA directed the FTC and other federal agencies with jurisdiction over "financial institutions" to develop rules to implement these requirements. The FTC announced its final trade regulation rule implementing the GLBA in May 2000 (the "GLBA Rule"), which went into effect on July 1, 2001.

3. Cases

[5] A notice need not be given to individuals or companies that obtain products or services for business, commercial, or agricultural purposes.

[6] If the financial institution does not intend to share the personal information of these individuals (who are not customers because there is no established customer relationship) with a non-affiliated third party for a non-exempted pur pose, then no privacy notice must be provided.

[7] See 66 Fed. Reg. 33686 (May 24, 2000).

[8] See 66 Fed. Reg. 33686-33687 (May 24, 2000).

[9] See 66 Fed. Reg. 33687 (May 24, 2000).

[10] The other federal agencies that must establish these standards include: the Office of the Comptroller of Currency ("OCC"); the Board of Governors of the Federal Reserve System ("Board"); the Federal Deposit Insurance Corporation ("FDIC"); the Office of Thrift Supervision ("OTS"); the National Credit Union Administration ("NCUA"); the Secretary of the Treasury ("Treasury"); and the Securities and Exchange Commission ("SEC"). The Commodity Futures Trading Commission ("CFTC") was added to this list by amendment on December 21, 2000.

[11] Although the GLBA permits most agencies to simply issue security guidelines, the FTC and the SEC must implement a specific security rule .

[12] See 66 Fed. Reg. 41162 (Aug. 7, 2001).

[13] The program does not need to be set forth in a single document, as long as all parts of the program are coordinated and can be easily accessed and identified.

[14] See Final Rule: Privacy of Consumer Financial Information (Regulation S-P), 17 C.F.R. Part 248.

D. Identity Theft

1. Identity Theft and Assumption Deterrence Act of 1998: Illegal to Transfer or Use False Identification to Engage in Unlawful Activity.

In October 1998, Congress passed the Identity Theft and Assumption Deterrence Act of 1998 (the "Identity Theft Act") to address the problem of identity the ft. Specifically, the Act amended 18 U.S.C. §§ 1028 to make it a federal crime when anyone:

Federal investigative agencies such as the U.S. Secret Service, the FBI, and the U.S. Postal Inspection Service may investigate violations of the Identity Theft Act. The Department of Justice may also prosecute these violations.

2. FTC v. Martinez: Fake ID Mills.

In FTC v. Martinez, the FTC charged the defendant with providing a Web site that afforded visitors the capability to produce high-quality "fake id's." The FTC alleged that the fake id's could be used to promote identity theft and underage drinking. In its complaint, the FTC claimed that the injury experienced by the victims of identity theft was unavoidable and therefore the defendant's practice was unfair. The FTC also alleged that by providing the means and instrumentalities to violate the law, the defendant's practice was deceptive.

3. R & R Consultants, Inc. Allegedly Fraudulent Credit Card Loss Protection Scheme

In October 2001, the FTC announced that it was taking action against R & R Consultants, Inc., a company that promoted an allegedly fraudulent credit card loss protection program. As part of this program, the defendants promised consumers that they could remove all of their personal information from the Internet to protect them from identity theft.

E. Online Profiling

In early 2000, the FTC began examining "online profiling," which is the practice of surreptitiously collecting data about the Internet activities of consumers in order to target them with advertising. The FTC is concerned about profiling because it is often conducted without consumers' awareness that their Internet use is being tracked. In order to avoid potential federal regulation of online profiling, the Network Advertising Initiative ("NAI") provided a proposal to self-regulate advertisers' online profiling practices through a seal program. The FTC approved and endorsed this initiative. Although the NAI proposal was framed in the context of the creation of consumer profiles by third party advertising networks, the current regulatory environment suggests that it is prudent to follow these practices even when a Web site intends only to create profiles on its own customers.

1. Network Advertising Initiative Proposal

The following principles, proposed by the NAI and endorsed by the FTC, apply to the merging of consumers' personal information with cookies or other data that provide information on their online habits:

• material changes in information practices cannot be applied to information collected prior to the changes in the absence of affirmative consent, or "opt in," by the consumer;
• non-personally identifiable data previously collected from consumers cannot be linked to personally identifiable information ("PII") without affirmative consent, or "opt in," by the consumer;
• to prospectively use PII for profiling, and even the merging of personally identifiable online and offline data, must provide "robust" notice and the choice to "opt out," which must appear at the time and place of information collection and before the entering of data;
• to prospectively use non-PII for profiling, must provide clear and conspicuous notice and the choice to "opt out," which must be included in the publisher's privacy policy with a link to the network advertiser or an NAI opt out Web page; and
• on any Web sites where multiple network advertising companies collect information (generally non-PII) consumers must be able to "opt out" of profiling by any or all of the advertisers on a single page that is accessible from the host Web site's privacy policy.

