Privacy Class Actions Lag Behind the Online World

Plaintiffs' attorney Scott Kamber is a privacy watchdog for consumers in the online world. Over the years, he's filed many class actions against companies over various security breaches of online information.

But recently, he's focused his efforts on a different type of online privacy suit. He's filed dozens of class actions against Web sites like Facebook and Netflix, claiming they have sold users' personal information to advertisers, and they shouldn't have.

“It's all about advertising,” says Kamber, who formed New York-based KamberLaw last year. “These cases are all about the extent to which companies will be able to monetize their Internet activities by selling the data of users. And there's nobody looking out for consumers' interests.”

A growing number of plaintiffs' attorneys seem to agree. As news outlets chronicle high-profile privacy blunders by companies like Google, Facebook, and Zynga, lawyers in Silicon Valley are dealing with a new wave of privacy class actions involving online advertising. Plaintiffs accuse companies of misdeeds ranging from improperly selling users' information to tracking consumers' online activity without their consent or knowledge.

There's one thing defense and plaintiffs' attorneys can agree on: Current U.S. laws do not clearly define what online companies can and can't do, nor what remedies are available for violations.

Most of the current privacy class actions involving online advertising are being filed under statutes written years before social media sites like Facebook existed. For example, the Electronics Communications Privacy Act (“ECPA”; www.law.cornell.edu/uscode/18/usc_sup_01_18_10_I_20_119.html) was written in 1986 to extend government restrictions on wiretaps to data transmitted via computers. Now, courts have to decide if that same law also defines and protects consumers' privacy in an online world, where it's never been tested before.

“In some ways, it's the Wild West of litigation,” says litigator John Nadolenco, a partner at Mayer Brown in Los Angeles. “Courts are trying to apply really old statutes and legal concepts to a world that is totally different than when the laws were passed, and it's a struggle by and large.”

As public concern grows, legislators, regulators and the White House have joined the debate, saying existing laws must be strengthened and new ones written. The Obama Administration recently announced that it's creating a privacy task force and appointing a new online privacy czar (www.whitehouse.cov/the-press-office/2010/12/16/president-Obama-announces-more-key-administration-posts-121610).

But until that happens, both plaintiffs and defense attorneys will be watching these class actions closely to see how courts redefine consumers' privacy in an online world flooded with personal information, much of which people have willingly provided themselves.

Defining Harm

It's the pollution problem of the information age, says Kevin Bankston, a senior attorney with the Electronic Frontier Foundation, a nonprofit advocacy group in San Francisco supporting online freedom of speech and privacy.

People are voluntarily putting a lot of personal information online, in some cases without considering how their virtual footprints can be collected and put to use by corporate America.

Kamber says consumers may willingly put their personal information online, but they still want to know who is collecting that information, and how it's being used: “The consumer doesn't know who the advertiser is that's taking their information.”

But what are the damages? Kamber admits that actual harm is difficult to prove and quantify in court. “We believe we can,” he says. “But there's limited case law in this area.”

Michael Rhodes, chairman of Cooley's national litigation department, has come up against Kamber in two class actions involving Facebook. They were opposing counsel in 2009 when Facebook agreed to terminate its controversial Beacon marketing program. (Beacon took information about what a user had browsed or bought and broadcast that information to others ' sometimes with embarrassing results. See, http://mashable.com/2009/09/19/facebook-beacon-rip.) Under settlement terms struck at mediation and approved by U.S. District Judge Richard Seeborg, Facebook agreed to pay $9.5 million, with up to a third of that going to cover attorneys' fees and the rest set aside to create an online privacy foundation. Privacy advocates want the Ninth U.S. Circuit Court of Appeals to undo the deal.

“It's a heightened Silicon Valley issue because the people attracting the most attention are here,” Rhodes says. “And the online business models have come out of the Valley.”

More Laws or Self-Regulation?

Plaintiffs' attorneys are filing more of these suits to see how far they can take existing laws, Rhodes says. And their biggest challenge is adapting old statutes to fit new business models that didn't exist when the laws were written.

“Some of it will get sorted out in courts, and I think you're going to see a combination of regulatory attempts to create some guidance that will come out of Congress and EU,” Rhodes says. “In what form, I couldn't say.”

Bankston says he agrees that laws such as the ECPA need revision. The law is notoriously confusing, and on top of that, old. “That doesn't mean it's not a correct basis for these claims,” he says.

But he concedes that clarity from Congress would help. Nadolenco agrees that Congress needs to act, much like it did in 1998 when it passed the Digital Millennium Copyright Act (“DCMA”; www.copyright.gov/legislation/pl105-304.pdf) that amended copyright laws to account for online technologies. “Otherwise you're going to have this piecemeal approach,” he says.

Kamber, however, believes Americans don't want a tightly regulated Internet. More regulations aren't needed, and consumers need better rules faster than legislators can take action. Privacy class actions like the ones he's filing are forcing companies to take action now to protect consumers' personal information.

“Companies need to figure out what the rules should be,” Kamber says. “We are the consumer's voice for self-regulation.”