2. FTC Report

In addition to endorsing the NAI proposal, the FTC called for Congress to enact legislation to provide privacy protection for consumers with regard to online profiling practices. The proposed legislation would mimic the NAI Proposal, and center around the basic principles discussed above. The FTC stated that such legislation would complement the NAI self- regulatory structure by guaranteeing compliance by non- member network advertising companies. The proposed legislation would provide the implementing agency with the authority to grant safe harbors to self-regulatory principles. The FTC stated that it believes the NAI proposal would qualify for such a safe harbor, but that other industry groups or individual firms would be free to apply for safe harbor approval as well. Under the proposed legislation, all network advertising companies and all consumer-oriented commercial Web sites that permit the collection of information from or about consumers by network advertising companies would be required to comply with the fair information practices described above.

F. Cookies and Web Bugs

Online profiling is often accomplished by placing tracking files such as "cookies" and "web bugs" on consumers' computers when they access certain Web sites. Cookies collect information that is used to develop a market profile of individual computer users. Web bugs are graphics on a Web site that monitor who is viewing the Web site and are usually invisible because they are typically only 1-by-1 pixel in size. Cookies and web bugs cause concern because they trace consumers' online movements without consumers' awareness that their Internet activities are being tracked. The FTC and state Attorneys General have brought lawsuits to prevent the use of cookie s and web bugs by Internet companies.

1. Michigan Web Bug Cases: Undisclosed Use of Web Bugs by Third Party Agents.

The Michigan Attorney General recently published Notices of Intended Action against several companies in connection with their alleged undisclosed use by third party advertising networks of Web bugs.

• In the Matter of Ortho Biotech
• In the Matter of AmericasBaby.com, Inc.
• In the Matter of Stockpoint, Inc.
• In the Matter of iFriends Network, Inc.

2. Esurance: Undisclosed Use of Cookies

The Michigan Attorney General recently reached a settlement with Esurance regarding allegations of the company's undisclosed use by third party advertisers of cookies to track Internet activities and compile demographic information. As part of the settlement, Esurance agreed to post a privacy policy on its site with links to these companies.

3. Missouri Web Bug Case: Undisclosed Use of Web Bugs by Third Party Agents.

The Missouri Attorney General recently announced a law enforcement action against More.com alleging the undisclosed use of Web bugs by third parties to receive or share information about consumers' visits to More.com's Web site.

4. DoubleClick: Failing to Disclose Use of Cookies.

On May 10, 2000, eleven federal class action lawsuits brought against DoubleClick, Inc. ("DoubleClick), were consolidated in the United States District Court for the Southern District of New York. Subsequently, two other federal class action lawsuits brought against DoubleClick were also added to the consolidation for pretrial proceedings, bringing the total to thirteen. The members of the classes had sued DoubleClick to challenge its use of "cookies" as well as its use of the Abacus Direct database to match users' personal information with their Internet surfing habits.

On March 28, 2001, Judge Naomi Reice Buchwald dismissed the federal claims brought by the class members, finding that (1) the Electronic Communications Privacy Act ("ECPA") does not apply to conduct authorized by "users," and that because DoubleClick's affiliated Web sites - not the individual consumers - constituted the "users," their authorization met the ECPA's requirements; (2) the Wiretap Act does not apply because only one party's consent is necessary to access a communication, and DoubleClick's affiliated Web sites, which were parties to the communications, gave the necessary consent to DoubleClick; and (3) the Consumer Fraud and Abuse Act does not apply because the individual class members could not prove that they had each suffered $5,000 in damages, and the $5,000 threshold may only be aggregated if the conduct at issue consists of a single act. Judge Buchwald also dismissed the state claims brought by the class members for lack of jurisdiction.

On June 11, 2001, Judge Lynn O'Malley Taylor of the Superior Court of California in Marin County, denied Doubleclick's demurrer in the class action lawsuit Judnick v. DoubleClick. This lawsuit also challenged Doubleclick's alleged failure to disclose its use of cookies. In denying Doubleclick's demurrer, Judge Taylor determined, among other things, that the plaintiffs' allegations were sufficient to show a serious invasion of privacy, in violation of the California Constitution.

5. Chance v. Avenue A, Inc.: Failing to Disclose Use of Cookies.

A private enforcement class action law suit was brought against Avenue A as a result of Avenue A's alleged undisclosed placement of cookies on users' computers that allowed Avenue A to track users' Internet activities and compile personal information for commercial purposes.

6. Rivera v. MatchLogic : Failing to Disclose Use of Cookies.

Plaintiffs filed a class action challenging the advertising network's allegedly undisclosed use of cookies.

7. Dearman v. Toys "R" Us, Inc.: Undisclosed Sharing of Information with Third Party Agent.

Plaintiffs brought a class action against Toys "R" Us, Inc., Toys "R" Us.com and Coremetrics, Inc. alleging that Toys "R" Us.com collected confidential information in an unauthorized manner and disclosed the information to Coremetrics.com - an agent working for the defendants - in contravention of Toys "R" Us.com's privacy policy.

8. Stewart v. Yahoo: Undisclosed Use of Cookies.

This pending class action challenges Yahoo's Broadcast.com's alleged undisclosed use of cookies. By using these cookies, the Defendants were allegedly able to obtain confidential information from consumers without their awareness or consent.

G. Complying with Agreed-to Third Party Privacy Policies

The FTC has charged one Internet company with failing to comply with agreed-to third party privacy policies.

1. FTC v. ReverseAuction.com: Failing to Comply with Third Party Privacy Policy.

The FTC alleged that ReverseAuction.com violated eBay's User Agreement and Privacy Policy after affirmatively indicating acceptance of the policy's terms. (ReverseAuction.com had agreed to comply with the User Agreement and Privacy Policy when it registered with eBay by clicking the "I Agree" button.) The FTC's intervention suggests that it will use the full power of the U.S. Government to enforce User Agreements and Privacy Policies between private entities, at least on behalf of major Web sites, and when it perceives widespread consumer injury.

H. Bankruptcy

As the "dot.com" market declines, many Internet privacy issues arise when online companies file for bankruptcy and attempt to sell their assets -- particularly information databases collected under privacy policies that state that the companies will not sell consumer information.

1. FTC v. Toysmart.com: Misrepresentation Regarding Treatment of Children's Personal Information.

Following enactment of the COPPA Rule, the FTC settled a case against Toysmart.com. Toysmart.com was an online toy retailer that collected family profiles, including the names and birth dates of children, which triggered application of COPPA. Toysmart.com promised in its privacy statement to never share information collected from consumers with a third party. However, the company subsequently filed a motion in bankruptcy court seeking to sell its assets, including its database of personal information.

The FTC charged that this constituted a violation of COPPA and Section 5 of the FTC Act because Toysmart.com collected names, e- mail addresses, and ages of children under thirteen without notifying parents or obtaining parental consent. The FTC demanded that Toysmart.com be prohibited from selling the database as a stand-alone asset, but agreed to allow its sale within one year to a "qualified buyer" that agrees to the terms of the original privacy policy.

2. Texas v. Living.com: Sale of Data in Bankruptcy Proceeding

The Texas Attorney General announced a settlement with Living.com, which like Toysmart.com, was insolvent and considering the sale of its customer information. Under the terms of the settlement, Living.com was required to destroy its customer financial records, including bank accounts, credit card and social security numbers. Living.com will be allowed to sell customer names and email addresses, but only after customers are given the opportunity to "opt out" of the proposed sale. Living.com had provided in its privacy policy that it might share personal information with third parties in the future, but that it would no do so if a consumer did not consent.

3. In re Essential.com: Sale of Data in Bankruptcy Proceeding

The Massachusetts Attorney General recently reached an agreement with Essential.com, which, similarly to Toysmart.com, wished to sell its customer database of roughly 70,000 customers as part of a bankruptcy proceeding. The Massachusetts Attorney General sought to block this sale because Essential.com's privacy policy stated that customer data would only be sold to accomplish the company's business objectives. To resolve this matter, Essential.com agreed to provide its customers with notice and an opportunity to decide whether they wish to have the entity that buys Essential.com's business to continue their service. If any customer chooses not to have their service continued by the purchaser, Essential.com agreed to destroy that customer's personal data.