Plaintiffs' attorney Scott Kamber is a privacy watchdog for consumers in the online world. Over the years, he's filed many class actions against companies over various security breaches of online information.

But recently, he's focused his efforts on a different type of online privacy suit. He's filed dozens of class actions against Web sites like Facebook and Netflix, claiming they have sold users' personal information to advertisers, and they shouldn't have.

“It's all about advertising,” says Kamber, who formed New York-based KamberLaw last year. “These cases are all about the extent to which companies will be able to monetize their Internet activities by selling the data of users. And there's nobody looking out for consumers' interests.”

A growing number of plaintiffs' attorneys seem to agree. As news outlets chronicle high-profile privacy blunders by companies like Google, Facebook, and Zynga, lawyers in Silicon Valley are dealing with a new wave of privacy class actions involving online advertising. Plaintiffs accuse companies of misdeeds ranging from improperly selling users' information to tracking consumers' online activity without their consent or knowledge.

There's one thing defense and plaintiffs' attorneys can agree on: Current U.S. laws do not clearly define what online companies can and can't do, nor what remedies are available for violations.

Most of the current privacy class actions involving online advertising are being filed under statutes written years before social media sites like Facebook existed. For example, the Electronics Communications Privacy Act (“ECPA”; www.law.cornell.edu/uscode/18/usc_sup_01_18_10_I_20_119.html) was written in 1986 to extend government restrictions on wiretaps to data transmitted via computers. Now, courts have to decide if that same law also defines and protects consumers' privacy in an online world, where it's never been tested before.

“In some ways, it's the Wild West of litigation,” says litigator John Nadolenco, a partner at Mayer Brown in Los Angeles. “Courts are trying to apply really old statutes and legal concepts to a world that is totally different than when the laws were passed, and it's a struggle by and large.”

As public concern grows, legislators, regulators and the White House have joined the debate, saying existing laws must be strengthened and new ones written. The Obama Administration recently announced that it's creating a privacy task force and appointing a new online privacy czar (www.whitehouse.cov/the-press-office/2010/12/16/president-Obama-announces-more-key-administration-posts-121610).

But until that happens, both plaintiffs and defense attorneys will be watching these class actions closely to see how courts redefine consumers' privacy in an online world flooded with personal information, much of which people have willingly provided themselves.

Defining Harm

It's the pollution problem of the information age, says Kevin Bankston, a senior attorney with the Electronic Frontier Foundation, a nonprofit advocacy group in San Francisco supporting online freedom of speech and privacy.

People are voluntarily putting a lot of personal information online, in some cases without considering how their virtual footprints can be collected and put to use by corporate America.

Kamber says consumers may willingly put their personal information online, but they still want to know who is collecting that information, and how it's being used: “The consumer doesn't know who the advertiser is that's taking their information.”

But what are the damages? Kamber admits that actual harm is difficult to prove and quantify in court. “We believe we can,” he says. “But there's limited case law in this area.”

Michael Rhodes, chairman of Cooley's national litigation department, has come up against Kamber in two class actions involving Facebook. They were opposing counsel in 2009 when Facebook agreed to terminate its controversial Beacon marketing program. (Beacon took information about what a user had browsed or bought and broadcast that information to others ' sometimes with embarrassing results. See, http://mashable.com/2009/09/19/facebook-beacon-rip.) Under settlement terms struck at mediation and approved by U.S. District Judge Richard Seeborg, Facebook agreed to pay $9.5 million, with up to a third of that going to cover attorneys' fees and the rest set aside to create an online privacy foundation. Privacy advocates want the Ninth U.S. Circuit Court of Appeals to undo the deal.

“It's a heightened Silicon Valley issue because the people attracting the most attention are here,” Rhodes says. “And the online business models have come out of the Valley.”

More Laws or Self-Regulation?

Plaintiffs' attorneys are filing more of these suits to see how far they can take existing laws, Rhodes says. And their biggest challenge is adapting old statutes to fit new business models that didn't exist when the laws were written.

“Some of it will get sorted out in courts, and I think you're going to see a combination of regulatory attempts to create some guidance that will come out of Congress and EU,” Rhodes says. “In what form, I couldn't say.”

Bankston says he agrees that laws such as the ECPA need revision. The law is notoriously confusing, and on top of that, old. “That doesn't mean it's not a correct basis for these claims,” he says.

But he concedes that clarity from Congress would help. Nadolenco agrees that Congress needs to act, much like it did in 1998 when it passed the Digital Millennium Copyright Act (“DCMA”; www.copyright.gov/legislation/pl105-304.pdf) that amended copyright laws to account for online technologies. “Otherwise you're going to have this piecemeal approach,” he says.

Kamber, however, believes Americans don't want a tightly regulated Internet. More regulations aren't needed, and consumers need better rules faster than legislators can take action. Privacy class actions like the ones he's filing are forcing companies to take action now to protect consumers' personal information.

“Companies need to figure out what the rules should be,” Kamber says. “We are the consumer's voice for self-regulation.”