II. EMPLOYEE PRIVACY RIGHTS

A. Monitoring Employee E-Mail

The Electronic Communications Privacy Act ("ECPA") (discussed in further detail above in Section I) provides protection for employees that are subject to workplace e- mail monitoring. However, in addition to the exception for party consent, there are several other exceptions that narrow the scope of the ECPA in the workplace and which allow employers to monitor their employees e-mail activities under certain circumstances:

• Employers who provide electronic communication services to employees are generally exempt from liability under the ECPA for intercepting, disclosing or using the content of an employee's e- mail message if:
  • employees are notified in advance;
  • the action is incident to the rendition of the communications service; or
  • the action is necessary to protect the rights or property of the company;
• Courts have interpreted unlawful "interception" narrowly, to mean acquisition of an electronic message during the actual transmission of the message from one party to another. Thus, because an e- mail message is in transit for a very short period of time, the ECPA offers little protection for employees against employers who monitor e-mail usage by recalling sent messages from the network's memory; and
• Section 2510(5)(a) of the ECPA permits a communications services provider to intercept e-mail as long as the intercepting device is part of the communications network and the device is used in the ordinary course of business.

To reduce risk of liability for monitoring employee e-mail usage, each employer should require all employees to acknowledge and sign an e-mail and Internet use policy. An employer also can reduce its risk of liability for defamation, transmission of obscene materials, sexual harassment and discrimination committed by employees on workplace computers by requiring compliance with such a policy.

B. State Law

1. Connecticut

Connecticut enacted a statute specifically directed to workplace privacy. The statute provides that employe rs that are engaged in electronic monitoring must give prior written notice to their employees, informing them of the types of monitoring that may occur. CONN. GEN. STAT. § 31- 48d(3)(b)(1) (2001). Electronic monitoring includes collection of employees' activities or communications by any means other than direct observation, including through a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic or photo-optical systems (electronic monitoring does not include monitoring for security purposes in common areas of the employer's premises). Id. § 31-48d(3). However, employers do not have to provide prior written notice to any employee that the employer has reasonable grounds to believe is engaged in conduct that violates the law, violates the legal rights of the employer or other employees, or creates a hostile work environment. Id. § 31-48d(3)(b)(2).

The California legislature tried twice to pass legislation similar to that of Connecticut, but both times California Governor Gray Davis vetoed the bill.[15]

2. California

Employers should also be mindful of a recent California statute, which requires businesses to ensure the privacy of a customer's personal information contained in records by destroying or arranging for the destruction of the records by shredding, erasing or otherwise modifying the customer record to make information contained therein unreadable or undecipherable through any means. See CA CIVIL CODE §§ 198.80-198.815. Failure to comply with this statute could make an employer liable for damages, injunctive relief or other remedies. Id. This statute will likely apply to employers that monitor their employees e-mail usage because they inevitably become privy to and collectors of their employees personal information contained in electronic communications.

[15] See http://www.wired.com/news/privacy/0,1848,42029,00.html

C. Cases

The practice of monitoring of employees' e- mail communications is a highly charged issue that has resulted in litigation over whether such a practice is an invasion of employees' privacy. Generally, courts have found that employees do not have a reasonable expectation of privacy in their workplace email communications.

1. McLaren v. Microsoft Corp., No. 05-97-00824-CV, 1999 Tex. App. LEXIS 4103 (Texas Ct. App., May 28, 1999).

Despite the fact that employee filed email messages in a "personal folders" application on his office computer that was password-protected, the employee did not have a reasonable expectation of privacy that would prevent the company from viewing the files. The court determined that the employee's email messages were not personal property, but were part of the office environment. In addition, the company's need to prevent inappropriate use of its email system outweighed the employee's privacy interest. Accordingly, the company had a legitimate right to access the data stored in the "personal folders."

2. Smyth v. The Pillsbury Co., 914 F. Supp. 97 (E.D.Pa. 1996).

The court determined that the employee did not have a reasonable expectation of privacy in using the internal email system to communicate with his supervisor, even though the company previously stated that email communications would remain confidential. Accordingly, the court found that it was not unlawful for the company to intercept the employee's email and terminate him for transmitting inappropriate communications over the company's email system.

3. Thomasson v. Bank of America, No. A061120 (Cal. Ct. App. 1994), app. den., 1995 Cal. LEXIS 1843 (1995).

Employee challenged his termination, alleging that he was terminated because his employer learned that he worked as a gay stripper in his off- hours through print-outs of email messages that he left in a printer tray and that the employer had no right to misuse information contained in an email. The court found that the employee had no reasonable expectation of privacy in the fact that he was a stripper, because a publicity photograph of him was posted outside the theater where he performed. The employer did not violate the employee's right to privacy by using information included in an email as grounds for dismissal.

4. Shoars v. Epson America, Inc., No. B 073243 (Cal. Ct. App.), rev. den., No. S040065, 1994 Cal. LEXIS 3670 (6/29/94) (no published decision)

Employee challenged her termination after her employer dismissed her for insubordination for crit icizing the company's practice of monitoring employee email. (Flanagan v. Epson America, Inc., No. BC007036 (Cal. Suoer. Ct. Los Angeles County, Jan. 4, 1991), a related class action suit brought by approximately 700 employees whose email was read, was dis missed when the court rejected the class certification.)

5. Bourke v. Nissan Motor Corp., No. B068705 (Cal. Ct. App. July 26, 1993)

Employees had no reasonable expectation of privacy in their e- mail messages, despite the fact that the messages were password-protected, because they were aware that their employer was monitoring the email messages. The employer began monitoring the employees' emails after an email system trainer randomly accessed an employee's email message and noted that it was of a personal and sexual nature. In addition, the court noted that the employees had a signed a statement that said "It is company policy that employees and contractors restrict their use of company-owned computer hardware and software to company business."

III. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996

HIPAA was enacted on August 21, 1996, and directed the Department of Health and Human Services ("HHS") to issue rules (the "HIPAA Rules") to govern the protection of "individually identifiable health information." On December 28, 2000, HHS issued the HIPAA Rules, which protect all medical records and other individually identifiable health information held or disclosed by health insurance agencies and other "covered entities" and their "business associates." Although the Bush Administration initially wavered about whether it would allow the implementation of the HIPAA Rules, they went into effect on April 14, 2001.[16] Compliance with the HIPAA Rules is required by February 26, 2003.

A. Who and what are covered by the HIPAA Rules?

The HIPAA Rules apply to "health plans," "health care clearinghouses," and most "health care providers," which are collectively referred to as "covered entities." The compliance requirements also apply to "business associates"[17] that receive or are exposed to individually identifiable health information while providing services for covered entities. Health insurance agents and brokers that sell health insurance policies[18] are considered "business associates" of health insurers, and are therefore considered covered entities under the HIPAA Rules.

The HIPAA Rules protect all forms of individually identifiable health information (whether electronic, on paper, or oral), which are held or disclosed by covered entities. Individually identifiable health information is information that:

• Is created or received by a health care provider, health plan (including a health insurance issuer or agent), employer, or health care clearinghouse;
• Is related to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual, or the past, present of future payment for the provision of health care to an individual; and
• Either identifies the individual or provides a reasonable basis for believing that it can be used to identify the individual.

[16] HHS has indicated, however, that it may make changes to the rules on a going forward basis. See http://www.cnn.com/2001/HEALTH/04/12/medical.privacy/index.html?s=2.

[17] Business associates are any people or entities that perform certain activities or functions on behalf of a covered entity that involves the use or disclosure of protected health information (i.e., claims processing, benefit management, etc.).

[18] It should be noted that not all insurance benefits are covered by the HIPAA rules, and are therefore exempt from regulation. These benefits include workers' compensation, life, disability, property and casualty, and automobile insurance. Entities that provide health insurance plans and other exempt benefits need only comply with the HIPAA rules with respect to the information gathered in the sale of the health insurance plans.

B. What is required by the HIPAA Rules?

http://www.bxa.doc.gov/Encryption/Default.htm). The BEA is committed to ensuring that U.S. exporters will not be disadvantaged by steps taken by the EU to create a "free-trade zone." The major change to the Export Rules tracks the recent regulations adopted by the EU that permit most encryption products to be exported to the fifteen EU member states and Australia, Czech Republic, Hungary, Japan, New Zealand, Norway, Poland and Switzerland under a license exception. Further, the change to the Export Rules:

• allows the release of consumer products incorporating short-range technologies;
• streamlines reporting requirements;
• liberalizes the export of commercial source code;
• clarifies the treatment of object code compiled from source code (considered publicly available); and
• allows procedures for the release of certain products from U.S. Content Requirements.

In addition, the BEA revised the Guidance section of the Export Rules to provide additional information and clarification on how to submit notifications, commodity classification requests, and licenses. Finally, the BEA updated the chart explaining the licensing mechanisms for the export of encryption technology.

V. SPECIAL RULES FOR TELECOMMUNICATIONS CARRIERS

Section 222 of the Telecommunications Act of 1934, codified at 47 U.S.C. Section 222, provides protection for certain personal information collected by telecommunications carriers about their customers. Specifically, carriers must obtain their subscribers' "approval" before using or disclosing "customer proprietary network information" ("CPNI") for any reason other than providing or billing for the type of telecommunications service from which the CPNI was derived.

CPNI includes both "information that relates to the quantity, type, destination and amount of use of a telecommunications service" that carriers receive as a result of their relationship with subscribers. Thus, for example, CPNI includes the telephone numbers called by subscribers and the length of the calls. CPNI excludes subscribers' name, address and telephone number; aggregate, non-personally- identifiable information; and data from other sources such as non- telecommunications services and data purchased from third parties.

In its implementing rules, 47 C.F.R, Part 64.2001 et seq., the FCC argued that "approval" means affirmative, opt-in consent following consumers' receipt of notice of their rights to CPNI data. In U.S. West v. FTC, 182 F.3d 1224 (10 th Cir. 1998), however, the Tenth Circuit Court of Appeals vacated the FCC's rules, arguing that the requirement of an affirmative, opt- in consent violated the First Amendment to the United States Constitution by restricting protected commercial speech.

The FCC has not yet acted on remand, but it has stated publicly that it will continue to enforce the remainder of Section 222, such as the requirement that telecommunications carriers at least provide consumers with notice and a means of opting out of the use or disclosure of their CPNI information.

VI. INTERNATIONAL PRIVACY LAW

A. European Union Data Protection Directive and the Safe Harbor

The EU Data Protection Directive (the "Directive") took effect on October 25, 1998. The Directive requires EU Member States to adopt regulations that forbid the transfer of data to non- member countries, if those non- member countries fail to provide an "adequate level of protection" for this data under EU standards. Pursuant to the Directive, in order for data collectors in non- member countries to be deemed to be providing an "adequate level of protection," individuals or entities providing data to data collectors must be able to:

• withhold consent to process their data;
• access the data collected about them;
• correct inaccuracies in the collected data; and,
• bring a complaint and seek redress for misuses of their data.

In addition, the data collector must provide its subjects with:

• notice of the purposes for which data is collected;
• the intended uses of the data; and
• any other recipients of the data.

1. Exceptions

There are exceptions to the prohibition against transferring data to countries that do not provide an "adequate level of protection." Under Article 26 of the Directive, even if there is not adequate data protection, a transfer is permissible if:

• the data subject consents to the transfer;
• the transfer is necessary to perform a contract;
• the transfer serves the interests of the data subject or the Member State where the transfer originates; or
• the recipient provides sufficient guarantees that the privacy and fundamental rights of the subject will be protected (i.e. through contracts approved by the EU for this purpose).

2. Safe Harbor

EU officials had generally determined that U.S. privacy protections would not provide an "adequate level of protection," unless one of the above-mentioned exceptions were satisfied. The EU's determination that U.S. privacy protections were "inadequate" was significant because it would have hindered certain transfers of personal data to the U.S. However, in July 2000, the U.S. Department of Commerce negotiated the Safe Harbor[19] to the Directive (the "Safe Harbor" to provide a means for U.S.-based companies to avoid interruption of their business operations with the EU and avoid regulation and prosecution by EU authorities under the Directive. By certifying with the Safe Harbor, EU organizations may be assured that U.S. companies have "adequate" privacy protection, as detailed under the Directive (as provided above).

Compliance with the Safe Harbor provides U.S. companies with the following benefits: (19) the 195 European Member States must abide by the European Commission's finding of adequacy; (2) companies that comply with the Safe Harbor will be considered to provide "adequate" privacy protections and data flows to these companies will continued uninterrupted; (3) the requirement for Member States prior approval of data transfers will either be automatically granted or waived; and (4) charges brought against U.S. companies by E.U. citizens will be heard in the U.S., subject to certain exceptions.

The list of companies that have chosen to comply with the Safe Harbor may be found at the Department of Commerce's Web site, http://www.export.gov/safeharbor.

[19] Id.

B. Organization for Economic Cooperation and Development Privacy Principles

The Organization for Economic Cooperation and Development (the "OECD") developed guidelines (the "OECD Guidelines") governing the protection of privacy and transborder flows of personal data. The OECD Guidelines apply to personal data in both the private and public sectors of Member countries and generally provide that:

• there should be limits on the collection of data, collection should be accomplished lawfully, and where appropriate the data subject should give consent;
• personal data should be relevant for the purpose of use and should be accurate, complete and current;
• the purpose of collection should be stated at the time of the data collection;
• personal data should not be disclosed or used other than for its stated purpose, unless the data subject consents or the disclosure or use is authorized by law;
• personal data should be protected by reasonable security safeguards;
• there should be a general policy of openness regarding the practices with respect to personal data and the identity of the data controller;
• an individual should have the right to obtain confirmation from the data controller of whether or not the data controller has data relating to him, have the data communicated to him (within a reasonable time, at a reasonable fee, if any, in a reasonable manner, and in an intelligible form), be given reasons if a request is denied, and challenge data relating to him, and if successful have that data erased, corrected or amended; and
• the data collector should be accountable for complying with these principles.

The OECD Guidelines also provide that Member countries should make efforts to ensure that the transborder flow of personal data is uninterrupted and secure. Furthermore, Member countries should only restrict the flow of data to countries that do not abide by the above- mentioned principles. Finally, the OECD Guidelines encourages Member countries to adopt appropriate domestic legislation in light of the OECD Guidelines, support self-regulation, provide a reasonable means for individuals to exercise their rights, and provide sanctions and remedies for noncompliance.

C. Canada, Hong Kong and New Zealand

If you are is considering conducting business in the following countries, please consult with the legal department before doing so because the rules in these countries differ from those of the United States.

1. Canada

Canada's Personal Information Protection and Electronic Documents Act ("Bill C6") became effective on January 1, 2001. Bill C6 will initially apply to organizations that are under the federal government's direct regulatory power, but will be extended to all organizations (except those government organizations subject to a separate Privacy Act) on January 1, 2004. However, if provincial governments pass their own privacy legislation before January 1, 2004, Bill C6 will not necessarily apply to all organizations (for instance, the province of Quebec already has its own privacy legislation). Under Bill C6, organizations must abide by the "Ten Privacy Principles" that were originally proposed by the Canadian Standards Associations. The "Ten Privacy Principles" are:

• accountability;
• identifying purposes for which data is collected;
• consent, generally via opt out;
• limiting collection to that which is reasonably necessary for identification purposes;
• limiting use, disclosure, and retention;
• accuracy;
• safeguards, whether physical or via encryption;
• making privacy policies known;
• individual access, which may be limited under some circumstances and for which a fee may sometimes be charged; and
• a complaint procedure for alleged violations of the "Ten Privacy Principles" and a means for sanctioning and awarding damages for violations.

2. Hong Kong

The Hong Kong Personal Data (Privacy) Ordinance (the "Ordinance") provides that a data user may not engage in any act or practice that contravenes a data protection principle that is set forth in the Ordinance. Schedule 1 of the Ordinance details the data protection principles that govern the collection of personal data, and includes the following provisions:

• data must only be collected for a lawful purpose and the data collected must be related to that purpose;
• the data subject must be informed about such collection;
• data is not to be used, without consent, for any purpose other than the stated purpose;
• data will be kept secure;
• a person must be informed of a data user's polices and practices regarding personal data; and
• data subjects shall have access to their data.

3. New Zealand

New Zealand's Privacy Act 1993 (the Privacy Act) governs the collection, use and disclosure of personal information and access to such information in both the public and private sectors. The Privacy Act sets forth twelve specific principles with which data collectors must comply (See http://www.privacy.org.nz/search.html). There is also proposed legislation to amend the Privacy Act that may be enacted by mid-2001. This amendment would qualify New Zealand's Privacy Act as providing an "adequate level of protection" under the EU Directive (See http://www.privacy.org.nz/news3.html). The amendment would remove the requirement that in order to make an access or correction request, the individual making the request must be a New Zealand citizen, New Zealand permanent resident, or in New Zealand at the time of the request. In addition, the amendment would prohibit the transfer of personal information from New Zealand to another jurisdiction if that jurisdiction does not provide comparable safeguards, if the proposed transfer may circumvent laws of the jurisdiction from where the information originated, and if the transfer is likely to breach the principles set out in the OECD Guidelines.